<!-- tempo-docs-context -->
> Source: [/docs/zones/privacy](https://tempo.xyz/developers/docs/zones/privacy.md)
> Section: [Zones](https://tempo.xyz/developers/docs/zones.md). Connect to a Zone and work with private balances, deposits, and withdrawals. Zones is in limited preview; see the introduction for access. Earlier testnet sandbox guides describe a separate integration.
> [Documentation index](https://tempo.xyz/developers/llms.txt) · [Docs skill](https://tempo.xyz/developers/SKILL.md)

> Tempo MCP: Use `search`, `find_pages`, `read_page`, and `code` at `https://mcp.tempo.xyz` for Tempo and related documentation.
> If an indexed page is missing or reflects an older site, read this site’s [documentation index](https://tempo.xyz/developers/llms.txt) and Markdown pages directly.

<span id="zone-privacy-model" />

# Privacy

A Zone keeps balances and account activity in a private ledger. Its operator can read that ledger. Deposits and withdrawals also leave public records on Tempo.

<span id="understand-who-can-read-the-data" />

## Who can see what

| Data | Visibility |
| --- | --- |
| Private balances and account activity | Account-scoped RPC limits other users' access. The Zone operator can inspect the ledger. |
| Deposit recipient and memo | Encrypted to the operator when submitted on Tempo. |
| Deposit token, amount, depositor, and refund recipient | Public on Tempo. |
| Withdrawal token, amount, destination, and settlement commitments | Public on Tempo. |

## Public deposits and withdrawals

Amounts and timing at the public boundary remain observable. Do not describe the Zone as hiding deposits and withdrawals or making the private ledger unreadable to its operator.

<span id="keep-application-access-scoped" />

### Scope application access

The account-scoped, redacted Zone RPC authenticates the caller and scopes results to that account. If your application uses a hosted provider instead, confirm which accounts its credentials can read. Enforce customer access in your backend, caches, logs, and user interface. A public Tempo explorer does not show private Zone activity.

Read access is separate from transaction-signing authority and the portal's funding rules. See [account privacy rules](https://tempo.xyz/developers/docs/protocol/zones/accounts) and [RPC access control](https://tempo.xyz/developers/docs/protocol/zones/rpc) for exact read restrictions and response redaction.

<span id="check-settlement-assumptions" />

## Trust assumptions

Each Zone has a `ZonePortal` on Tempo that holds its backing assets. Execution-proof enforcement depends on the deployed verifier and network configuration. Forced exits are not a generally available recovery path.

Review [proving and settlement](https://tempo.xyz/developers/docs/protocol/zones/proving) with the operator before integrating. Then [connect to the Zone](https://tempo.xyz/developers/docs/zones/connect) using that deployment's interfaces.