Fig. 07 / Questions

Straight answers

What is actually encrypted?: The note, and the pairing between the note and the people involved. Encryption is NaCl secretbox (XSalsa20-Poly1305) with a key derived from the envelope keypair, performed in your browser before anything is sent.
What is NOT encrypted?: The lamport amount is visible on-chain, because the envelope is a real Solana account holding real SOL. This is Level A — Social Seal. Pretending otherwise would be a lie, and a privacy product that lies is worse than no product.
Where does the key live?: In the URL fragment of the claim link, after #k=. Browsers never transmit the fragment to a server, so the key never reaches us. If you lose the link, nobody — including us — can open or recover that envelope.
Do you ever hold my money?: No. There is no custody and no escrow program. The envelope is a one-time Solana account funded by your own signed transaction, and it is swept by whoever holds the envelope key.
What if the recipient never claims?: After 7 days you can return the value to yourself from the Outbox — you will need the original claim link, since that is where the key lives. Before then, the same action works as a cancel.
Is the claim link a bearer instrument?: Yes, deliberately. Anyone holding the link can open the envelope, exactly like a physical envelope of cash. Send it over a channel you trust.
Which network is this?: Solana mainnet-beta. Every signature is a real transaction you can verify on a block explorer — there is no simulation mode anywhere in this app.
What is Level B?: Token-2022 confidential transfers, where the amount itself stops being trivially readable. It is the next step, not a current claim.