What is public and who sees it

Status: Built, runs on simulatorStatus: Coming soonStatus: Built, runs on simulator

Payment amounts and commitments are public; keeping an income opening out of the public record does not make every part of a series confidential.

The current design separates what the chain needs from what a reviewer needs. It also has an important onchain-income exception, described below.

Public mechanism data

The public proof inputs include the terms commitment, outstanding units, conversion rate, prior and current income commitments, and payment amount. Token holdings, revealed bids, and payment movements are visible onchain.

Status: Coming soon

Removing amounts from an application activity feed cannot remove them from the chain. Do not treat a quieter interface as concealment of the underlying transaction.

Terms and evidence

Information	Who can access it in the pinned design
Threshold, rate per unit, and their opening	The issuer, eligible backers through logged reads, and the reviewing attestor for an amendment.
Tier-3 income documents and openings	The chosen attestor, through encryption addressed to that reviewer. The server stores ciphertext without that decryption key.
Hardship pause reasons and evidence	The chosen attestor. Holders see status and dates, not reasons.
Payment and proof records	Public onchain amounts, with role-specific views in the application.

Stage 2's privacy document records these permissions. It also says retention and deletion are not yet automated. Intended deletion rules should not be read as a purge that already runs.

Arrows mean access to the named information, not a transfer of funds. The issuer retains its own terms and evidence. The chosen attestor sees evidence for its task; a backer's terms access does not include that evidence. The report verifier sees the attested figure and prior opening briefly in memory. Admin access to an encrypted evidence copy does not supply the recipient's decryption key.

The tier-1 exception

A series using the onchain income router stores its threshold and rate per unit in plaintext. Routed income is public as well. A general statement that the protocol hides income would therefore be false.

Even outside that path, public payment amounts can reveal information. As a deduction from the formula, a viewer who knows the terms and enough surrounding amounts may infer parts of the income history. A commitment is not a promise that no inference is possible.

What a reviewer contributes

A reviewer can inspect evidence the holder cannot. That access is specific to the task; it does not turn the evidence into a public entitlement. The covered-income explanation explains why the agreed scope matters as much as the arithmetic.

What can go wrong

Public chain records persist. A compromised device or reviewer key can expose material intended for a limited recipient. The committed proof setup is development-only and must be replaced before production use; its presence is not a production confidentiality or authenticity assurance.