Every privacy product says "verifiable" and then hands you numbers from its own server. This makes "don't trust us" executable: your browser rebuilds the shielded pool's Merkle root from the public chain and checks it against the chain and our API — and verifies any seal or certificate locally.
Every input is public: on-chain LeafInserted logs + currentRoot(). Nothing here reveals a depositor, an amount, or a link — just that the set is what we say it is.
The math is a LeanIMT over poseidon2 — the same primitive the pool uses. Reproduce the root yourself with the open-source @zk-kit/lean-imt + poseidon-lite.