Built so you don't have to trust the tab.

Keys stay in the tab.

Derived from a wallet signature, held in memory. The server should never see them, and should not be able to read the balance.

No upgrade switch on the pool.

Only a valid proof moves pooled funds.

Exits are not a promise from this site.

Unshield has to keep working if peb disappears.

Turnstile in the open.

Notes are private. Totals are not. In minus out should equal the contract balance, per asset, for anyone to check.

The pool is new and has not been externally audited. Deposits are capped. A single-party phase 2 sits on a public phase 1. Privacy means something only if the pool is used. Not financial advice.