What backers can and cannot see

Status: Built, runs on simulatorStatus: Coming soon

Backers can see more than a status: payment amounts and chain records are public, while income documents and hardship reasons use narrower access paths.

Terms and public records

The backend's privacy map gives eligible backers access to the threshold, rate per unit and related terms. Each read is logged, and eligibility is checked when the terms are read. A terms commitment is public onchain; it is not a public copy of all committed fields.

The reporting proof exposes payment and commitment inputs rather than the raw income figure. Tier-1 series are an exception to a broad hidden-terms description: the registry stores their threshold and rate in plaintext for the onchain split route.

Payment amounts, wallet addresses, statuses and events can be public onchain. Keeping an amount out of a public activity feed does not remove it from the chain. Private payouts are coming soon; the current payment record should not be treated as concealed.

Evidence has different readers

For the verifier-assisted path, the report verifier sees income evidence in memory. For the accountant-attested path, the chosen attestor receives an encrypted opening and documents that it can decrypt. The server's privacy map records that it does not hold the decryption key for those envelopes.

Holders receive report rows without the income-source kind. For hardship, holders can see state and dates, while the chosen attestor receives the reason and evidence. The signed contract bundle has a separate access rule: the signer and administrator can read it, with reads recorded in the audit log.

These are descriptions of the inspected implementation and its privacy map. Retention periods remain unresolved, and deletion is not automatically performed. They are not a promise that a recipient cannot retain information it has already seen.

What can go wrong

Public amounts and accessible terms can support inferences even when a raw figure is absent. Copying evidence into public messages also bypasses the intended access boundaries. Treat the audience of each field separately; the status display is only one part of what is visible.