Make the privacy guarantee visible.
Show privacy as something a person can judge, not just a claim the interface asks them to trust.
Private swaps for tBTC
Murmur is a concept for moving tBTC privately: deposit into a shared pool, wait, then withdraw to a fresh address so there is no public line between the two. I designed it on my own, and it was never built. I am showing it because the design problem is a good one. On a public chain the cryptography is the easy part. The hard part is making an invisible guarantee feel real, and keeping the steps you cannot undo from ever feeling casual.
Murmur has two sides, and they depend on each other. There is you, trying to disappear, and there is the crowd you disappear into. Your privacy is only as strong as the set of identical deposits around you, so the whole design is built to make that crowd legible and to keep you from a mistake you cannot take back.
The flow is simple on the surface. You deposit a fixed amount of tBTC into a shared pool and get a secret note. You wait while more identical deposits join behind yours. Later you paste the note, pick a fresh address, and withdraw. On the chain, no one can tell which deposit became which withdrawal. The interface stays quiet until you connect, then opens up to show your history and the live set.
This is concept work, not a shipped product. There were no users, no client, and no measured outcomes. The value is in the UX problem: making an invisible guarantee understandable while making irreversible actions feel deliberate.
On a public blockchain, every transfer is visible and traceable, by amount and by address. A privacy tool has to break that link. But the real design problem is not the math. It is trust and safety. The guarantee is invisible, so a person has to be shown, clearly, how hidden they actually are. And the steps are irreversible: lose your note and the funds are gone, paste a bad address and they are gone. The interface has to make the invisible legible and the irreversible deliberate, at the same time.
Show privacy as something a person can judge, not just a claim the interface asks them to trust.
Guide people toward identical amounts because uniformity is what makes the crowd protect them.
Slow down the note and withdrawal steps so losing access or sending funds badly never feels casual.
Explain the privacy model through context, labels, and timing instead of heavy documentation.
The concept has two sides: depositing into the crowd, then withdrawing from it without revealing which deposit was yours.
Connect your wallet, pick one of four fixed amounts, and see how big your crowd is. Get your note and back it up. Confirm in your wallet, and your deposit joins the pool.
Paste your note, choose any fresh address, and let Murmur build a proof that you own a deposit without saying which one. Confirm in your wallet, and the tBTC arrives with no visible trail back.
01 - DepositChoose amount
02 - DepositCheck crowd
03 - DepositBack up note
04 - DepositConfirm
05 - DepositTrack history
01 - WithdrawPaste note
02 - WithdrawAdd address
03 - WithdrawBuild proof
04 - WithdrawConfirmA custom amount is a fingerprint. I chose four fixed denominations: 0.001, 0.01, 0.1, and 1 tBTC. When everyone deposits in identical amounts, no single deposit stands out. The uniformity is the privacy, so the interface had to make the uniform choice the only choice.

"You are private" is a claim a person cannot weigh. I showed the anonymity set as a plain count with a liveness cue, sized to the exact denomination, then revealed history and latest deposits once connected. The depth appears when you are transacting, not before.

The note is the only proof of a deposit. Lose it and the funds are unrecoverable. I gave that moment its own screen with the key, a copy action, a blunt warning, and an "I understand" check before the deposit can send.

On withdraw, a malformed note or wrong recipient address means funds lost for good. Inline validation and an inactive withdraw button make the interface refuse bad input before the wallet is involved, not explain it afterward.

I tried two real directions for the amount step. One was a slider with snap points, the pattern most tools in this space use. The other was four discrete tiles. Both present the same fixed set, so the choice was about the mental model.
A slider implies a range you dial in, which fights the one idea the product depends on: amounts are fixed and identical. Tiles say it plainly, pick one of four equal buckets, and they give each amount room to show its own crowd size. I chose tiles. The slider is not wrong, it is a fine pattern. Tiles just make the interaction match the idea the privacy rests on.
Direction AA familiar control, but it suggests a continuous range and makes fixed denominations feel like a constraint instead of the core privacy mechanism.
Direction BFour clear buckets make the rule visible: choose an identical amount, join an identical crowd, and avoid becoming the unique transaction.
The full concept flow, from deposit to withdraw, plus a How it Works screen that explains the model in plain language.
Introductory surface for choosing a private tBTC deposit amount.
Because nothing shipped, this is not a product before and after. It is the privacy state of a transaction. Before: a normal tBTC transfer is fully public, one traceable line from sender to recipient. After: many identical deposits go into a pool and identical amounts come out to fresh addresses, and the one true path is hidden inside the crowd. The crowd is the privacy.
Murmur was never built, and I would want a real usability pass before trusting the note-loss flow with anyone's money. But it is where the core idea of privacy UX clicked for me: the interface's job is to make an invisible guarantee feel legible, without ever letting the irreversible parts feel easy.
Fixed amounts, a visible crowd, a note you are made to respect, a withdraw that refuses bad input. None of it is flashy. For a privacy tool, that is the point.
Building something that needs a clear, trustworthy product experience? I'd love to hear about it.