Privacy at Fable

On-chain privacy does not make your network connections anonymous. Public addresses, transaction times, amounts and information you share can still link activity to you.

What Fable protects at each stage

Fable represents private balances as encrypted notes. Zero-knowledge proofs let you spend them without publishing which notes you own or which ones paid for the spend. The transaction itself is still visible on chain.

Shield: enter the pool

What Fable provides: Your deposit creates a private note that can later fund a send, withdrawal or swap without the spend proof identifying that deposit.

What stays public: The depositing address, token, amount and deposit time. Shield does not hide the transfer into the pool. Matching amounts and timing can still suggest a link to later activity.

Hold: keep a private balance

What Fable provides: Your wallet decrypts its own notes locally. The pool does not publish a balance indexed by your Fable address, so observers cannot simply look up that address to read your private holdings.

Limits: Public deposits and exits remain observable. Anyone with your viewing key can read your private activity; someone who compromises your wallet or device may also learn it.

Send: transfer inside the pool

What Fable provides: The transfer token, recipient and amount are hidden from public chain observers, and the proof does not identify the private notes spent. The recipient can decrypt what they receive. With a broadcaster, the broadcaster’s gas-paying address submits the transaction instead of yours.

Limits: Transaction time, proof structure and encrypted outputs remain public. A broadcaster reads its own fee note; if that fee shares the transfer proof, it can identify the transfer token, though not the transfer amount. A separate fee-token proof avoids that particular disclosure. Submitting from your own account makes that account public.

Withdraw / Unshield: leave the pool

What Fable provides: The spend proof does not reveal which private notes funded the withdrawal. A broadcaster can submit an eligible withdrawal without putting your own gas-paying address on it.

What stays public: The receiving address, token, amount, fees and time. A known receiving address can identify you. A withdrawal sent from your own account, including a pending-note exit or a return of a flagged deposit, also exposes that sending account. Check the transaction review for the actual route.

Swap / DeFi: use funds from the pool

What Fable provides: Supported swaps use an executor to interact with a DEX. The spend proof hides which private notes paid for the swap. Proceeds returned to the pool become a new note without publicly naming its owner.

What stays public: The DEX interaction, tokens, amounts, route and timing, including the proceeds deposited back into the pool. Fable does not make the underlying DeFi trade secret. Quote providers see the swap parameters sent to them. Using your own account to submit also exposes that account.

These protections hide information in proofs and encrypted notes; they do not prevent every inference. Reusing public addresses, distinctive amounts, close timing or revealing information to a service can still link activity. Network IP exposure is a separate boundary, described below.

Before you continue

The website host and any CDN or reverse proxy serving this page receive your connection IP and request metadata. These requests happen before the first-visit notice. Acknowledging it starts the app’s business connections, including public pool and Explorer reads. It cannot undo earlier exposure.

The notice stores only an acknowledgement in this browser’s local storage. It adds no tracking request, identifier or cookie. It remains until you clear site data or your browser removes it. With storage disabled, it lasts only while the app remains mounted.

What Fable stores, and what is not verified

The reviewed web application has no analytics or remote error-reporting integration. Wallet settings and identity checks are stored in your browser; the wallet also caches public chain data and encrypted wallet records in IndexedDB. These remain until site data is removed, with pending transaction records managed by the wallet.

We have not verified the live website host, CDN, reverse-proxy access logs, infrastructure error logs or every service operator’s retention settings. Their purposes and retention periods are not confirmed here. We therefore cannot promise that no IP addresses are retained or that no access and transaction profiles can be built. Processing a connection exposes an IP even when it is not saved.

Do not send anyone your mnemonic, private keys or viewing key. The web app derives its wallet identity from an external wallet signature and keeps wallet secrets in a Worker. The optional viewing-key export reveals your full viewing history and must not be shared unless you intend that access.

RPC and the optional private relay

This build’s default RPC origins: https://bsc.rpc.sentio.xyz, https://rpc-bsc.48.club. Settings can override these. Encrypted HTTP forwarding is not configured in this build. Service requests use direct connections, with Waku for broadcaster messages.

The app reads chain data through the RPC endpoints configured for this deployment or selected in Settings. Your external wallet uses its own provider for signing and public transactions. A dedicated or “private” RPC is not an anonymous network: its operator may see the connection source, queried data and transaction simulations.

Fable supports an optional encrypted HTTP route: browser → ingress relay → broadcaster → RPC or other service. When configured, the ingress sees the source IP and traffic timing; the broadcaster decrypts the forwarded requests and sees the ingress connection. This separation requires independent operators that do not collude. Website requests and your external wallet’s traffic are outside that route. Support in the code does not establish that this deployment has enabled it; no such guarantee is made here.

Community broadcasters and Waku

Community broadcasters are independently operated. Fable cannot promise that every operator avoids logging. A direct HTTP broadcaster can see the connection IP, request timing and submitted transaction data. Broadcaster process logs can also output transaction hashes, proof indices and registration outcomes for diagnostic purposes. When connecting through Tor, the broadcaster normally sees the Tor exit IP.

The bundled Waku broadcaster can persist request IDs, expiry times and transaction hashes or failure results to prevent duplicate submissions. Expired records are removed when the replay store is opened or updated, rather than by a guaranteed deletion deadline. This record format has no IP field; it does not constrain operators’ other logs or backups. Published blockchain transactions remain public.

With Waku, your browser connects to entry service nodes that can see its IP, connection timing, packet sizes, and the Waku pubsub and content topics used to route messages. The transaction message itself is encrypted for the selected broadcaster, which decrypts the payload but does not receive the original browser connection through Waku. An entry node and broadcaster under the same operator, or cooperating operators, can correlate traffic. Waku is not an IP anonymity tool. Node discovery may also contact DNS-over-HTTPS providers or a signed node-list host.

Other services

Indexers receive requests for pool history. Quote services receive swap parameters and contact trading venues. While Fable’s reference deployment configures the quote service reverse proxy without access or error logging, upstream venues and hosting infrastructure remain unverified. Attestation nodes maintain an append-only admission log of proofs, public signals and transaction coordinates to enable offline verification by replicas. In direct mode these services can see your connection source and the information sent to them; with the optional private HTTP route they receive forwarded requests. Circuit-file hosts see downloads. Each operator controls its own logs and retention, which are not verified here.

Using Tor Browser

For stronger network privacy, use Tor Browser before your first visit. If you already opened Fable directly, switch network environments and revisit; this does not erase earlier requests. Tor Browser protects traffic routed through it, not all traffic on your device. External wallets and extensions may connect independently.

The notice, full explanation and acknowledgement were checked in Tor Browser against a local preview, with Tor internet routing verified separately. This does not validate the deployed services. Fable requires an injected EIP-1193 wallet for signing, which Tor Browser does not provide. Shield, Swap, Send and Unshield are unavailable in that setup. Do not install extra extensions just to connect a wallet in Tor Browser, or assume another wallet’s requests use Tor.

Hiding an IP cannot remove links from public addresses, timing, amounts or information you disclose. See the Tor Project’s safety guidance.