Winnow · Puerto Rico · 15 minutes
From the café till.
To the family vault.
Meet Sofía. Her day explains why a phone wallet should learn from Bitcoin, adapt custody to the money, and tell the truth about its tradeoffs.
Sofía Cruz, Brisa Café, Harbor Exchange, Ceiba Trust, and the Rivera family are fictional. The signet transactions are real test evidence.
01 · the hot wallet
Open first.
Synchronize behind it.
Sofía creates keys, copies her recovery phrase, and receives at Brisa Café without waiting for a historical header download.
For Q&A: what happens at payment time?
The Receive screen watches a bounded relay window for an early observation. Confirmation still comes from a block. Spending shows destination, amount, fee, inputs, and change before signing; every spend is replaceable with RBF.
02 · the read path
Bring Bitcoin
to the phone.
Peers serve public headers and compact block filters. Sofía's phone checks those summaries against her scripts locally. It never asks a wallet server for her balance.
For Q&A: what does a peer still learn?
A peer sees a network connection and public chain ranges. A matched full-block request can add a correlation clue, so Winnow can use different peers. A full eclipse remains a real threat; this is a light client, not a validating full node.
03 · close the café
Tomorrow's cash stays hot.
Savings move cold.
One person does not need one custody model. Sofía sweeps excess operating funds into the Rivera reserve instead of leaving the whole business behind one phone key.
04 · ordinary 2-of-3
Elena and Leo
return operating money.
The transaction moves as a PSBT. Each signer reviews the destination and fee before adding a partial signature. No coordinator account can silently change the policy.
For Q&A: what appears on chain?
This path uses a Taproot script leaf with a threshold policy. Spending reveals that chosen script path, as Taproot is designed to do.
05 · inheritance path
A missing signer
does not erase the family plan.
If Elena cannot participate, Leo and Marina can exercise the same threshold after the family's real-world checks. Bitcoin enforces two keys; people define what qualifies as recovery.
Elena + Leo → Brisa Café liquidity
Leo + Marina → next-generation reserve
Either pair satisfies 2-of-3. Both paths confirmed in the public-signet story.
06 · joint reserve
Two people sign.
The chain sees one key.
Elena and Mateo complete MuSig2's nonce and signing rounds. Their contributions aggregate into an ordinary Taproot key-path signature.
For Q&A: why does nonce state matter?
Reusing a secret nonce can expose a signing key. Winnow keeps it only in the active signing screen, consumes it during round 2, and requires a new session if the signer leaves early. The verified spend had one 64-byte witness item and no revealed script.
one Taproot key-path signature07 · tell the whole truth
A replacement phone works.
Silent receive is not finished.
Winnow's export carries public history and scan state so a new phone can verify forward. Silent Payment sending works; receiving stays off by default while its mobile tweak-data backend remains experimental.
For Q&A: why not compact filters alone?
A Silent Payment output is not recognizable from the recipient's static code. The phone first needs a per-transaction tweak derived from sender inputs, then it can derive candidate scripts and query the ordinary block filter. The planned block-dn path requests fixed public ranges, never wallet identifiers, but a provider could still omit data.
Replacement phone matched balance, UTXOs, history, RBF links, and scan height.
Silent Payment send creates the recipient-specific Taproot output locally.
Silent Payment receive-and-spend did not complete in the current public story.
08 · public beta, open source
Try the story.
Inspect the choices.
Winnow defaults to public signet. Test without risking money, read the paper, and challenge the architecture.
winnowwallet.com/present
Take the story with you