How to use Ville
On this pageWhat Ville is
What Ville is
Ville lets people pay you on Robinhood Chain without your main wallet showing up as the one who got paid.
Normally an address is a public diary: whoever learns it can read your balance and every payment you ever received. Ville puts three small pieces on top of the chain so that does not happen:
A pay link
One link to share. Each payment through it reaches an address no one has seen before.
A short name
A word instead of forty hex characters, checked against the public registry by every payer.
A gas allowance
A pinch of ETH that travels with a token payment, so the new address can pay its own fee.
Ville never holds money and never sees your keys. It follows two open standards, ERC-5564 stealth addresses and the ERC-6538 registry, both already deployed on Robinhood Chain. Its own two contracts are described under Contracts.
Getting started
Have a browser wallet with a little ETH on Robinhood Chain. That is the whole list.
- 1
Connect a wallet
Press Connect wallet and pick your browser wallet, or WalletConnect for a phone wallet where this site has it set up. Robinhood Chain is added to your wallet on connect.
- 2
Sign once
On Receive, sign the key message. It names ville.cash, costs nothing and sends nothing on chain. The tab turns it into your keys.
Your two keys
The signature becomes a viewing key, which recognises payments meant for you, and a spending key, which moves them. Their public halves form your meta-address. Your wallet produces identical keys wherever you sign, so there is no new phrase to write down. An optional passphrase can be mixed in; then you need it every time.
Nothing secret leaves the tab
Keys live only in this tab's memory. Close it, or press Forget keys and scan record, and they are gone until you sign again. To avoid rereading the whole history, this browser remembers how far its inbox scanned and which one-time addresses matched, in its own storage and never on a server. The server only keeps public things: the list of announcements and, until VilleDirectory is deployed, signed practice names.
Receive
Get paid without handing out your wallet. Each payment lands on its own fresh address.
- 1
Copy your meta-address
After signing you get a public address starting with
st:eth:0x. It lets people pay you and cannot move money. - 2
Publish it
One registry transaction lets payers start from your plain wallet address and switches on
/pay/<your address>. - 3
Watch the inbox
The tab reads every announcement and tests each with your viewing key. Matches show what was announced and what the address holds now.
- 4
Send it onward
Each payment has a Move form. Pick a destination, review the fee, and sign in the tab with that one address's own key.
Sending a payment onward
The transfer is signed in your browser with the one-time key and sent as a raw transaction; your wallet extension never sees it. For ETH, the fee is paid from the balance itself, and a tiny remainder can stay behind because gas is reserved with a small buffer.
Token payments and gas
A new address holds no ETH, so on its own it could not pay the fee to move tokens. The send form handles this in the same payment:
- 1
The payer adds an allowance
The form suggests a small ETH amount from the live gas price. It can be set to zero.
- 2
It rides along
That ETH goes to the same one-time address as the tokens, in the same flow.
- 3
You move the tokens
The allowance pays the fee. Afterwards you can move the leftover ETH too.
| Asset | Who pays the fee to move it out |
|---|---|
| ETH | the payment itself |
| USDG, WETH, any ERC-20 | the ETH allowance sent with it |
| Tokens without an allowance | someone must send the address ETH first, which links that wallet to it in public |
Send
Pay someone's link, and only they can tell the payment was theirs.
- 1
Enter the recipient
On Send, type a name, a pay link, an
st:eth:meta-address, or a 0x wallet that published one. A plain wallet without one is refused, because paying it would not be private. - 2
Pick asset and amount
ETH, USDG, WETH or any token by address. For tokens, keep the small gas allowance unless told otherwise.
- 3
Send
One transaction through VilleCourier pays the one-time address and posts its note together.
What others can see
Your wallet, the amount, the time and the one-time address are public, like any transfer. What nobody can work out is who controls that address. A new one is made every time you press send, so a retry never reuses an address from an earlier attempt.
One transaction with VilleCourier
VilleCourier pays and announces in the same call and writes the note itself from what actually moved, so a payment and its note can never disagree. Token payments approve exactly the amount being sent. It is deployed and in use.
Privacy pool
Stealth addresses hide the receiver; the pool hides the payer too.
- 1
Deposit
ETH or USDG goes in from your wallet and the pool writes you a note. The deposit itself is public: wallet, amount, time.
- 2
Wait for the set
After a screening wait the deposit's label joins the association set the provider publishes, unless the depositing wallet is on its deny list.
- 3
Pay privately
Your browser proves in zero knowledge that it owns a note from an approved deposit, not which one. A bundler submits it: the money lands on the receiver's one-time address with its note, and your wallet is not on the transaction.
Why a set at all
Paying from a crowd only helps if the crowd is one you are happy to be seen in. The association set keeps deposits from deny-listed wallets out of it. Its rule is short: approve a deposit an hour after it is confirmed unless its wallet is on the list, and remove a wallet's deposits if it is added later. That is a screening policy run by Ville, not a legal guarantee and not a regulator's approval.
Ragequit
A deposit that is never approved, or later removed, can always go back to the wallet that made it, in public, without asking anyone. The provider can leave a deposit out of the set or stop publishing; it cannot move or freeze funds.
The bundler
It submits your proven payment from its own wallet and is paid a fee from your note, in the same asset, fixed inside the proof: it cannot change the receiver or the amount, only send or refuse. If it refuses or does not answer, nothing is sent; the site never falls back to your wallet. It sees the IP address your browser used to reach it.
Limits
One payment draws on one deposit, so a deposit should be at least the largest amount you plan to pay from it. A USDG payment from the pool carries no ETH for the receiver's gas. The crowd is only as large as the number of approved deposits; small pools and unusual amounts are easier to follow.
Where it stands
The pool is live at 0x5f5aa015a3d23c56a29191b6f930f53722ea69b0. Pool payments are on.
What is and isn’t private
Ville hides who got paid. It does not make transactions disappear.
| Anyone can see | Stays private |
|---|---|
|
|
| Anyone can see | Stays private |
|---|---|
|
|
| Anyone can see | Stays private |
|---|---|
|
|
| Anyone can see | Stays private |
|---|---|
|
|
| Anyone can see | Stays private |
|---|---|
|
|
| Anyone can see | Stays private |
|---|---|
|
|
Each note reveals one byte of its shared secret (the view tag). That slightly narrows the privacy margin of that one payment, as the standard describes, and never helps anyone spend.
Privacy habits
One-time addresses do their part. These habits do the rest.
- Move payments to fresh addresses, not straight to the wallet you use daily.
- Do not sweep several one-time addresses into one destination at the same moment; that groups them.
- Odd amounts are easy to follow. Round numbers blend in.
- Moving a payment seconds after it lands makes the pair easy to match. Let some time pass.
- Funding a payment address from your main wallet links them. Ask payers to include the gas allowance.
- The stealth crowd on Robinhood Chain is still small. Privacy grows as more people use the standard.
Fees and limits
| Action | Ville fee | Network fee paid by |
|---|---|---|
| Derive your keys | none | nobody (a signature) |
| Publish your meta-address | none | your wallet |
| Take a name | none | your wallet |
| Send privately | none | the payer |
| Move money out | none | the one-time address |
| Limit | Value |
|---|---|
| Name length | 3 to 20 characters: a–z, 0–9, hyphens inside |
| Names per wallet | one |
| Practice name lifetime | 30 days |
| Token approval | exactly the amount sent |
| Relayed raw transactions | plain ETH or ERC-20 transfers on chain 4663, rate-limited |
Network fees on Robinhood Chain are usually a small fraction of a cent.
Safety
Read this before you send anything that matters.
No admin key
VilleCourier and VilleDirectory have no owner, pause, fee setting or upgrade path. What gets deployed is what runs.
Keys stay in the tab
The site never holds funds and never learns your keys, so it cannot move, freeze or recover anything.
- Payments on a public chain are final. Check the recipient, the asset and the amount before confirming.
- Practice names are labelled as practice and move no money.
- A token issuer may be able to freeze its token at any address, including a one-time address. See the terms and risks.
FAQ
What is Ville?
Ville is a stealth payment app on Robinhood Chain. You publish one stealth meta-address (two public keys), and every payment made to it arrives on a never-used address that your keys alone control. It follows the ERC-5564 and ERC-6538 standards.
How does Ville work?
The payer's browser combines a random key with your viewing key to compute a fresh address, pays it, and posts a short announcement through the standard ERC-5564 contract. Your browser reads all announcements, recognises yours with your viewing key, and signs transfers out of each one-time address with a key derived from your spending key.
How do I buy $VILLE?
Once the contract address is published on the Ville token page, you can swap ETH for $VILLE on Robinhood Chain from the swap page or the launchpad it trades on. Until then there is no official token, and any token using the name is not ours.
Which network is Ville on?
Robinhood Chain mainnet (chain number 4663). Fees are paid in ETH. Ethereum mainnet support is a possible later step and does not exist today.
Can Ville seize or lock my funds?
No. The site never touches funds or keys, and the Ville contracts have no owner, pause or upgrade. If this site went away, your keys still come from your wallet's signature and the payments stay on chain.
I am on a new device. Are my payments gone?
No. Connect the same wallet and sign the same message; the keys come out identical, and the inbox finds the same payments. If you added a passphrase, type the same one.
Why does a token payment need some ETH as well?
A one-time address starts empty. To move tokens out of it, it must pay a network fee in ETH. The payer can add a small ETH allowance in the same payment; the send form suggests one from the live gas price. ETH payments pay their own fee from the amount.
Is a name private?
No. A name points at your meta-address and shows which wallet registered it. Payments made through the name still land on unlinkable addresses, but the name itself is a public pointer. If that matters, register the name from a wallet you do not use for anything else.
Does it work with other stealth address wallets?
Yes, as long as they implement ERC-5564 scheme 1 the same way. Announcements go through the shared singleton contract, and meta-addresses through the shared registry, so payments are not tied to this site.
Has a regulator approved Ville?
No. Ville makes no claim of regulatory approval. Wallet payments are ordinary public transactions with a hidden recipient; pool payments come only from deposits that passed the association set screening, which is Ville's own policy, not a legal guarantee. A recipient can share a viewing key to show payments to someone who needs to see them. Using it within the rules that apply to you is up to you.
Is there a privacy pool?
Yes. Deposit ETH or USDG on the pool page; after the screening wait you can pay anyone from it on the Send page. Your browser makes the proof and a bundler submits the payment, so your wallet is not on it. A deposit can always go back to the wallet that made it.
Can anyone see that I paid?
From your wallet: yes, your wallet shows as the payer, while the receiver stays hidden. From the pool: your earlier deposit is public, but the payment itself is sent by a bundler and the proof does not say which deposit paid, so it is not tied to your wallet.
Official token
There is one official $VILLE contract, and it is shown here first.
The token is separate from the payment features: you do not need it to send, receive or take a name. See the token page.
Names and pay links
Short words that point at your keys, with the trade-offs said out loud.
The rules
A name is 3 to 20 characters of a to z, 0 to 9 and hyphens (not at either end). One per wallet, first come, first served, free apart from gas, and you can release it. Its link is ville.cash/pay/<name>.
On chain in VilleDirectory
Names live in VilleDirectory. Claiming, repointing and releasing are transactions from the wallet that holds the name.
Contracts
Everything below is on Robinhood Chain mainnet, chain id 4663.
Neither Ville contract depends on the $VILLE token. Both are covered by unit, fuzz, invariant and fork tests against the live Robinhood Chain contracts. After deployment anyone can check an address against a clean build with the repository's verify-deployment script.