Plain-language definitions of every term you’ll meet in the Cloak app and docs
Every term Cloak uses, in plain language, in alphabetical order. Definitions here match the app and the rest of these docs exactly.
Three terms carry most of the weight: private balance, UTXOs, and backup file. If you read nothing else, read those — and remember: your backup file is the money.
Anonymity set — The crowd your transaction hides in: all the other activity in the same pool. The more a pool is used, the harder it becomes for a chain-watcher to link any deposit to any withdrawal.Backup file — A JSON file, downloaded from Backup & Restore, that restores your private balance on any device. It is a bearer instrument and a point-in-time snapshot: anyone holding it can withdraw your funds, so guard it like cash and re-export it after new activity.Change — The UTXO that comes back to you when you spend more than a payment needs, like coins handed back at a register. Every private transaction creates up to two new UTXOs: one for the payment, one for your change.Commitment — The sealed on-chain record of a UTXO, proving it exists without revealing its amount or owner. The chain stores commitments; the details stay with you.Gasless — A property of private sends and swaps: your wallet pays no gas and never appears as sender. The transaction is submitted for you — your wallet only signs a sign-in message.Merkle tree — A data structure that lets the chain confirm a UTXO belongs to the pool without pointing at which one. Each Cloak pool keeps its own tree, with room for roughly 4.3 billion UTXOs.Note — The friendly name for a UTXO; the app and these docs use both. See UTXO.Nullifier — A one-time tag published when a UTXO is spent, guaranteeing the same UTXO can never be spent twice — without revealing which one it was.Payment link — A single-use link funded from a shielded deposit; whoever holds the link can claim the funds to their own wallet, no address exchange needed (payment links). Treat this link like cash — and note that unclaimed links are not included in your backup file.Payroll — Cloak’s batch payment surface: many private sends in USDC or USDT, one transaction per recipient. Each recipient is paid from the pool, so your wallet never appears as the payer.Pool (shielded pool) — The on-chain account where everyone’s shielded funds of one token sit together; Cloak runs a separate pool for each token (SOL, USDC, USDT). Shielded pools are like sealed envelopes in a public mailbox: everyone sees mail, not what’s inside.Private balance — Your shielded funds: the total value of your UTXOs, encrypted and held only by you, never on Cloak’s servers — which is why the backup file matters.Private send — A payment from your private balance to any Solana address or .sol domain. On-chain, the funds arrive from the Cloak pool, and the recipient receives the exact amount you entered — the fee is added on top.Private swap — Swapping shielded SOL into any Jupiter-verified token, delivered to an address you choose as a normal public balance. The link back to your funding wallet stays hidden; routing goes through Jupiter for the best price.Proof of funds — Showing a counterparty that you hold or received funds by disclosing your own history with a viewing key. Disclosure covers your transactions only — never anyone else’s (prove your funds privately).Screening — An automatic check of every transaction against sanctions and high-risk lists before broadcast, run with Range, Cloak’s screening partner. Flagged transactions are blocked with a support path; on the happy path you never see it.Shield / unshield — Shielding moves tokens from your wallet into your private balance (the app’s Deposit); unshielding moves them back out to a wallet. In the app, unshielding is a private send with your own address as the recipient — there is no separate withdraw screen.Sign-in message — The message your wallet signs to unlock Cloak; the signature authenticates you and encrypts your local data. It never moves funds, and it is not a backup: signing in on a new device does not restore a private balance..sol domain — A human-readable Solana name (like maria.sol) that resolves to a wallet address. Private send accepts .sol domains directly as recipients.Treasury — The on-chain account where the program collects protocol fees. Fees are taken on-chain by the program itself — nothing else in Cloak charges a fee (see the fee table).UTXO (unspent transaction output) — A private note of value inside your private balance, created when you shield or receive and consumed when you spend. Each private transaction consumes up to two UTXOs and creates up to two new ones. Your UTXOs are encrypted, held only by you, and carried in your backup file.Viewing key — A read-only key that can decrypt your transaction history — amounts, fees, recipients — but can never move funds. Read access and spend authority are cryptographically separate (compliance).Wallet (and Wallet Standard) — The Solana app (Phantom, Solflare, Ledger, among others) that signs your deposits and sign-in messages; any wallet supporting the Wallet Standard is detected automatically. Your wallet is not a backup: it cannot restore a private balance — only the backup file can.Zero-knowledge proof — A way to prove a statement is true without revealing anything else; Cloak uses Groth16 proofs, generated in your browser in under three seconds. The chain verifies the proof, never the details (zero-knowledge without the math).
