<!-- tempo-docs-context -->
> Source: [/docs/zones/privacy](https://tempo.xyz/developers/docs/zones/privacy.md)
> Section: [Zones](https://tempo.xyz/developers/docs/zones.md). Connect to a Zone and work with private balances, deposits, and withdrawals. Zones is in limited preview; see the introduction for access. Earlier testnet sandbox guides describe a separate integration.
> [Documentation index](https://tempo.xyz/developers/llms.txt) · [Docs skill](https://tempo.xyz/developers/SKILL.md)

> Tempo MCP: Use `search`, `find_pages`, `read_page`, and `code` at `https://mcp.tempo.xyz` for Tempo and related documentation.
> If an indexed page is missing or reflects an older site, read this site’s [documentation index](https://tempo.xyz/developers/llms.txt) and Markdown pages directly.

<span id="zone-privacy-model" />

# Privacy

A Zone keeps balances and account activity in a private ledger that its operator can read.

## Overview

The Zone visibility model defines who can read each kind of Zone data. Four parties matter:

* **Account Holder:** Reads its own balances and activity through the Zone RPC.
* **Operator:** Runs the deployment and can read the whole private ledger.
* **Public Observers:** See deposits and withdrawals on Tempo, but not activity inside the Zone.
* **Your Application:** Reads only the accounts whose authorization tokens it holds.

<span id="understand-who-can-read-the-data" />

## Who Can See What

| Data | Visibility |
| --- | --- |
| Private balances and account activity | The Zone RPC limits each account to its own data. The operator can inspect the ledger. |
| Deposit recipient and memo | Encrypted to the operator when submitted on Tempo. |
| Deposit token, amount, depositor, and refund recipient | Public on Tempo. |
| Withdrawal token, amount, destination, and settlement commitments | Public on Tempo. |

## Public Deposits and Withdrawals

Amounts and timing at the public boundary stay observable. Don't describe a Zone to customers as hiding deposits and withdrawals. Don't describe its private ledger as unreadable to its operator.

<span id="keep-application-access-scoped" />

## Scope Application Access

The Zone RPC authenticates each caller with an [authorization token](https://tempo.xyz/developers/docs/zones/connect#authorize-access). It scopes results to that account and redacts shared data. If your application uses a hosted provider instead, confirm which accounts its credentials can read.

Enforce customer access in your backend, caches, logs, and user interface. A public Tempo explorer doesn't show private Zone activity.

Read access is separate from transaction-signing authority. It's also separate from the portal's funding rules.

<span id="check-settlement-assumptions" />

## Trust Assumptions

Each Zone has a portal (`ZonePortal`) on Tempo that holds its backing assets. Execution-proof enforcement depends on the deployed verifier and network configuration. Forced exits aren't a generally available recovery path.

Review [proving and settlement](https://tempo.xyz/developers/docs/protocol/zones/proving) with the operator before you integrate.

## Related

[Connect to a Zone](https://tempo.xyz/developers/docs/zones/connect): Use for getting deployment details and signing the authorization token.

[Accounts and Privacy](https://tempo.xyz/developers/docs/protocol/zones/accounts): Covers the account privacy rules and exact read restrictions.

[RPC Reference](https://tempo.xyz/developers/docs/protocol/zones/rpc): Covers per-account scoping and response redaction.

[Proving and Settlement](https://tempo.xyz/developers/docs/protocol/zones/proving): Covers settlement certificates and the current onchain verification limits.