Privacy Policy

Last updated: 21 June 2026

1. Summary

Zephyros is a non-custodial protocol. We do not maintain user accounts, we do not require email or KYC, and the only personal identifier we can observe is your Solana public key when you interact with the relayer.

2. Data the website itself processes

Standard request metadata (IP address, user-agent, timestamp) is available to the hosting provider (Vercel) for the duration needed to serve the request and detect abuse. Zephyros shows a cookie consent banner where you can choose Essential-only or enable Marketing cookies. Essential features are always on. If you enable optional categories, related cookies may be set by Zephyros or the selected services. Local browser storage holds your shielded notes, cookie preferences, (encrypted at rest with a key derived from your wallet signature) and a small Merkle-tree cache. Nothing is uploaded.

3. Data the relayer processes

When you withdraw, the browser sends our relayer service a Groth16 proof, the recipient address, and the fee. The relayer signs and submits the Solana transaction. It does not link your deposit to your withdrawal because the proof itself reveals nothing about which note is being spent. The relayer applies a per-IP rate limit and logs failed transactions for debugging; logs are kept no longer than 30 days and are not shared with third parties.

4. On-chain data

Solana is a public blockchain. Anyone can observe deposits, withdrawals and balances. The privacy property Zephyros offers is unlinkability between the depositor and the withdrawer of a note inside the anonymity set, not on-chain confidentiality.

5. Your rights

Because we do not hold personal data tied to your identity, most GDPR-style requests do not apply. If you contact us with a verified identity, we will tell you what (if anything) we can find tied to you and delete what is deletable.

6. Contact

security@zephyros.cash