Use Arkiv incognito

Arkognito keeps every Arkiv record owned by its user while making records impossible to group by person.

Arkognito is an open-source SDK and a set of self-hostable services that make writes to Arkiv unlinkable. Each record is owned by a fresh one-time address that only its user can recompute, and is written by a shared relayer in a shuffled, padded batch. The user still owns every record, can find all of them again from any device, and can prove that one of them is theirs without revealing the others.

Arkognito is experimental and runs on the Arkiv Tiramisu testnet only. The protocol is version 0.x and may change, and the cryptography has not had an outside audit. See Security.

The problem in one query

Every Arkiv entity stores its $owner and $creator, and both are indexed. Anyone can run:

$owner = addr(0xYourWallet)

and get every record that wallet ever wrote, in every app. Separate small actions (a stock report in one app, a note in another, a sketch in a third) add up to a profile. Expiring records does not help: the data stays readable in transaction history. Read more.

What Arkognito changes

	Plain Arkiv	With Arkognito
$owner of your records	Your wallet, on every record	A different one-time address on every record
$creator	Your wallet	A relayer, shared by every user
One owner query on your wallet	Returns everything you wrote	Returns nothing
Who pays gas	You, per write	The relayer
Finding your records	Owner query	myEntities(), from any device, without telling anyone which records are yours
Proving one record is yours	Implicit	proveOwnership(), for one record, one verifier, one challenge

Measured on Tiramisu, an outside observer trying to group 50 records from 5 people did no better than random guessing. See the linkage experiment.

Start here

Quickstart

Run a relayer and write your first private record in about five minutes.

Add it to an app

Replace createEntity with the private client. Same parameters.

Self-host the network

Two relayers, a token issuer and an OHTTP relay with one docker compose up.

Understand the design

How one-time owners, batching, blind tokens and Oblivious HTTP fit together.

What is in the box

• SDK (arkognito): derives one-time owners in a Web Worker, seals and pads records, finds and verifies your records privately, issues ownership proofs, handles rate-limit tokens and Oblivious HTTP. Works in browsers and Node.
• Relayer: batches records from many users, writes them to Arkiv, hands each to its one-time owner, and pays the gas. Anyone can run one.
• Token issuer: hands out daily blind rate-limit tokens, so relayers can limit writes per person without learning who wrote what.
• OHTTP relay: forwards encrypted requests so relayers never see users’ IP addresses.

Everything is MIT licensed, and all shared state lives on Arkiv: there is no database to run and no operator to trust. Source on GitHub.