The ones people
actually ask.

Because they hide a different thing. Token-2022's confidential transfers encrypt the amount, and that is genuinely useful — but who paid whom stays written on the chain for ever. KeepHost hides the link and publishes the amount, which is why the amounts are fixed. They are complements, not competitors: a confidential transfer stops people reading your salary, a shielded pool stops them following your money. Confidential balances also cannot be touched by a program, so nothing in DeFi can use them yet.

It is built on the same design, and pretending otherwise would be dishonest: fixed amounts, a tree of commitments, one proof per withdrawal. What killed that category was not the cryptography but hiding everyone equally, so honest users inherited the crowd's reputation and exchanges flagged every withdrawal. The published fix is to prove your deposit belongs to a set you chose — the Privacy Pools paper, and the way 0xbow shipped it on Ethereum in 2025. That is the next thing built here, and it is why this is not designed as a mixer.

A privacy pool for SOL on Solana. You send a fixed amount to a program, keep the receipt your browser draws, and later withdraw to any address you like. Both ends are public; the link between them is not, so the chain cannot say which deposit paid for which withdrawal.

Nobody. Deposits sit on a PDA, a Solana address computed from the program itself, which has no private key — none was ever possible. There is no admin instruction, no multisig, no team wallet and no support desk with an override. The only way a lamport leaves is the withdraw path, and only against a valid proof. One thing is not yet frozen: the authority that can replace the program still exists, deliberately, because the trusted setup has to be redone and that needs a redeploy. It no longer sits on the server — check it with `solana program show` — and it is revoked as soon as the new key is in.

Yes, on Solana mainnet since 23 September 2026, at CTHg29kf7L6TNDH5TSd3tdoZfsmP39JjyQWKmPtEY1YW, with three pools open at 0.1, 1 and 10 SOL. Deposits and withdrawals run from this site. Two things are still missing and both are written down rather than hidden: there is no external audit, and the proving key came from a ceremony run on a single machine, which is being redone in public. Deposit accordingly.

Yes, and only that. SOL comes back as SOL, and later a stock token comes back as that same stock token, in the same fixed amount. The pool breaks the link between the address that deposited and the address that withdrew; it is not an exchange and never swaps one asset for another. If you want to end up holding something else, withdraw first, then swap from the new address — the swap is public, but it is no longer attached to you.

The deposit stays in the pool and nobody can get it out — not you, not us, not anyone. There is no account, no backup and no recovery, because a recovery path would be the back door the whole design exists to avoid. Keep the receipt the way you would keep cash.

Not to use the pool. You send SOL from whatever wallet you already use, and paste a destination address when you withdraw: no account to create, and no transaction this site could ever ask you to approve. A wallet is used in one place only — holder access, where you sign a message to prove you hold the token. A signature, never a transaction, never a fee.

Deposits are 0.1, 1 or 10 SOL and nothing else. An unusual amount is a name: put in 3.4172 SOL, take out 3.4172 SOL a week later, and no cryptography saves you. Fixed sizes make deposits look like each other, which is where the privacy actually comes from.

Both edges. The deposit: the wallet it came from, the amount, the time. The withdrawal: the address it lands on, the amount, the time. A pool on a public chain hides the line between them and nothing more.

A relayer. Every Solana transaction has a public fee payer, so paying it yourself would undo the privacy, and a fresh destination wallet has no SOL to pay with. The relayer submits your proof and takes its fee out of the withdrawal. It cannot change the destination or the amount — they are sealed inside the proof — and it cannot learn which deposit is being spent.

Fees are a fraction of a cent, which matters when the privacy depends on someone else paying them for you. Withdrawals confirm in one slot, and the assets people want to hold privately already live here.

Tokenised equities are why the project exists, and they are not what the first pool holds. The design is being built for SOL first, in fixed amounts, because that is the smallest thing worth auditing. Stock tokens come after, and they are not built.

It is the emblem, not a feature. The pixel device in the logo and the object turning on the home page stand for the pool; you do not need one, and there is nothing to plug in, pair or sign on. KeepHost is not affiliated with Ledger.

One thing today: holding it opens the pool pages, checked by a wallet signature — a message, not a transaction, with no fee and nothing approved. The rest is the design and is not running. When the pool exists, every deposit pays a small fee, holding the token makes that fee smaller, the fees pile up on a PDA, and anyone can trigger the operation that buys the token on the market and burns it. No pool, so no fee and nothing burned.

No, and it is not allowed to. A discount that depends on who you are needs to know who you are, and a privacy pool has no business knowing. There are no per-user tiers, no history, no account and no profile: the fee is a property of the deposit in front of the program, not of a customer it recognises. Writing that check so it cannot become a way to fingerprint depositors is part of what has to be designed and audited.

Anyone. The fees accumulate on a PDA, which has no private key, so the pile cannot be swept by us or by anyone else. The buy-back and burn is a public instruction that any wallet may call — not a team function we could withhold or run quietly. Every step is an ordinary Solana transaction, readable on an explorer, and the total burned shown on this site will be read from the chain rather than from a database of ours. None of it exists yet.

No. There is no yield, no dividend, no revenue share and no staking return. The only reward for using KeepHost is a lower price, never a payout. The token is not a share and carries no claim on the project or the pool; its price comes from a market, not from a promise of ours. If the pool never ships, the token keeps exactly what it had on day one — access to the pages.