> For the complete documentation index, see [llms.txt](https://docs.husher.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.husher.io/documentation/privacy-model/privacy-model.md).

# Privacy Model

How Husher reduces on-chain exposure through architecture, non-custodial execution, and optional privacy-enhancing routing

Husher incorporates privacy as a design principle, not as a marketing promise.

Rather than relying on user accounts, internal balances, or custody, Husher reduces unnecessary exposure during swaps through non-custodial execution, minimal data retention, and optional privacy-enhancing routing.

{% hint style="info" %}
Privacy in Husher is primarily structural. No accounts, no internal balances, no custody of funds. The architecture reduces what is created and retained, not just what is disclosed.
{% endhint %}

### What this section covers

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Privacy by Design</strong></td><td>The architectural choices that reduce metadata creation and retention by default.</td><td><a href="/documentation/privacy-model/privacy-model/privacy-by-design.md">Privacy by Design</a></td></tr><tr><td><strong>Non-Custodial Execution</strong></td><td>Why Husher never holding funds is itself a privacy and security guarantee.</td><td><a href="/documentation/privacy-model/privacy-model/non-custodial-execution.md">Non-Custodial Execution</a></td></tr><tr><td><strong>Private Mode Overview</strong></td><td>The optional mode that adds privacy-enhancing routing to reduce on-chain linkability.</td><td><a href="/documentation/privacy-model/privacy-model/private-mode-overview.md">Private Mode Overview</a></td></tr><tr><td><strong>Execution Flow (Conceptual)</strong></td><td>A step-by-step view of how Normal and Private Mode orders travel from input to output.</td><td><a href="/documentation/privacy-model/privacy-model/execution-flow-conceptual.md">Execution Flow (Conceptual)</a></td></tr><tr><td><strong>Privacy Networks: Monero and Zcash</strong></td><td>How XMR and ZEC shielded transactions are used as optional routing intermediaries.</td><td><a href="/documentation/privacy-model/privacy-model/use-of-privacy-focused-networks-monero-and-zcash.md">Use of Privacy-Focused Networks (Monero &amp; Zcash)</a></td></tr><tr><td><strong>What Private Mode Does and Does Not Do</strong></td><td>The specific protections Private Mode provides, and the honest limits of what it does not guarantee.</td><td><a href="/documentation/privacy-model/privacy-model/what-private-mode-improves.md">What Private Mode Does and Does Not Do</a></td></tr><tr><td><strong>Multi-Wallet Distribution and Privacy</strong></td><td>How splitting output across multiple addresses adds discretion without claiming anonymity.</td><td><a href="/documentation/privacy-model/privacy-model/multi-wallet-distribution-and-privacy.md">Multi-Wallet Distribution &amp; Privacy</a></td></tr><tr><td><strong>Shared Responsibility Model</strong></td><td>The four parties whose behavior collectively determines privacy outcomes.</td><td><a href="/documentation/privacy-model/privacy-model/shared-responsibility-model.md">Shared Responsibility Model</a></td></tr><tr><td><strong>Why Transparency Matters</strong></td><td>Why Husher documents both the benefits and limits of its privacy approach.</td><td><a href="/documentation/privacy-model/privacy-model/why-transparency-matters.md">Why Transparency Matters</a></td></tr></tbody></table>