Identity, metadata, and public visibility
What Operators, the default SSP, public interfaces, and counterparties can learn from the reviewed transfer and payment paths.
How to read this topic: 3 principal evidence groups organize 13 supporting records by the question they answer.
Critical boundary: Visibility is not proof that records were combined or misused. Privacy mode limits covered public reads, while Operator- and SSP-side data flows remain separate questions.
Evidence group 01
Reviewed transfer and Lightning paths give every Operator wallet pseudonyms and transaction metadata needed for validation, including full Lightning invoices in the cited flow.
Scope boundary: Pseudonyms are not civil identities by themselves. The record does not establish retention periods, staff access, or that one Operator holds all threshold secrets.
Privacy
Spark's reviewed V3 transfer paths distribute participant identities and transfer records to every configured Operator. Operators outside a signing subset still persist the transfer rows, so threshold signing does not make transfer metadata Operator-blind. [4 sources]
Privacy
A normal wallet authenticates the same durable identity to every Operator and queries each for that identity's leaves. Operator code can associate that pseudonym with connection metadata; structured request logging, when enabled, can also record request bodies and client details. [8 sources]
Privacy
Spark distributes the complete Lightning invoice, payment hash, amount, fee, direction, and wallet identities to every Operator while dividing only the cryptographic shares. Each Operator stores the original invoice beside the affected Spark identity. [6 sources]
Evidence group 02
Public participant rules, Sparkscan observations, and SSP data models create documented ways to correlate transfers, invoices, destinations, and Operator-layer wallet identities.
Scope boundary: Joinability is not proof that every dataset is combined or misused. Privacy mode can suppress covered public reads when all relevant participants are private.
Privacy
Spark defines an IP-restricted, Lightspark-only SSP interface for cross-wallet node, transfer, static-address, and tree queries. Reviewed handlers and a pinned commit explicitly bypass ordinary wallet-privacy checks for SSP calls. [4 sources]
Privacy
Spark grants public transfer access when any sender or receiver is readable, and its test suite preserves full participant detail in that case. Because outgoing Lightning leaves go to one fixed, publicly indexed SSP identity, this is a concrete privacy limitation rather than a hypothetical two-wallet edge case. [6 sources]
Privacy
The default wallet authenticates Lightspark's SSP with the same identity signer used at the Operator layer. The SSP model attaches that identity to request history containing full Lightning invoices and exact cooperative-exit Bitcoin destinations, creating a deterministic join key. [9 sources]
Privacy
Spark describes static-address rotation as useful for privacy, but the implementation archives the old address and creates its replacement under the same immutable owner identity. That linkage is retained and distributed across the Operator set. [4 sources]
Privacy
Breez derives the Spark identity deterministically from the seed, network, and account. Restoring a compatible wallet with the same inputs preserves the Operator-side pseudonym, so changing apps or deposit addresses is not a privacy reset. [1 source]
Privacy
Breez real-time sync encrypts record values but uses deterministic SHA-256 identifiers for four metadata record types. A party that already knows the underlying payment ID can test for its record, while exit state is excluded and requires a separate backup. [3 sources]
Evidence group 03
Public-mode Bitcoin identities expose holdings and transaction material, while Spark's token ledger is designed for global enumeration under the reviewed interface.
Scope boundary: These are documented public surfaces. They do not expose private keys, and the token-ledger result should not be generalized to privacy-enabled Bitcoin transfers.
Privacy
Spark expressly excludes tokens from privacy mode, permits anonymous token queries with no wallet filter, and paginates the complete token-transaction table. Returned records expose owner public keys, exact amounts, outputs, status, and timestamps. [6 sources]
Privacy
For a publicly readable wallet, Spark's unauthenticated client can calculate its exact available balance and enumerate leaves. Returned records include ownership keys, tree relationships, exact values, timestamps, and multiple raw Bitcoin transaction fields. [4 sources]
Privacy
Breez emits complete Payment debug objects at INFO. Blink forwards SDK INFO and WARN lines to Crashlytics logging, while Cake appends SDK logs to a plaintext file, creating diagnostic copies with different retention and access paths. [3 sources]