I land on the website.

Cool, straight to the point.

The main actions are right there:

Shield - Withdraw - Send - Swap - Request

All pretty intuitive titles. "Request" I'm not sure but I can kind of imagine. I'll find out later.

Let's connect the wallet.

Before connecting, something catches my eye: the icons next to the Connect Wallet button.

I click the globe.

Ahhh, very nice, I can choose my own RPCs on each chain.

I thought this was something you picked at the wallet level. To be honest, I don't understand that much about RPCs, but I like that the option exists.

I can also route through Tor and Nym, which is pretty cool.

And the position is actually a great choice. The privacy controls sit next to the wallet button, before I even connect. I don't have to go hunting for a settings page after the fact.

I don't configure anything for now and move to the other icon, the shield.

And here I get a bit confused.

Isn't this the same option I saw in the previous modal?

"Send RPC calls through anon-rpc"?

Why is the same option showing up twice?

Two different icons next to each other make me assume two different features. When both lead to the same setting, I start wondering what difference I'm missing here!

Okay, I close that. Let's connect the wallet for real.

Connect.

New modal: Unlock your account.

Pretty clear what I have to do. Okay, one more click to unlock.

I'm at the Shield tab.

I really like the recommended deposit amounts, especially the tooltip explaining why they matter for privacy.

I know why using common deposit amounts can help, but I'd guess a lot of users don't. A link explaining at a deeper level how deposit amounts affect anonymity wouldn't hurt.

I notice I'm on Ethereum mainnet. I'd like to go to Base.

I can change it from the button next to the wallet, and also is possible when I select the asset.

I love this double appearance. It subtle and doesn't feel redundant, it just puts the control wherever I already am in the flow.

That's the difference with the anon-rpc thing. Same idea, a control in two places, but here each entry point matches a moment where I actually want to switch. With anon-rpc, two different-looking doors led to the same room which makes me waste more clicks instead of saving them.

It says yield is 3.11%.

Wait. Where does it come from?? Do I have to activate it?? Does it add risk??

There's a tooltip, so I'm hoping it answers my questions.

"Aave yield position: accrues automatically into your balance"

Okey, super simple.

One line, and I know where the money comes from and that I don't have to do anything. Gud

I'll shield.

Click.

Now it seems I need to register.

It says it's a one-time thing. I register.

Easy.

I think it's done?? But it says pending.

"XXX USDC is pending approval. Spendable once approved."

It needs to be approved. By who? How long will it take? How can I track the process? Does it have steps? No one told me about this?

My money is floating in the air and I have no way to know if it's moving, if someone is checking it, or what is happening.

This is the most sensitive moment of the whole flow. The funds already left my wallet and I can't use them yet. Exactly when I need the most information, the product gives me only one word.

The approval step itself isn't a problem, but not knowing where I am inside it is. Even a tiny tracker would do a lot:

Submitted → Under review → Approved, spendable

Plus who reviews it and how long it usually takes. That's basic system status visibility, and with money involved it's also trust UX.

I go to Portfolio.

My deposit is still pending, but there's a "View pool" button. Let's see.

Deposits: 4.

WAIT WHAT??

Does that mean I'm hiding among just four deposits??

I came here for privacy, and suddenly I'm not even sure I'm getting any.

Maybe that number isn't actually my anonymity set? Maybe different assets share the same pool? Maybe swaps help increase the crowd I'm hiding in?

I honestly have no idea.

And that's the problem. I'm using a privacy product, but I can't figure out how much privacy I'm actually getting.

I go to Explore to understand this better.

First, it takes me a while to find the chain filter. Showing chain logos would make this much easier.

Now I'm looking at the different pools on Base, and the numbers aren't exactly reassuring. But I'm not even sure what I should be looking at.

More deposits? More volume? More recent activity? Does swapping between assets increase my anonymity set?

How do I know if I'm actually private?

This is tricky because you want to encourage users to deposit into smaller pools so they can grow. But at the same time, users need to understand the privacy they're getting.

The same way an exchange shows me the quote before I swap, or a lending protocol shows me the APY before I deposit, a privacy protocol should help me understand my anonymity set before I shield.

I don't expect a magic number that guarantees anonymity. I expect enough information to make an informed decision.

Right now, I know exactly how much yield I'm earning. I have no idea how much privacy I'm getting!

Wait, hold on. I see the Swap tab.

That means I can move into ETH and get out through there, right?

Let's try the swap.

It says that if it fails, the output can go to a transparent wallet??

I don't get that, and it's not as well explained as everything else.

This is the one moment in the flow where something private could become public. It deserves the best explanation in the product, not the vaguest one.

What does "fails" mean here? How often does it happen? If it does, what exactly becomes visible?

It seems my account got registered on Base but not on Ethereum. Same process I did before.

Very clear alert! Arigato!

It tells me what's missing, why I need it for this swap, that my wallet will switch networks for one transaction, and that it brings me straight back.

That's contextual UX done right. The explanation appears exactly when it's relevant to what I'm doing.

At the swap/bridge screen, let me know how much I'm receiving in dollars!

I don't know how many USD that amount of ETH is.

The bridge fee is already shown in dollars. Show me the output in dollars too.

Ok, now let's go to Request.

"Get paid without an address."

Nice. I put in my request, and it seems I can add a name.

Then I see the request page.

Wait...

It says it's private, but it also says it's signed by me?? With my wallet right there?

How does that work? I feel betrayed. If I had shared this with someone, they'd know my wallet.

The card I filled out promised "Get paid without an address". The page the payer sees shows an address.

If the wallet has to be there, tell me before I create the link, not after I've shared it.

Something like:

The payer will see: your display name and the wallet that signs this request

The payer won't see: your balance or your history

In a privacy product, the only thing worse than a data leak is users unknowingly exposing themselves because of bad UX.

The yield is on the first screen. The size of the crowd I'm hiding in is buried in a pool page, and I only found it after I deposited.

In a privacy product, that's the main number.

If you're going to let me choose the asset, amount, and chain, give me the information I need to understand the privacy implications of each choice. Otherwise, make those decisions for me and optimize for privacy by default.

Either give users the information to make informed decisions, or don't make them decide at all.

"Pending approval" is the scariest state in the product: the money left my wallet and I can't spend it.

Who approves it, how long it usually takes, and which step I'm in should all be visible right there.

The swap fallback to a transparent wallet and the request signed by my wallet are both moments where something private might become visible.

Those are moments that deserve the clearest copy in the app. Tell me what stays hidden and what doesn't, before I click.

The yield tooltip, the recommended amounts tooltip, the one-time register modal and the Ethereum registration alert all explain things at the exact moment I need them.

The gaps are small but stand out because of that: anon-rpc behind two icons, a chain filter without chain logos, a swap output without a dollar value.

Privacy Pools is really good.

The core flows are simple, and most of the time, the product explains things exactly when I need to understand them.

Building privacy products is particularly challenging because we're still figuring out what good privacy UX even looks like. Privacy Pools is definitely one of the projects leading the way and shaping what will eventually become the standard.

So while this roast is about Privacy Pools, most of my criticism applies to pretty much every privacy product out there.

The main weakness is the lack of visibility into the one thing I came here for: How private am I?

I saw my yield on the first screen. But I only discovered I was hiding among four deposits after I'd already shielded my funds, clicked through multiple screens, and moved my money out of my wallet.

An exchange shows me the quote. A lending app shows me the APY. A privacy app should show me the crowd.