Privacy
What a BSV wallet gets for free, what the user still controls, and the one leak that is a coin selection decision.
Most of the privacy work in a BSV wallet is not a feature the user turns on. It happens in how the wallet derives keys and selects outputs, and the user never sees it.
What is left for the interface is small, and worth doing properly.
What happens without asking
Every payment goes to a key derived for that payer and that payment, from a secret only the two parties share. So there is no reused address, nothing for an observer to group payments around, and no privacy setting for the user to find and fail to enable.
Don't
Build an address-reuse warning or a "generate fresh address" control. Both solve a problem BSV already solved, and their presence implies the default is unsafe.
The leak that is still yours to manage
Every input to a transaction is visibly controlled by whoever signed it. Spend an output received from an employer alongside one received from a friend, and an observer learns the same person received both.
That is a coin selection decision, made by the wallet, not by the user. See Coin selection.
Do
Prefer selections that keep outputs from unrelated counterparties apart. The saving from combining them is a fraction of a penny; the cost is linking two relationships.
Don't
Expose coin control to ordinary users as the answer. On BSV the fee argument for it is gone, and the privacy argument is better served by selecting well than by asking somebody to.
Hiding the balance
A useful feature, though not for the reason it is usually built. The threat is not surveillance; it is the person standing next to you.
Do
Make hiding reachable in one gesture from the home screen, and make it stick until deliberately reversed.
Do
Hide amounts in activity too, not just the headline balance. A hidden total above a visible list of payments is not hiding anything.
What the wallet's services learn
A wallet asks header services for headers, broadcast services to send transactions, and storage services to hold its records. Each learns something: which transactions the user cares about, and the IP address asking. Settings lists each service with what it learns; see Services and help.
Do
Let users change them, or run their own. See Nodes and verification.
What connected apps learn
An app only knows what the wallet told it, which is the design's main privacy benefit and the thing to keep true.
Do
Show, per app, what it has been granted. See Security.
Don't
Reveal the user's identity key or profile to an app for a routine payment unless the user chose to. It permanently links a name to spending. See Identity.
What to tell users
Avoid "private" and "anonymous", which are both false. Say what is true and what it depends on:
Payments on BSV are public, but they do not carry your name and each one uses a new key. What can link them is spending them together, so your wallet keeps money from different people apart where it can.
Recommendation
Put that explanation where a user looking for privacy settings would find it, rather than in a help article. The honest answer is more reassuring than a toggle that does nothing.
Notes and on-chain data
A note travels with a payment and reaches the other party's records. What a note should hold is on Requesting.
Don't
Write personal data on chain in the clear. There is no delete. See Wallet privacy.
Open questions
- Does the plain privacy explanation reassure people more than a toggle would?
- Should the wallet keep unsolicited small payments apart from other money?
Related
- Wallet privacy: the concept in full
- Coin selection
- Security
- Activity: hiding amounts in the list
Written from: BRC-42, BRC-69, BRC-100, BRC-151.
Checklist
The rules on this page, in a form you can work through.
10 rules