Blindwoods

Private AI · Robinhood Chain · $BLIND

We can't see you.

Pay from your wallet. Ask with a blind ticket. Nothing we run can link a question to the wallet that paid for it.

Open the appStamp a ticket blind
Sample ticket · what your device keeps

Blindwoods

one ticket
one answer

Serial
7f3a91c2 e04b…5d21e8d0
Stamp
5b1e0c44 9a7f…c18d92af
Worth
1 message, up to 2,000 tokens in and 1,000 out
Valid
72 hours after its key was published
Owner
nobody can say, including us
A woodcut print: a lit town with street lamps and a camera on a pole on the left, a footpath leading into a dark pine forest on the right

Town on the left. Woods on the right. The path is yours.

Follow the path ↓

Trail permit · $BLIND contract address

Pre-launch

Not launched yet. The address appears on this permit the moment the coin exists.

Only trust an address shown on this permit. Anyone can deploy a coin with the same name and ticker.

Launches on Pons · Robinhood Chain · fair launch · paired with USDG · receipt published with it

1

Under the street lamps

In town, the lights are on you.

Most private AI on a public chain still knows exactly who is asking. Blindwoods starts from the other end: separate the payment from the prompt, so there is nobody to point a lamp at.

  1. 01

    Your wallet is your account.

    On a public chain a wallet is a public portfolio: every coin you hold, every trade, every counterparty.

  2. 02

    Every question sticks to it.

    The service can tie each question to the wallet that paid, and keeps the metadata that proves it.

  3. 03

    “No logs” is a policy page.

    Analytics scripts inside the app still report what you do, when, and from where.

  4. 04

    “Verified” often means “present”.

    A badge that checks an enclave report exists is not a check that it is genuine or fresh.

In town

Wallet = account: every request is tied to it

In the woods

Pay with a wallet, ask with a ticket: nothing ties them

In town

Per-account request records, kept for weeks

In the woods

No per-person records exist to keep or hand over

In town

Third-party analytics inside the chat

In the woods

Zero third-party scripts, locked by the page's own policy

In town

A green badge that checks the evidence exists

In the woods

Attestation checked in your browser; your question sealed to the enclave

In town

The token sits beside the product

In the woods

The token is the daily ticket allowance

In town

An owner can change where the revenue goes

In the woods

The fee split is fixed in a contract with no owner

In town

Launch curve bought by insiders in one second

In the woods

Public launch receipt; no exemption but the dev wallet

2

Booth

Get tickets with no name on them.

The booth is the only door that ever sees a wallet. It checks that you paid, or that you hold, and then stamps your tickets without being able to read them. What it writes down is one line: this wallet received this many tickets today.

A woodcut print: a small wooden ticket booth with a lit window and a lantern at the edge of a pine forest, a stack of blank envelopes on its counter

Pack · anyone

Buy with USDG

$0.01 a ticket on Robinhood Chain. A pack is an entitlement: your device draws blind tickets from it in batches of up to 200, so nothing you bought ever expires.

  • Pocket · 500 tickets$5
  • Daily · 2,500 tickets$25
  • Heavy · 10,000 tickets$100
  • Studio · 50,000 tickets$500

Daily stub · holders

Claim them free

Hold 100,000 $BLIND or more and claim tickets every day, paid for by the Compute Pool, which trading fees refill. You sign a message; there is no transaction.

  • Saplingup to 20 a day
  • Groveup to 250 a day
  • Old Growthup to 3,000 a day

Seed tag · gifts

Pass a few on

Turn spare tickets into a seed link. The tickets ride after the #, the part of a link browsers never send to a server, and nothing touches our side until a seed is spent.

blindwoods.app/s#<tickets>

Once drawn, every ticket is the same object: blind, bearer, valid for 72 hours after its key was published, worth one standard message (up to 2,000 tokens in, 1,000 out). A bought ticket and a claimed ticket cannot be told apart, by design.

Try it · real math, in this browser

Stamp one ticket blind, right here.

The booth opens on your first click

Your device

Serial (stays on your device)

not yet

Sealed envelope (sent to the booth)

not yet

At the booth

What the booth receives

not yet

Stamp on the sealed envelope

not yet

It never sees the serial, and never will.

Your device, later

The ticket's stamp

not yet

Check: stamp^e mod n = hash(serial)

not yet

Play the booth

Can you tell whose ticket it was?

Simplified for the page: here the serial is hashed straight onto the key's range, while the product uses RSABSSA-SHA384 (RFC 9474) with PSS encoding. Sealing, stamping and opening are the same operations. Nothing in this box leaves your browser.

Your trail ends here

Treeline

Past this line, nothing follows you.

Two doors and one wall. The first door takes your payment, the second takes your question, and no field, log or key ever crosses from one to the other.

Door 1 · the wallet

Pay, or prove you hold.

USDG for a pack, or a signed claim if you hold $BLIND.

We see

Wallet X is owed N tickets.

A woodcut print of tall pine trunks: the wall between the two doors

the wall

Door 2 · the ticket

Ask with one ticket.

One ticket per message, three for a premium model, five for a picture.

We see

A valid, unspent ticket. Nothing else.

What we see, and what we never see

We see

The wallet that bought or claimed, and how many

We never see

Which wallet a ticket came from

We see

The tx hash of a purchase (public on chain anyway)

We never see

Your questions or answers: they are never written down

We see

A ticket's serial when it is spent, never whose

We never see

An account, an email or a phone (there is none)

We see

Hourly totals for the public meter

We never see

Your IP at the gate, once the relay ships (phase 2)

We see

Nothing else

We never see

A call to any third-party script

Checked in your browser

Before the first question, the app checks the enclave itself, then seals the question to it: the gate in between passes ciphertext it cannot open. A failed or skipped check is a failure, never a warning.

  1. 1

    Release. The enclave's code release is fetched with its digest, signed by its build and recorded in a public transparency log.

  2. 2

    Hardware. The enclave's report is checked against the processor vendor's keys, in your browser.

  3. 3

    Match. What the hardware measured must equal what the signed release says it should be.

  4. 4

    Key. The key your question is sealed to must be named inside that report: only that enclave can open it.

  5. 5

    Verdict. Only when every check passes is the question encrypted and sent. Otherwise nothing leaves the page.

Groves

Hold $BLIND, and the woods hand you tickets every day.

The token sits in front of the product, not beside it: holders claim free blind tickets from the Compute Pool every day, and the bigger the bag, the more they get per token. Claimed tickets expire 72 hours after their key, so the allowance is for asking, not for hoarding.

holds none

Wanderer

buys packs

  • · Buys packs at $0.01 a ticket
  • · Standard enclave models
  • · Full privacy, the same tickets as anyone

100,000 $BLIND

Sapling

up to 20 tickets a day

  • · Up to 20 free tickets a day
  • · Standard enclave models
  • · Gift seeds from the allowance

20 tickets per 100,000 held

1,000,000 $BLIND

Grove

up to 250 tickets a day

  • · Up to 250 free tickets a day
  • · Premium enclave models (3 a message)
  • · A first look at new models

25 tickets per 100,000 held

10,000,000 $BLIND

Old Growth

up to 3,000 tickets a day

  • · Up to 3,000 free tickets a day
  • · Pictures (5 tickets each)
  • · API tickets for agents
  • · A vote on the next model

30 tickets per 100,000 held

How the daily allowance is sized

Every UTC day

budget = 1/30 of the Compute Pool, in tickets

weight = $BLIND held × tier multiplier (1 · 1.25 · 1.5)

allowance = min(tier cap, budget × weight / all weights)

The balance is checked at the claim and at two random blocks in the previous 24 hours, so a borrowed bag held for one block claims nothing. Caps rise faster than the line, so splitting one bag across many wallets always gets fewer tickets. The pool pays only for tickets actually drawn; budget nobody claims stays in it.

What $BLIND will never do

  • Pay holders money. $BLIND gives tickets and features, nothing else.
  • Buy privacy. A bought ticket and a claimed ticket are the same object.
  • Open a softer door. Every ticket passes the same stamp check.
  • Change the fee split. The router that splits it has no owner.

Where supply goes instead: 20% of the creator fee and 10% of every ticket sale buy $BLIND back and burn it, on chain, on the meter.

Clearing

Every trade buys a prompt.

A trade of $BLIND pays 2%: the launchpad's fee plus a creator tax. 1.7% of the volume reaches a router with no owner, and half of it buys inference for holder tickets. Every $1 traded puts 0.85 tickets in the pool.

1.7% of volume · FeeRouter, no owner

Where the creator fee goes

  • Compute Pool50%

    buys inference for holder tickets

  • Buyback and burn20%

    $BLIND bought and sent to the dead address

  • Builders20%

    team, audits, infrastructure

  • Leak Bounty Vault10%

    pays whoever finds a log

$1 of USDG · TicketMint, no owner

Where a ticket dollar goes

  • Inference and operations80%
  • Compute Pool10%

    becomes holder tickets

  • Buyback and burn10%

Model · move the volume

A day of trading, turned into answers

Not a forecast: the input the meter will show live

$
Reaches the FeeRouter
$4,250
1.7% of the day's volume
Compute Pool, for holder tickets
$2,125
half of the router
Free private answers it buys
212.5K
at $0.01 a ticket
Answers per hour
8,854
what the meter would show
Bought back and burned
$850
20% of the router
Into the Leak Bounty Vault
$425
10% of the router
A woodcut print: a round clearing in a pine forest at first light, young saplings planted in a spiral, a lantern on a post
Forest · one tree for every 1,000 untraceable answers

Meter, and the Forest

The home page shows both, live, from chain data and hourly totals. Nobody has a profile to rank, so everything counts together: no tree belongs to anyone, and nobody can tell which questions planted it.

Pre-launch · the meter starts with the first ticket

This hour, trading paid for
— answers
Tickets spent today
— tickets
Tickets that named a wallet
0 by design
$BLIND burned so far
0 nothing to burn yet
Trees in the Forest
0 first one at 1,000 answers
  • · 100 trees, a grove: a new enclave model is added
  • · 1,000 trees, a wood: the bounty vault gets a top-up from the builders' share
  • · 10,000 trees, old growth: the stamping key is split across two independent operators
A woodcut print: a wooden fire lookout tower above a sea of pine treetops at night, one window lit amber

Firewatch · the leak bounty

We keep no logs. Find one, and the vault is yours.

A privacy promise is worth what it costs to break. 10% of the creator fee fills a vault that pays whoever proves us wrong, so the people most likely to doubt us are paid to look. Every month without a payout is a public data point.

Finding · share of the vault

  • Link a ticket to a wallet50%
  • Find a log of a question or an answer30%
  • Catch the app calling a third party10%
  • Any other privacy defectup to 5%
  • · A reproducible proof. A claim we cannot reproduce is not a finding.
  • · The first valid report wins; a duplicate of a paid report gets nothing.
  • · A 2-of-3 verdict within 72 hours, posted on the meter page.
  • · The fix ships first, then the full report, with your credit or with none.
Vault
seeded by the builders before launch
Reports
none yet (pre-launch)
Logs found
none yet

Bearings · the whole map

From your device to the enclave, every path drawn.

Stamp keys rotate every 24 hours and die after 72. The gate keeps a list of spent serials and hourly counters, nothing more. Every split of money runs through a contract nobody owns.

  1. On your device

    Your device

    keeps tickets, checks the enclave, runs the chat

  2. Door 1

    Booth

    stamps a blinded batch; reads payments and balances on Robinhood Chain

  3. Wall

    Nothing crosses

    no field, log or key passes from door 1 to door 2

  4. Door 2

    Relay (phase 2), then the gate

    hides your address; checks the stamp and the spent set

  5. Door 2

    Enclave models

    answer inside attested enclaves; only they can open your question

Contracts on Robinhood Chain

None of them can be upgraded or paused, and none has an owner who can move money.

  • TicketMintUSDG in, split 80% / 10% / 10% in the same call

    buy(packId) · buyWithPermit(…) · event Purchased

  • FeeRouterthe coin's fee recipient; anyone can run it

    claim() · distribute() → 50% / 20% / 20% / 10%

  • ComputePoolpays only a published inference address

    dailyBudget() public, in tickets

  • BountyVaultpays only on a 2-of-3 verdict

    event Paid(reportHash, amount)

  • BuybackBurnerbuys $BLIND and sends it to the dead address

    burn() · event Burned

On your device

  • The chat page loads scripts, styles, fonts and images from its own origin only, enforced by its security policy.
  • The wallet door is the only page that talks to the chain; the chat page carries no wallet code at all.
  • History stays in this browser: export it or wipe it whenever you like.
  • Tickets live in the browser's own storage; move them to another device as a text pack.
  • Draw a batch ahead of time and ask later: a draw right before a question says more about timing.
  • Builds are reproducible: every release hash is published, and the page shows its own (phase 3).

What the database holds

issuer_keys   (key_id, epoch, public_key, not_before, not_after)
entitlements  (wallet, source, epoch, drawn, balance)
purchases     (tx_hash, wallet, usdg, tickets, block)
spent         (key_id, ticket_hash)        dropped with its key
meter_hourly  (hour, fee_in, pool_in, issued, redeemed, burned)
bounty        (report_id, received_at, tier, verdict, payout_tx)

no table for questions, answers, IPs or devices,
and no column that ties a ticket to a wallet

Endpoints

GET  /api/keys                today's stamp key + the honoured ones
POST /api/tickets/draw       door 1: signed-in wallet + blinded batch
GET  /api/me                 door 1: tickets left to draw
POST /v1/chat/completions    door 2: tickets + a sealed body
GET  /attestation            the enclave's report and signed release
GET  /api/meter              public hourly totals
GET  /.well-known/private-token-issuer-directory
POST /v1/images/generations  door 2: 5 tickets a picture (phase 2)

Tally

Where every dollar goes.

What pays for it

  1. 01

    Ticket packs. $0.01 a standard message, paid in USDG. Cost is about $0.006 (assumed), so roughly 40% stays.

  2. 02

    Premium and pictures. A premium-model message costs 3 tickets, a picture 5.

  3. 03

    Agents and apps. Bulk tickets at the same price: no key, no account, nothing to sign.

  4. 04

    Partner tickets (phase 4). Other apps accept the same tickets and pay a settlement fee per ticket spent.

  5. 05

    Creator fee. 1.7% of $BLIND volume, split by the FeeRouter.

Ticket packs

One price per ticket, no bonus maths. A pack never expires; drawn tickets do.

  • Pocket$5

    500 tickets · $0.01 each

  • Daily$25

    2,500 tickets · $0.01 each

  • Heavy$100

    10,000 tickets · $0.01 each

  • Studio$500

    50,000 tickets · $0.01 each

Unit economics · assumed

Standard
$0.01
cost ≈ $0.006
Premium
$0.03
cost ≈ $0.020
Picture
$0.05
cost ≈ $0.030

Holder tickets are bought by the Compute Pool at cost.

$BLIND facts

Supply
1,000,000,000 $BLIND, fixed, no mint function
Team allocation
none · no presale · no private round
Launch
Pons launchpad, Robinhood Chain, fair launch
Quote token
USDG, the chain's dollar
Graduation
the launchpad's setting for the USDG pair, read on chain at launch
Trader fee
2%: launch fee + creator tax
To the FeeRouter
1.7% of volume
Dev buy
at most 2%, into a 90-day vesting wallet
Snipe-tax exemptions
the dev wallet, nothing else

How a launch on this launchpad spreads the supply · measured

  • Sold along the bonding curve≈ 71.4%
  • Seeded into the pool at graduation≈ 20.4%
  • Locked by the launchpad≈ 8.2%

Launch receipt · published with the launch

Everything about the first minute, in public.

  • · The creation transaction, the dev wallet and the dev buy
  • · The exemption list: the dev wallet only
  • · Every buyer in the first minute, with amounts
  • · The fee recipient: the FeeRouter address
  • · The vesting wallet and its release date

Anyone not exempt pays the launchpad's snipe tax in the first seconds, so the only early bag is the published dev buy. No bundle, no wallets paid for by one payer, no instant graduation.

Waymarks

Four marks on the trail. We are at the first.

  1. Phase 1

    building now

    First steps

    days 1 to 10

    • · Ownerless contracts deployed and verified
    • · Booth (blind stamps, daily keys) and gate
    • · Chat with a standard enclave model; premium with the holder tiers
    • · Attestation checked in the browser; questions sealed to the enclave
    • · Packs, holder claims, the meter, the receipt
    • · Launch on Pons

  2. Phase 2

    weeks 2 to 6

    Nobody sees the road

    • · Relay run by a third party: the gate never sees an address
    • · Pictures, seed links, the Forest
    • · Leak bounty live, with a first public review
    • · Chat-completions API paid in tickets

  3. Phase 3

    months 2 to 4

    Our own woods

    • · Our own enclave nodes, published measurements
    • · Reproducible builds and a transparency log
    • · Zero-knowledge holding proofs: claim without naming the wallet
    • · The stamping key split across operators

  4. Phase 4

    months 4 to 12

    Tickets travel

    • · Partner apps on the chain accept the same tickets
    • · Private agents that pay their own way
    • · A mobile app with an on-device ticket store
    • · New enclave models by holder vote

Field notes

What we chose, what we watch, what we cannot promise.

Why it can work

  • The privacy is a property of the math, not a policy page: the stamp cannot carry a name.
  • Every claim on the page links to something you can check: the browser verifier, the chain, the receipt.
  • The token has a job inside the product, and the fee that funds it is visible on the meter.
  • The bounty pays the doubters, which is how a privacy claim comes to be trusted.

What we cannot protect

  • What you type: a name or an address inside a question names you, ticket or not.
  • Your device: malware, a shared browser or a wallet extension can read the page.
  • Timing: in a small crowd, a batch drawn at 10:00 and a question at 10:01 can be guessed. Random prefetch and the relay help; a bigger crowd helps most.
  • The network edge in phase 1 sees addresses in transit (never stored); the phase 2 relay removes them.
  • Hardware trust: attestation is only as good as the vendors' roots and their patches.
  • The launchpad's owner holds a timelocked power over a coin's fee recipient. We watch for it and will say so.

Decisions

Blind RSA tickets (RFC 9474)
Unlinkable, standardised, fast to check
Two doors, one wall
The payment never meets the prompt
Holders claim daily tickets
The token sits in front of the product
A 1% creator tax
It funds the Compute Pool
FeeRouter with a fixed split
Nobody can reroute it
TicketMint without an owner
The 80 / 10 / 10 cannot move
Enclave-only models
No third-party promises about your words
Attestation checked in the browser
Verification, not a badge
Zero third-party scripts
Nothing watches the chat
72-hour ticket life
Limits hoarding; old keys die
Super-linear tier caps
Splitting a bag never pays
USDG as the quote token
Fees, packs and buybacks in one dollar, no price oracle
Dev buy at most 2%, vested
A clean launch anyone can read
Seed links after the #
Onboarding with no account
10% to a leak bounty
Pays people to check us
USDG for packs
The chain's own dollar

Attacks and defences

Borrow a bag, claim, return it
Balance checked now and at two random blocks in the last 24 h
Split one bag across many wallets
Caps rise faster than the line: many small wallets get fewer
Hoard tickets for later
Drawn tickets expire 72 h after their key
Spend one ticket twice
The spent set, per key epoch
Resell tickets
Allowed: it hurts nobody's privacy, and expiry keeps it small
Flood the gate
Every request costs a ticket
Flood the bounty
Proof must reproduce; a duplicate of a paid report gets nothing

What we watch

  • · Tickets redeemed per day, and the share the pool paid
  • · Wallets claiming each day, by tier
  • · Pack revenue per day, repeat purchases per week
  • · Router inflow, burns, pool budget used
  • · Bounty reports received, valid, paid
  • · Third-party requests on the chat page (must stay at zero)

What we cannot see, by design

  • · Who you are: there is no account
  • · How often one person comes back: there is no person to count
  • · What anyone asked: questions are never written down
  • · Which wallet spent which ticket: the math does not allow it

Every number marked as a model or an assumption on this page is listed with its source in the Blindwoods docs.