Skip to content

UMBR is live on testnet. Private payments with test funds on Robinhood Chain and Tempo.

Open the app
UMBRDocs

Start here

UMBR documentation

UMBR keeps stablecoin balances and payments off the public record and lets you prove one fact at a time when someone needs to see it. Start here for the ideas, the app and the SDK.

Networks
Robinhood Chain and Tempo testnets
Assets
Stablecoins
Proofs
Made on your device
Token
None

What UMBR is#

On a public chain, every transfer you make is a permanent entry anyone can read: who paid whom, how much and when. That is fine for some money and a problem for most of it. Salaries, supplier invoices, savings and an agent's running budget are not things you would pin to a noticeboard.

UMBR is a shielded pool for stablecoins. You deposit into it, and from then on your balance is held as private notes that only your keys can read. Inside the pool you can pay a person, pay a whole team or hand out a claim link, and the public record shows that the pool was used, not the amounts or who paid whom. When someone has a real reason to see a figure, you give them a proof of that one figure, for a limited time, and nothing else.

The privacy comes from zero-knowledge proofs (Groth16) that your browser or your server builds locally. Nothing about your notes is sent to UMBR. The same pool design runs on two chains, Robinhood Chain and Tempo, and today both are testnets. UMBR has no token.

The whole flow#

From a public wallet and back

  1. Shield

    Deposit stablecoins from your public wallet into the pool. The deposit itself is visible; from here on the funds are notes only you can open.

  2. Hold privately

    Your private balance is the sum of your unspent notes. The app reads them with your keys and keeps a local copy; no server holds them for you.

  3. Pay or run payroll

    Send to an UMBR address, create a claim link or pay a list of people in one run. Each payment spends notes and creates new ones for the receiver.

  4. Prove

    When a landlord, accountant or partner needs one fact, make a proof of a balance, a payment or a payroll total, addressed to them, with an expiry.

  5. Unshield

    Withdraw to any public address when you need funds outside the pool. The withdrawal is public; which deposit it came from is not.

Each step has its own page: how shielding works, private payments, private payroll and proofs.

Try it in two minutes#

There are two ways to see UMBR working without touching real money.

  • In the app. Open the app, connect a wallet on Robinhood Chain testnet or Tempo Moderato, take test funds from the network's public faucet and shield a small amount from Vault → Shield. The testnet guide walks through every screen.
  • In demo mode. Add ?demo=1 to any app URL on localhost (or on a deployment that enables it). You get a pretend funded account and can click through shielding, paying, payroll and proofs. Nothing is signed and nothing is sent.
  • From code. The quickstart shields, sends and unshields with @umbr/sdk in about twenty lines.

A network may show as planned

A testnet becomes usable on a deployment once its pool address is configured. Until then it is shown as planned and the app is read-only on it. Demo mode works either way.

What works today#

  • Shielding and unshielding stablecoins on the configured testnets.
  • Private sends to an UMBR address, with an optional memo only the receiver can read.
  • Claim links that hold a payment until someone opens the link and claims it.
  • Payroll runs from a pasted list or a CSV, with each line paid as its own private payment.
  • Four kinds of proof (exact balance, at least, payment, payroll total), each bound to an audience and an expiry of 1, 7 or 30 days.
  • Checking proofs at /verify without an account or a wallet.
  • Key backup and restore from Settings.
  • Demo mode for walkthroughs and screenshots.

What is not built yet#

  • Sealed trade is switched off. The path for swapping from a private balance exists in design and code but is not enabled. Sealed trade explains why.
  • No mainnet. Robinhood Chain and Tempo mainnets are not configured, so they are hidden in the app. They will appear only after the production gate is passed. See /mainnet.
  • The SDK and the MCP server are previews. @umbr/sdk and umbr-mcp are documented here but not published to npm yet, and their APIs may change.
  • No hosted MCP endpoint. Agents run the server locally for now.
  • No independent security review yet. Circuits and contracts have not been reviewed by an outside party. Treat everything as testnet software.

The full list, feature by feature, is on product status.

QuickstartInstall the SDK and make a first private payment on a testnet.Testnet guideEvery flow in the app, step by step, with test funds.Privacy modelWhat an observer can and cannot learn from UMBR activity.ProofsThe four statements you can prove and how a reader checks them.Agents and MCPA private balance for an AI agent, with hard spending limits.Threat modelWho UMBR defends against and the gaps we know about.