Ownership you can prove without publishing it.

01 Summary

Settlement on a public chain is legible by design, and that legibility is what makes it trustworthy. The cost is that legibility does not stop at settlement. Anyone with an indexer can read a position size, follow it backwards through every counterparty it has touched, and infer intent from the timing.

Stockora inserts a shielded set between the holder and the public record. Deposits become commitments. Claims about those commitments become proofs. The chain keeps its job — it still decides what is valid — but it stops being a directory of who holds what.

02 Why this chain

Robinhood Chain carries tokenized equities as first-class assets rather than as wrapped imports, and it settles against a native dollar unit. Both matter here.

• The assets are the sensitive ones. A stablecoin balance says little. An equity position says what you think is going to happen, and to whom.
• No bridge in the path. The holdings being shielded are already native, so the set never inherits wrapped-asset risk on top of its own.
• The audience is retail. Privacy that requires a manual is privacy nobody uses. Everything below is built to disappear behind an ordinary transfer flow.

03 What is being defended against

Three observers, in rising order of effort. The design is only meaningful if it is clear which one it stops.

• The reader. Anyone running an explorer or a screener. Sees every balance and every transfer today. Stopped fully.
• The correlator. Someone joining on-chain records with an off-chain identity — an exchange withdrawal, a public address, a leaked list. Stopped for holdings and counterparties; timing remains an approximate signal.
• The global observer. Someone watching the network layer and the chain at once. Not fully stopped by the current release; the relay work in section 06 is what closes it.

04 Layer one — the commitment set

A deposit produces a commitment: a fixed-size entry binding the asset, the amount, and a secret only the depositor holds. Entries are appended to a sparse Merkle structure whose root the chain tracks. The root proves membership. It reveals nothing about members.

Spending an entry publishes a nullifier derived from the same secret. The set can tell that some entry has been spent exactly once without being able to tell which one. This is the whole of the double-spend defence, and it is the part that must never be wrong.

05 Layer two — one-time recipient keys

A shielded balance is worth little if receiving it re-links you. Each incoming transfer is directed to an address derived from the recipient's viewing key and a value the sender picks at random. The recipient scans for entries they can open; nobody else can tell that two arrivals belong to the same person.

The recipient never has to publish anything to receive. That is the property that makes the flow usable by someone who does not care how it works.

06 Layer three — shared relaying

A proof still has to reach the chain, and whoever submits it pays for it. If you submit your own, the fee-paying address becomes the link the previous two layers removed.

The planned answer is a bonded relayer pool: submitters stake $STOCKORA, forward proofs on behalf of holders, and are paid out of protocol fees. Misbehaviour — censoring, reordering for advantage, leaking submission metadata — is slashable. This layer is not live and is described here as intent, not as a shipped guarantee.

07 The ownership route

• Commit. Deposit an asset; a commitment is appended and the local secret is stored in your vault.
• Prove. Produce a statement about one entry — that it exists, that it is yours, that it clears some threshold — and nothing about the rest.
• Transfer. Spend an entry, publish its nullifier, and write a fresh entry to a one-time address for the recipient.
• Verify. Anyone holding a proof checks it against the current root. No account needed, no permission asked.

08 Assets the set accepts

Tokenized equities and the native dollar unit at launch. Anything else has to be onboarded deliberately, because each asset added to a shielded set shrinks the crowd that any one holder hides in. A set with one exotic asset and four holders is not private, whatever the cryptography says.

Onboarding is therefore a governance decision measured against expected depth, not a listing race.

09 Stack

• Proofs generated in the browser, so the secrets never leave the device.
• Circuits kept deliberately small; the membership and nullifier logic is the part worth auditing hardest.
• Set state anchored on Robinhood Chain; the contract is the only authority on validity.
• Vault material stored locally and exportable, so a lost browser is not a lost position.

10 Token

$STOCKORA pays for relaying, bonds the relayers who do it, and votes on which assets the set accepts. Fees generated by usage flow back to that same set of participants. There was no pre-allocation and no private round.

11 What is actually different

• It shields equities, not just cash. That only works on a chain where equities are native, which is why this is not a design that ports somewhere else unchanged.
• Three separate leaks, three separate answers. Holdings, identity and submission metadata each get their own layer instead of one primitive marketed as covering all three.
• Partial disclosure is a first-class action. Viewing keys let you open exactly one position to exactly one party, on purpose, without opening the rest.

12 Risks

• Thin sets. Privacy is a function of how many people are standing in the same place. Early on, the set is small, and that is a real limitation rather than a temporary marketing problem.
• Circuit risk. A flaw in the nullifier logic is a mint. Audits and a bounded deposit cap during the early phase are the mitigation; neither is a proof of safety.
• Regulatory attention. Shielded ownership on a chain built for regulated assets will draw scrutiny. The position taken here is consumer financial privacy with user-controlled disclosure — never disclosure taken from the user by default.
• Relayer centralisation. Until the pool in section 06 is live and genuinely plural, submission is the weakest link in the chain described above.

13 Sequence

• Now. Commitment set and one-time recipient keys, running against a capped deposit limit.
• Next. Viewing keys and scoped disclosure; export and recovery hardening.
• After. Bonded relayer pool, then removal of the deposit cap once the set has depth worth relying on.