Privacy and trust model
Proof or Bluff is built on selective disclosure: the game publishes what fairness requires and nothing more. This page states precisely what is public, what is private, who can see what, and what we do not do. We would rather be exact than impressive.
What is public
The following is written to the Midnight public ledger and can be read by anyone:
- Claims — every declaration ("Two Kings"), including its count and rank.
- Scores, mode, phase, and turn order — the full public match state.
- Challenge outcomes — a single bit per challenge: the claim was true, or it was false.
- Commitments — cryptographic fingerprints of each player's entropy, hand salt, current hand, each play, and the shared seed. A commitment does not reveal the value behind it.
- Hand sizes — how many cards each player holds, not which ones.
- Transaction ids and wallet public keys of the two players, as with any on-chain activity.
- Timestamps supplied with each move, used for timeout handling.
What is private
The following never appears on-chain. It enters the zero-knowledge proof only as a private witness on the prover's side:
- Your cards — the actual ranks in your hand and in each play you make.
- Your hand salt — the secret that, together with the shared seed, determines your deal.
- The shared seed — only its commitment is published; both players hold the seed itself.
When a bluff is caught, the chain learns that the claim was false. It does not learn what the cards actually were.
Who can see what
This is the table that matters. "Hosted proof server" means the proof server we operate for convenience; see the next section for how to avoid it.
| Data | You | Opponent bot | Our hosted proof server | Public chain |
|---|---|---|---|---|
| Your cards | Yes | No | Yes, during proving only (if you use it) | No |
| Your hand salt | Yes | No | Yes, during proving only (if you use it) | No, commitment only |
| Shared seed | Yes | Yes | Yes, during proving only (if you use it) | No, commitment only |
| The bot's cards | No | Yes | Yes, when proving the bot's moves | No |
| Your claims | Yes | Yes | Yes | Yes |
| Challenge result (true / false) | Yes | Yes | Yes | Yes |
| Scores and match state | Yes | Yes | Yes | Yes |
| Your wallet public key | Yes | Yes | Yes | Yes |
Two things follow from this table. First, the opponent bot — and whoever operates it — provably cannot see your cards: your hand is derived from a salt the bot never learns. Second, if you use our hosted proof server, we can see your cards during proving. We never store them, but you are trusting that statement rather than a proof.
The proof server choice
Generating a zero-knowledge proof requires the private inputs. Whoever runs the proof server sees them while the proof is being built. This is the one privacy decision a player actually makes, and the game asks you directly:
Who generates your proofs?
Your cards never go on-chain, but the proof server sees them while proving. The game's fairness is enforced by the contract either way.
- Hosted (easy) — our proof server. No setup. We can see your cards during proving; we never store them.
- My own (private) — a proof server you run on your own machine. Nobody else ever sees your cards.
Running your own proof server means running the standard Midnight proof server locally (typically in Docker) and pointing the game at it. Instructions live in the project repository. With a local proof server, your cards, salt, and seed never leave your computer.
Either way the chain rejects cheating. The proof server choice decides only who can see, not who can cheat.
What the contract guarantees
| Guarantee | Mechanism |
|---|---|
| Nobody can bias the deal | Commit-reveal of two entropies produces the shared seed; each side commits before seeing the other's value. |
| Nobody, including the dealer, can see your hand | Your hand is dealt in-circuit from a secret hand salt committed before the seed existed. The salt cannot be ground for a good hand and the opponent never learns it. |
| You cannot play a card you were not dealt | Each play proves the cards open the public play commitment and belong to the committed hand, then stores the remainder commitment. |
| Bluffing stays legal | The claim is public, the cards are private; challenge resolution discloses one bit. |
| Reshuffles are as fair as the first deal | When a hand empties, the round counter increments and a fresh hand is derived from the same committed material. |
Known limitation: the in-circuit rank derivation uses a three-byte rejection fallback to avoid modulo bias; the residual bias is roughly 0.004% and is documented in the contract source.
What we do not do (v1)
- No wagers. The launch contract holds no funds and never receives a coin. Players pay only normal network transaction fees.
- No payments. There is nothing to buy. See Pro for what might come later.
- No accounts. There is no sign-up, password, or profile. Your wallet is your identity on-chain, as with any Midnight DApp.
- No analytics. This website and the v1 game include no analytics, tracking pixels, or third-party scripts.
- No storage of private witnesses. Our hosted proof server processes your cards in memory to build a proof and does not retain them.
Things we cannot promise: that a hosting provider or network intermediary keeps no logs of ordinary connection metadata (IP address, timing), or that the public chain will ever forget what is public. If you need the strongest guarantee available, run your own proof server.