> For the complete documentation index, see [llms.txt](https://valargroup.gitbook.io/shielded-vote-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://valargroup.gitbook.io/shielded-vote-docs/overview/privacy-guarantees.md).

# Privacy Guarantees

Shielded Vote provides several layers of privacy protection.

## What is hidden

* **Your identity** — The delegation step moves voting rights to an unlinkable hotkey. All subsequent voting transactions use this hotkey, with no on-chain link back to your spending key.
* **Your total balance** — Vote splitting decomposes your weight into multiple shares submitted at different times, preventing balance reconstruction via timing analysis.
* **Individual vote amounts** — Each share is an El Gamal ciphertext. The plaintext amount is never revealed. Only the aggregate per (proposal, decision) is decrypted at tally time.
* **Which vote commitment a share came from** — ZKP #3 proves the share is in the vote commitment tree without revealing which entry. Blinded share commitments prevent observers from recomputing `shares_hash` from on-chain ciphertexts and linking revealed shares back to a specific vote commitment.
* **Your real nullifiers** — Governance nullifiers are derived via a domain-separated Poseidon hash with `nk`, so they cannot be linked to your on-chain nullifiers.

## What is revealed

* **Aggregate vote totals** per (proposal, decision) — this is the point of voting
* **That you voted** — a governance nullifier is published (but unlinkable to your identity)
* **The number of share submissions** — visible on-chain, but unlinkable to specific voters when mixed across the server

## Trust assumptions

* **Election authority** — Holds `ea_sk`. Must honestly decrypt the aggregate and publish a correctness proof. Cannot decrypt individual shares without additional work (each share is individually encrypted, but in principle the EA could decrypt them). Privacy against the EA relies on vote splitting.
* **Share submission servers** — Learn the encrypted share and vote decision, but not the plaintext amount or the voter's identity. Their main trust requirement is not leaking timing metadata.

## Post-quantum considerations

The governance hotkey address is never published, so a quantum adversary cannot learn the delegated amount. Vote splits remain unlinkable to a quantum adversary. However, a quantum adversary could break the El Gamal encryption to see individual share amounts. Delegation amounts would also be visible. Post-quantum delegation is out of current scope.