Valon keeps your activity off the public record without hiding it from the people you choose. Here is what is visible, how you prove your history, the safeguards built into the protocol, and the rules for using it.
Tap a row to see why.
Entry and exit are public: a shield shows your wallet, token and amount; a withdrawal shows the address and amount received. Everything between them is sealed.
Your viewing key lets anyone you choose read your Valon history and check it against the chain. It can’t spend.
In the app, go to Keys. Your viewing key is there, next to your receiving address.
It is read-only. Share it only with the person who needs it: an accountant, an auditor, an exchange’s compliance team.
The key opens your notes, which can then be matched to the public entries and exits on Solana, without your spending key. The app can’t open a viewing key yet: for now that takes Valon’s client code or our help.
Enforced by the program on Solana, not by policy alone.
Every shield and withdrawal is an ordinary, visible Solana transaction. Value can’t enter or leave Valon unseen.
Tokens with features that could endanger a shared vault are rejected on-chain when a vault is opened.
Freezable tokens such as USDC keep their issuer’s controls over the vault. The app labels them.
A 2-of-2 multisig can pause the protocol while an issue is investigated. No instruction lets it move or redirect funds.
Amounts, recipients and fees are bound into each zero-knowledge proof and checked by the program before anything moves.
Financial privacy is a normal expectation. Using Valon to break the law is not permitted.
By using Valon you confirm you are not a sanctioned person or acting for one, and that you will meet your own legal and tax obligations.
Law enforcement and compliance enquiries: info@valon.xyz
Valon is a private balance you keep and use: you shield once, then send, trade and lend inside it. Entry and exit stay public, every action is checked on-chain, and your full history remains provable with your viewing key.
No. The program has no instruction that moves a user’s notes without their proof. The admin multisig can pause deposits, transfers and swaps while an issue is investigated; withdrawals stay open. In an incident it can also pause everything leaving the pool for at most about 3 days, ending by itself, with at least 7 days between two such pauses. No instruction lets it single out, freeze or take anyone’s balance. The same multisig controls program upgrades, so it could change these rules through an upgrade; upgrades are announced in advance.
Valon doesn’t have it. Notes are encrypted to your keys in your browser, and the relayer and indexer keep no record of who asked for what. Your viewing key is the only way to read your history, and only you can share it.
Give their compliance team your viewing key. It shows every note you received and spent, which they can match to the public shield and withdrawal transactions on Solana.
Rules on privacy tools differ by country and change over time. You are responsible for following the laws that apply to you, including tax reporting. If you are unsure, ask a qualified adviser.
Last reviewed October 4, 2026. This page explains how Valon works and the rules for using it. It is not legal advice.