How WiSP works

The diagram in words

Step 1: you shield SOL from your wallet into the pool. Anyone can see that deposit.

Step 2: the pool pays a fresh wallet at a standard size. No transfer on chain goes from your wallet to it.

Step 3: the fresh wallet buys the token, and later sells it. Both trades are public.

Step 4: after a full sale, the wallet's SOL returns to the pool. The next token is bought from another fresh wallet.

#The four steps

1. Shield. You move SOL from a wallet you already use, such as Phantom, into the Privacy Cash pool. The pool records it as a note that only your account can spend. This deposit is public: your wallet, the amount and the time. From here on the SOL is your private balance.

2. Fund a fresh wallet. When you buy a token, the pool pays a new wallet at one of a few standard sizes. The payment comes from the pool, not from your wallet, so no transfer on chain connects the two. That wallet is used for one token only.

3. Trade. The fresh wallet buys the token and holds it. You can add to it or sell part of it later; the token stays in that one wallet. Every trade is an ordinary Solana transaction, built and checked in your browser and signed there by that wallet's key. There is no wallet popup for each trade.

4. Return. When you sell everything, the wallet's SOL goes back into the pool and the wallet is retired. On the default profile this happens right after the sale. Your next token gets a different wallet.

#Who holds which key

Everything starts from one 24-word recovery phrase, made in your browser when you create the account. Every key the app uses is derived from it on your device:

The phrase and the list of your wallets are stored in your browser, encrypted under your password (PBKDF2-SHA256 with 310,000 rounds, then AES-GCM). WiSP has no copy and no key of its own over your funds. The pool's own operator runs a relayer that submits withdrawals; it can delay or refuse one, but the proof fixes the recipient and the amount, so it cannot send your SOL anywhere else. The Security page lists every party that can stop you and how.

Because each position wallet is an ordinary Solana wallet, you can export its key and open it in Phantom without WiSP. See Wallet keys and signed statements.

#What a tracker sees

The diagram in words

In your app: the position wallet is yours, it was paid for by your private balance, it sits beside your other positions, and your app knows your main wallet.

On Solana: a wallet bought a token for 0.5 SOL. It was funded by a pool withdrawal of 0.5 SOL. It paid a fee to WiSP, which marks it as a WiSP wallet. Its owner and the owner's other wallets are not shown anywhere on chain.

What the chain cannot show is which deposit paid for which wallet, and which wallets belong together. What it can show, and what can still be guessed from amounts, timing and your IP, is set out on What stays private, and what does not.

#Standard sizes and why

A wallet is funded at one of these sizes only: 0.5, 1, 1.5, 2, 3, 4, 5, 6, 7, 8 or 10 SOL. An odd size such as 0.73 SOL would be easy to match against your deposit. A standard size sits among the other pool withdrawals of the same size, so a watcher has more candidates to choose from.

The pool had recorded about 858,800 notes by 16 October 2026, but that is its whole history. What hides a withdrawal by timing is the traffic around it: about 42 pool transactions an hour, of every size, measured on 15 October 2026. Some sizes are far more common than others. The Privacy screen shows how often each size appeared in a sample of 361 pool withdrawals, and the size chips on Trade use the same data.

If you want more cover in time, choose a slower privacy profile. It makes the app wait a random time after money enters the pool before it funds a wallet.

#The services the app talks to

When you allow network reads, the app talks to five services. Each one sees your IP.

#Related

• What stays private, and what does not
• Privacy profiles
• Glossary