People need space.

Generate a Semaphore identity on your own device. Only its commitment reaches the application service. Keep the recovery file offline: the platform cannot recover your identity secret.

A Semaphore v4 Groth16 proof establishes membership without identifying which commitment belongs to the claimant. It does not prove real-world need; reviewers establish eligibility.

This is private eligibility, not a shielded payment system. Sender, recipient, amount, transaction timing and gas payments remain public. Use a separate recipient if appropriate; that alone does not ensure unlinkability.

Reviewers can read encrypted applications after signing into the server. AES-256-GCM protects storage; it is not encryption against the authorized platform reviewers. Private text is removed after 180 days.

A round opens only for at least five approved commitments. Small groups still offer limited anonymity; five is a minimum, not a privacy guarantee.