UPAY3FOODInstall
Private payment · Cloak on Solana

Your purchase funding is shielded before settlement.

Cloak hides one thing very well: the on-chain link between your wallet and what you buy. It does not make Pix private and it does not hide amounts entering or leaving the pool. Here is exactly where the line is.

Live today: shielding USDC into Cloak on Solana mainnet. Not live: paying the order's Pix from the pool, which needs a licensed off-ramp partner. Steps 4 and 5 below describe that flow as designed.

  1. 1Your walletpublic
  2. 2Shield into Cloakdeposit visible: wallet, amount, time
  3. 3Cloak shielded poolwhich note paid what: hidden
  4. 4Unshield to off-rampamount and time visible, not your wallet
  5. 5Pix to the merchanta normal Pix: not private

Hidden

  • The link between your wallet and the purchase: the off-ramp is paid from the shared pool.
  • Which deposit funded which payment, and your shielded balance itself.
  • Your wallet history and balances, from whoever receives the payment.

Still visible

  • Pix is not private. The off-ramp, the PSP, iFood and the merchant see the Pix payment as usual.
  • Your shield transaction: wallet, amount, time.
  • The unshield to the off-ramp: amount, time.
  • Cloak's relay can see your shielded history: your viewing key is registered for compliance, by design.

Hidden from whom

Public chain observers, analytics, other usersNo
Off-ramp / Pix recipientNo: funds arrive from the pool (it still sees the Pix and, under KYC, knows its customer)
Merchant, iFoodNever saw your wallet; unchanged
Cloak relay (compliance, registered viewing key)Yes, by design
Anyone with your viewing key or note fileYes, so they are never logged, uploaded or shown

Use it well

Shield in advance and in round amounts: shielding the exact purchase amount right before paying makes the link easy to guess.

The privacy has a price, shown before you confirm: Cloak's withdraw fee is 0.45 USDC + 0.3% (about 0.47 USDC on a R$27.79 order).

Your keys

No seed phrase, no private key, ever. Your wallet signs one message to derive your Cloak key; notes are encrypted on your device. Settlement is disabled until a licensed off-ramp is integrated.

Open wallet