Privacy by disclosure class

Update log

• 7 September 2026 - First edition. Drawn from the White Paper's effect classes, the Yellow Paper's effect algebra, admissibility kernel and privacy lanes, the architecture programme's chapters on external claims, receipts and denials, history as corpus and the research horizon, and the portal's legal page. Object names are given as the shape of the design.

Short answer

Public ledgers made every balance a broadcast and then tried to add privacy back with add-ons. FxChain's direction starts from the other end. Privacy is one of the effect classes a claim declares - beside value, authority, state, time and external effects - and the Yellow Paper gives it four forms: reveal, commit, prove, shield. Because "finality plane, fee dimensions, denial invariants, quarantine eligibility, receipt shape and audit views all derive deterministically" from the declared effect set, the disclosure profile of a claim - what is visible, to whom, in which audit view - is a function of what the claim declared, not a setting someone toggled later.

Three rules follow. Denial privacy: "the reason class of a denial is public; the full detail is claimant-scoped. A sealed claim's content must not be reconstructable from its public denial." Reconstructible reason without unbounded disclosure: an actionable refusal may name the rule, the failed obligation and the missing evidence class, but the programme separates a reason an auditor can reconstruct from a channel that leaks what the claimant was not entitled to know. Privacy never blocks finality: "heavy privacy computation is asynchronous; it never blocks capsule finality" - proofs may be produced in privacy lanes, but the capsule does not wait for them.

What exists today is small and outside the protocol: this portal collects no personal data, runs no analytics and keeps only technical logs, and no personal identity appears anywhere on it. The protocol's privacy machinery is design, and every specification of the local line says so.

What is established, what is in development, what is not claimed

Privacy as an effect, not a setting

The Yellow Paper's effect algebra types every consequence a claim may have, and privacy is one of its dimensions. A claim that reveals declares that its content is public; one that commits publishes a commitment and keeps the preimage; one that proves discloses a property without the data; one that shields discloses neither. The point is not the menu but what depends on it: the audit view, the fee vector, the receipt shape and the finality plane are all functions of the declared set, so a claim cannot be private in one place and public in another by accident.

   claim declares effect set  { value, authority, state, time, PRIVACY, external ... }
                                                   |
                       +---------------------------+---------------------------+
                       v                           v                           v
               disclosure profile          fee vector (privacy           receipt and
               and audit view              priced separately)            denial shape

Figure 1 - Privacy as a declared effect. Everything downstream derives from the declaration; nothing is toggled afterwards.

The White Paper's comparison with ordinary fee models makes the economic side explicit: fees are vectors - compute, state, bandwidth, urgency, privacy, data availability - "priced separately", against a one-dimensional congestion fee. Privacy costs what it costs, in its own dimension, and cannot be subsidised by hiding it in another.

Denial privacy

The admissibility kernel refuses claims in a frozen order of verdicts, and the refusal is where privacy is most easily lost: a detailed reason is a detailed description of the claim. The Yellow Paper's rule is therefore two-sided. The reason class is public - an evaluator can see that a claim failed a capability check or a constitution binding. The detail is claimant-scoped - only the claimant learns which capability, which binding. And a hard constraint sits above both: "A sealed claim's content must not be reconstructable from its public denial."

The architecture programme carries the same rule into institutional refusals. An actionable denial may, "where disclosure is safe", name the applied rule, the failed obligation, the missing evidence class, the authority basis and a bounded remediation hint; and it separates a reconstructible reason - enough for an auditor to reconstruct why - from unbounded disclosure - enough for a competitor to reconstruct what.

   refusal
     |
     +--> public ........ reason class, stable reason code, invariant named
     |
     +--> claimant ...... full detail, remediation hint, appeal path
     |
     x   never ......... the sealed claim's content, reconstructed from the above

Figure 2 - Denial privacy. Being told why is a right; learning what someone else asked is not.

The cheap-reject tier, described in the evidence-objects dossier, is part of the privacy design too: syntax, signature and replay failures produce unsealed refusals with no object, so the cheapest attack - probing a system with malformed claims to learn from its answers - learns only that the claim was malformed.

Privacy that never blocks finality

Privacy computation is expensive, and expense on the hot path is either a denial-of-service vector or a reason to skip privacy. The Yellow Paper's privacy lanes avoid both: proofs are produced in a proving lane, computation on encrypted data in another, key splitting in a third, and "heavy privacy computation is asynchronous; it never blocks capsule finality." A capsule seals what has been judged; a proof that arrives later is bound through the evidence tiers, not waited for.

   capsule finality (deterministic, never waits)
        |
        |   privacy lanes (asynchronous)
        |     proving ........ property disclosed, data withheld
        |     ciphertext ..... computation without decryption
        |     split keys ..... no single holder
        |
        +-- bound afterwards through the evidence tiers

Figure 3 - Lanes beside the path, not on it. Finality is a function of the judged claim; privacy work joins by evidence.

Compliance without judgement in consensus

The programme's finance chapter requires "compliance claims, sanctions screening, travel-rule data, eligibility, jurisdiction, consent, privacy, retention, and disclosure" to be defined "without placing nondeterministic legal judgement inside consensus". The pattern is the settlement-truth pattern again: a compliance determination is an external claim with a source, an authority epoch, a time, a revocation and a disclosure class; the protocol judges its presence and binding, not its legal merit. Every artifact carries a privacy class and a retention class; every named primitive declares its privacy properties in its concept contract; and the corpus replayed for promotions is "the complete privacy-permitted accepted corpus" - what may not be replayed is excluded by class, and the exclusion is disclosed.

For markets, the same chapter names orderflow privacy profiles, fair sequencing and market-state commitments, and the White Paper's law that no subsystem "may speak its own risk dialect" applies: a market's privacy is an effect declared under the same algebra as everything else.

   compliance determination  (external claim: source, epoch, time, revocation,
                               disclosure class)
        |
        v   the protocol judges: present? bound? in scope? fresh?
        |   the protocol never judges: is it legally correct?
        v
   verdict on the claim, not on the law

Figure 4 - Compliance as evidence. Legal judgement stays outside consensus; its presence and binding are what the protocol verifies.

What the portal practises

The protocol's privacy is design; the portal's is practice, and it is the only privacy claim on this site that is proven today. The legal page states it: no account, no personal data collected, standard technical logs kept for security and operations and not used for profiling, no analytics or tracking scripts, only the technical cookies the framework requires. The site plan adds a rule the pages obey: no personal identity anywhere, a single public address for contact, and no reproduction of the papers or specifications. A portal about a privacy-respecting protocol that tracked its readers would be its own counter-example.

What the privacy doctrine does not do

• It runs nowhere. No confidential transaction, shielded balance, privacy lane or disclosure profile exists on the local line.
• It does not make privacy absolute: a reveal is a reveal, and the reason class of a denial is public by design.
• It does not put legal judgement into consensus. Compliance is an external claim with a disclosure class.
• It does not let privacy delay finality; lanes are asynchronous.
• A privacy-preserving verifier ecosystem is an explicit research horizon, not a plan.

Verdict

FxChain's privacy is a consequence of its effect algebra rather than a product: declare what a claim reveals, commits, proves or shields, and the audit view, the fee and the receipt follow. Its most careful rule is about refusal - a public reason class, private detail, and a sealed claim that cannot be rebuilt from its own denial - because refusal is where transparent systems leak. Its most practical rule keeps privacy off the critical path: lanes beside finality, joined by evidence. None of it exists yet, and the portal says so; what the portal can prove is only its own conduct, which is why it collects nothing.

Frequently asked questions

Are FxChain transactions private?

There are no FxChain transactions on any network. In the direction, privacy is an effect a claim declares - reveal, commit, prove or shield - and the disclosure that follows is derived from the declaration.

If my claim is refused, who learns why?

You learn the full detail; the public learns the reason class and the invariant. The design forbids reconstructing your claim from its public denial.

Does privacy slow the chain down?

By design, no. Heavy privacy computation runs in asynchronous lanes and never blocks capsule finality; it joins the record through the evidence tiers.

How does compliance fit?

As external claims with a source, an epoch, a disclosure class and a revocation. The protocol verifies that a determination is present and bound; it does not perform legal judgement inside consensus.

What does the portal itself collect?

Nothing personal. Technical server logs for security and operations, framework cookies, no analytics, no tracking, and no personal identity on any page.

Sources and methodology

Drawn from the White Paper's effect classes and fee comparison, the Yellow Paper's effect algebra, admissibility kernel and privacy lanes, the architecture programme's chapters on external claims and compliance, receipts and denials, history as corpus and the research horizon, and the portal's legal page and site plan. Quotations are from those sources. The portal's own practice is the only claim reported as proven today; every protocol claim carries the status research.

The papers and the programme are not published on this portal and are not reproduced here; effects, lanes and classes are reported as shape. Figures shown anywhere on this portal come from a single dated snapshot; none are introduced by this dossier.

Related reading: Receipts, denials and capsules for the refusal tiers; FxIntent for declared effects; The evidence algebra for the tiers privacy work joins through; Legal for the portal's own practice.