Start here
How it works
Shield, hold, spend, pay, prove: the lifecycle of money inside a Noirpay account, and the two keys that control it.
Status: pre-launch. Noirpay is being built. This page describes the design as specified in the whitepaper; nothing on it is live on Robinhood Chain yet, and details can change before launch. See What's live today.
Noirpay is an account, not a mixer. The account is the product; the shielded pool underneath is plumbing. This page walks through what happens to a dollar from the moment it enters.
1. Shield
Money enters through a licensed fiat ramp or a bridge to Robinhood Chain. At the boundary of the pool it is screened: sanctioned sources are refused before anything is shielded. What passes lands in the pool as one or more encrypted notes bound to your spending key. From that moment the chain sees a deposit into the pool; it does not see whose balance grew.
2. Hold
A balance is the sum of the notes your spending key can open. Notes can hold USDG or tokenized stocks. Your app decrypts them locally, in the browser; the Noirpay server never sees your positions (what Noirpay sees). You can split notes across vaults for savings, trading, business and spending, and the app consolidates fragmented notes in the background so proofs stay fast.
3. Earn
Shielded deposits are pooled and routed into Robinhood Chain yield venues. Returns are credited pro-rata per note, so you earn without a visible deposit, a visible claim, or a visible balance. Auto-sweep moves idle balance into the yield pool on its own. See Private yield.
4. Spend and pay
- The card settles directly from shielded balance, with no unshield step first (Card).
- Payments go to stealth addresses: a fresh receiving address per payment, so a shared handle can never be used to scrape a balance (Payments).
- Recurring payments and DCA schedules run without publishing a repeating on-chain pattern.
- A business pays its whole roster from one treasury in one transaction (Payroll).
5. Prove
When someone legitimately needs to see inside, you issue a viewing key: read-only, scoped to a date range, revocable, and optionally self-expiring (Viewing keys). When they only need a yes-or-no answer, you issue a zero-knowledge attestation instead: balance above X, held N months, not in a tainted set (Attestations).
6. Unshield
Leaving the pool is screened again, and exits are time-decorrelated: scheduled and split so an unshield can't be matched to a shield by timing (Shield and unshield).
The two keys
| Key | Can | Cannot | Held by |
|---|---|---|---|
| Spending key | Open your notes, sign spends, issue viewing keys | — | You. Generated and kept on your device; recoverable via guardians |
| Viewing key | Read the notes inside its scope and date range | Spend, issue further keys, read outside its scope | Whoever you give it to, until it expires or you revoke it |
There is no third key. Noirpay holds no master viewing key and cannot move funds.
What the chain sees
| Event | Public | Hidden |
|---|---|---|
| Shield | A deposit into the pool, screened | Whose balance it became |
| Transfer inside the pool | A proof was verified | Sender, recipient, amount, asset |
| Yield credit | Pool-level routing | Per-note accrual |
| Card settlement | Pool-level settlement to the issuer | Which account paid |
| Unshield | A withdrawal from the pool, screened | Which notes it came from, when they were shielded |