A team ships a payroll app on Privy. Users sign in with an email address and get a self-custodial wallet, no seed phrase and no extension to install. Then the first payroll runs, and every salary is on a block explorer with an address attached to it.
The same thing happens to a payments product with its merchant list, and to a treasury with its positions. That is a blockchain doing what it was built to do. But it means an application that solved onboarding still publishes what its users do next.
Hinkal adds the side that was missing, privacy.
What changes
The user's private balance is not readable on-chain. Transfers, swaps, withdrawals, and batch payouts do not reveal the sender.
A deposit into Hinkal is a public transaction, by design. The user's Privy wallet broadcasts it from their own address, and anyone can see that this address is deposited. That is the only public point. After it, the public record holds nothing that ties the address to what follows. A withdrawal address is visible and is not linked back to the deposit.
For a payroll run, that is the difference between publishing a salary list and publishing one deposit.
What does not change
Privy authenticates the user, creates and manages the embedded wallet, and produces signatures. Hinkal does not touch any part of that.
What Hinkal needs is a signer, and a Privy embedded wallet already produces one. Nothing else is needed, no custody handoff, no new key for anyone to manage or lose, and no change to how the application signs users in.
How it works
The user's signature authorizes everything. Every private action is authorized by a signature from the user's own Privy wallet, and that signature commits to the specific operation - the chain, the token, the amount, and the recipient. Hinkal can execute the operation the user signed and nothing else.Hinkal then reads the private balance and generates a zero-knowledge proof that the operation is valid.
A relayer submits the transaction. For withdrawals, transfers, swaps, and batch payouts, nothing user-facing is broadcasted. A relayer handles that which is why the user's address does not appear as the sender.
The ZKproof establishes three things at once, without revealing the sender, the recipient, or the amount: that the spender owns the funds, that they have not already been spent, and that value in equals value out.
What a Privy wallet can do now
- Hold a private balance
- Deposit and withdraw
- Transfer privately to another user
- Swap within the private balance
- Pay many recipients from a single deposit
Every deposit is screened by Chainalysis KYT before it enters. A user can share a full transaction history, a specific date range, or individual transactions with an auditor, a regulator, or a counterparty. The user decides the scope and the moment. Nothing is disclosed by default and nothing is permanently hidden.
An institution cannot operate on rails that publish its payroll to its competitors, and it cannot adopt a system that makes its auditors' job impossible. Selective disclosure is what lets both be true.
For teams building on Privy
The integration lives at the wallet’s infrastructure. Because Hinkal attaches at the signature, and every Privy wallet already produces one, a team can use it without rebuilding anything.
Adding private balances and transactions is a configuration step, not a migration.
Trusted by teams building on public chains
.png)
.png)
.webp)
