Protocol
Money that
stays silent.
An Orchard-style shielded pool of variable-amount notes, with proofs you generate yourself and an exit nobody can trace back to you.
Two sides
A public balance, and a private one.
Caligo gives you two balances and two addresses. Your public MetaMask account stays public; your shielded balance lives behind an address derived from your recovery phrase — deliberately unlinkable to the first.
The note model
A balance is just a private note.
When you shield, your CALIGO becomes a note — a tuple of value, a one-time secret, and a diversified owner key — committed with Poseidon2 into a depth-24 Merkle tree. The commitment is public; everything it hides is not.
Commit
The note's commitment joins a tree of up to ~16M leaves — one shared anonymity set for everyone.
Encrypt
An ECIES-encrypted copy rides on-chain so only the recipient (or a held viewing key) can read the note.
Hide
Diversified addresses mean each note's owner key is unlinkable; watching the chain reveals no balance and no link.
Spending
Spend once. Prove nothing else.
A single 2-in / 2-out transaction covers deposit, private transfer, and withdrawal via a signed external amount. The proof shows you own the input notes and that value balances — without revealing which notes, who, or how much. A one-time nullifier burns each note exactly once, so double-spends are impossible.
The machinery
Real cryptography, on your device.
In-browser proving
Noir circuits and UltraHonk (Barretenberg) proofs run in your browser — the spending key never touches a server. The same verifiers check the proof on-chain.
Gasless relayer exits
You hand a proof to a relayer over HTTP; it submits the withdrawal and pays the gas, so the exit is never linked to your wallet. Relaying is permissionless; the proof binds recipient, relayer and fee, so nothing can be redirected.
Proof-of-innocence & viewing keys
Neutral by default — nobody is blocked. An optional association set (Privacy Pools) proves a note belongs to a curated clean subset, and user-held incoming/outgoing viewing keys give selective disclosure to an auditor without spend power.