Skip to main content
Once your funds are in your private balance, value can move in exactly two directions — and almost all the confusion about Cloak comes from mixing them up:
  • Out to a public address — a private send (pay someone) or a withdraw (cash out to yourself). The value leaves the pool and lands as ordinary, spendable SOL in a wallet.
  • Sideways to another shielded balance — a shielded transfer. The value never leaves the pool; it stays private and only its ownership changes.
  • A payment link is the third shape and sits between the two: the value stays in the pool until someone claims it, and the claim is a withdrawal to the claimant’s wallet. It defers the exit rather than avoiding it.
Your private balance has two ways out: private send / withdraw sends value out to a public address as liquid SOL, or a shielded transfer moves it sideways to another shielded balance where it stays private

​
Exit 1 — out to a public address (send & withdraw)

A private send and a withdraw are the same underlying move, which is exactly why they can feel confusing:
  • Private send — pay someone else at their Solana address.
  • Withdraw (unshield) — cash your private balance back out into a wallet you control, so you can actually spend it.
In both cases the funds leave the shielded pool and arrive as normal, liquid SOL in a wallet — the only difference is whose. There’s no separate “withdraw” screen in the app: you use Send for both. Private send vs withdraw: both leave the shielded pool as liquid funds — a private send lands in someone else's wallet, an unshield lands in your own; the link back to your deposit stays hidden Why would you send to your own wallet? Because funds in the pool are a private balance — you can’t pay a merchant, trade, or use them in DeFi while they’re shielded. Unshielding is the exit door back to spendable SOL. And the trick is you withdraw to a fresh wallet, not the one you deposited from — so value moves from your old, public wallet to a clean one with no on-chain link between them. That break in the trail is the privacy.

​
What makes it private

You don’t sign the payment from your own wallet, and your wallet never appears as the sender. The funds arrive at the recipient from the Cloak pool, with no on-chain link back to the wallet that funded your balance. The recipient sees a normal incoming payment; a chain-watcher sees a withdrawal from the pool; neither can trace it to you. Think of the pool as a public mailbox full of sealed envelopes: everyone sees mail moving, no one sees what’s inside or who sent which envelope.

​
What the recipient needs

A public Solana address (or .sol domain). You put it in the Send screen and they receive the exact amount there. They don’t need Cloak, a viewing key, or to do anything — the funds just arrive in their wallet.

​
Exit 2 — sideways, staying shielded

The second way out doesn’t leave the pool at all. The value stays a shielded note; only who can claim it changes. The primitive is a shielded transfer (transfer, public_amount = 0). Shielded transfer: you deposit into the pool, then send — the lamports stay in the pool and only note ownership moves to the recipient; you then hand the recipient the note's secrets off-chain, and they only touch the chain if they later withdraw The catch is how the recipient gets it. If the recipient already has a Cloak key and has shared it with you, the note finds them on its own: your send seals the note’s secrets to their viewing key and publishes that sealed envelope on-chain, and their wallet picks it up on its next scan. Nothing is handed over per payment. If they don’t have a Cloak key, the transfer is a bearer handoff instead: the note is only spendable once you pass its secrets over an off-chain channel, which can be a DM, a QR, a copied blob, or a link. A payment link is just the packaged form of that handoff — a URL that carries the secrets, built on a throwaway key so the recipient needs no Cloak identity up front. It’s the convenient default, not a separate mechanism. (The other flavor: if the recipient already has a Cloak key and shares its pubkey, you transfer straight to it and their wallet discovers the note itself, no link and no handoff needed.)
Send vs. shielded transfer, the one-liner: a private send delivers liquid SOL to a public address (it exits the pool). A shielded transfer delivers a still-shielded note that stays in the pool. A payment link is a deferred exit: the value waits in the pool and leaves it when the recipient claims, landing in their wallet. Pick “send” to pay a normal wallet; keep it shielded to hand off value that stays private end-to-end.

​
All three moves, side by side

The takeaway: “send” and “withdraw” are the same move to different public addresses. A “payment link” is the same exit, deferred: the value waits in the pool until someone claims it, and the claim is what takes it out.

​
The privacy timing that matters

Because a send/withdraw is where value leaves the pool, it’s the privacy-sensitive step — so a few habits help:
  • Let time pass. Funds shielded a while ago are more private than shield-and-send in one motion — separating the deposit and the send in time breaks the correlation for a chain-watcher.
  • Avoid distinctive amounts. Sending an unusual exact amount right after an identical deposit weakens privacy. Round, common amounts and patience strengthen it.
  • Once out, it’s public again. Cloak hides the link between your deposit and this payment; it does not hide what the recipient does with the funds afterward. See privacy is not anonymity.

​
Where next

Payment links

Pay someone with a link, no address needed; they claim it to their own wallet.

Fees

The exit fee that applies when value leaves the pool.

Shielded transfers (SDK)

The transfer primitive behind exit 2 — the bearer-handoff mechanic in full.

Your private balance

Notes (UTXOs), change, and the backup file that holds your claims.