Use Arkiv incognito

Reduce wallet linkage in user-owned Arkiv records, with optional anonymous group permissions.

Arkognito is an open-source SDK and a set of self-hostable services that reduce wallet-based linkage in Arkiv apps. Each record is owned by a fresh one-time address that only its user can recompute, and is written by a shared relayer in a shuffled, padded batch. The user still owns every record, can find all of them again from any device, and can prove that one of them is theirs without revealing the others.

Arkognito is experimental and runs on the Arkiv Tiramisu testnet only. The protocol is version 0.x and may change, and the cryptography has not had an outside audit. See Security. Wallet separation does not guarantee complete anonymity: public metadata, content, timing and network observations can identify users.

The problem in one query

Every Arkiv entity stores its $owner and $creator, and both are indexed. Anyone can run:

$owner = addr(0xYourWallet)

and get every record that wallet ever wrote, in every app. Separate small actions (a stock report in one app, a note in another, a sketch in a third) add up to a profile. Expiring records does not help: the data stays readable in transaction history. Read more.

What Arkognito changes

	Plain Arkiv	With Arkognito
$owner of your records	Your wallet, on every record	A different one-time address on every record
$creator	Your wallet	A relayer, shared by every user
One owner query on your wallet	Returns everything you wrote	Returns nothing
Who pays gas	You, per write	The relayer
Finding your records	Owner query	myEntities(), from any device, without telling anyone which records are yours
Proving one record is yours	Implicit	proveOwnership(), for one record, one verifier, one challenge
Anonymous eligibility	Application-specific	Optional Semaphore proofs show approved group membership without identifying the member

In the original synthetic Tiramisu experiment, the tested observer grouped 50 records from five synthetic users no better than random guessing. This is evidence for that workload and observer, not a general anonymity guarantee or a Semaphore benchmark. See the linkage experiment.

Start here

Quickstart

Run a relayer and write your first private record in about five minutes.

Add it to an app

Replace createEntity with the private client. Same parameters.

Self-host the network

Two relayers, a token issuer and an OHTTP relay with one docker compose up.

Anonymous group permissions

Enroll members, generate proofs and independently verify submissions.

What is in the box

• SDK (arkognito): derives one-time owners in a Web Worker, seals and pads records, finds and verifies your records privately, issues ownership proofs, handles rate-limit tokens and Oblivious HTTP. Works in browsers and Node.
• Relayer: batches records from many users, writes them to Arkiv, hands each to its one-time owner, and pays the gas. Anyone can run one.
• Token issuer: hands out daily blind rate-limit tokens with quotas per issuance identity.
• Optional Semaphore module: group administration, recoverable anonymous membership proofs, proof-gated relaying and history-based duplicate checks. Integration status.
• OHTTP relay: forwards encrypted requests so relayers never see users’ IP addresses.

Everything is MIT licensed. Arkiv holds public records, groups, discovery and token state; Semaphore admission also requires a durable local journal. Relayer operators and RPC providers remain trust and availability dependencies. Source on GitHub.

Credential policies are optional: see Integrations and the Anon Aadhaar integration guide. It covers proof-based enrollment and the existing Arkognito group APIs. Synthetic test proving was explored separately; a production admission adapter is not included.