One café · three layers of custody

From the café till.To the family vault.

Sofía runs Brisa Café with a small phone wallet, moves savings into shared cold storage, and leaves her family a recovery path—all without turning a wallet server into a map of her money.

Join the public beta Follow Sofía's story

A fictional Puerto Rico story, proven with public signet transactions · open source

Winnow's receive screen: a QR code, a fresh Taproot address beginning tb1p, and a note that incoming payments appear as unconfirmed within seconds while the screen is open.

A fresh Taproot address, derived on the phone.
No server was asked to produce it.

The café-to-vault story

One person does not need one custody model.

Sofía Cruz, Brisa Café, Harbor Exchange, Ceiba Trust, and the Rivera family are fictional. Their journey turns Winnow's architecture into a situation people can reason about: daily cash stays quick; savings become shared; recovery survives one missing person.

01 · daily

Café hot wallet

Sofía alone can receive customers and pay suppliers from her phone.

02 · savings

2-of-3 cold reserve

Two of Elena, Leo, and Marina are required. One missing key is survivable.

03 · family

2-of-2 joint reserve

Elena and Mateo cooperate with MuSig2; the chain sees an ordinary Taproot spend.

Winnow receive screen showing a fresh signet Taproot address and QR code.

Public signet demonstration · coins have no value

Sofía Cruz · Brisa Café

Morning: open the till.

The wallet and its first address are created on the phone immediately. Bitcoin headers can load in the background; Sofía does not wait for the network to write down or copy her recovery phrase.

A customer pays a fresh Taproot address. While Receive is open, Winnow watches a bounded slice of peer relay traffic for an early heads-up. The balance becomes final only when the transaction appears in a block.

Why it is different: creating keys is local. Knowing what confirmed is a separate network job.
Winnow transaction review showing destination, amount, fee, inputs, and change before signing.

The signature does not exist until the review is accepted.

Sofía pays Lina Vega

Noon: pay the supplier, then fix the fee.

Winnow shows the destination, amount, fee, inputs, and change before it asks the secure key store to sign. It relays the signed transaction directly to Bitcoin peers.

If the fee is too low, Replace-by-Fee creates a higher-fee successor. The history keeps the whole replacement chain instead of pretending the first transaction vanished.

Verified: the public-signet story confirmed a two-step replacement chain and the final spend.

Bitcoin comes to the phone

Block headersProve the chain's accumulated work.
Compact filtersSummarize every block for every client.
Local matchThe phone decides which blocks matter.
The read path

All day: learn without asking for a balance.

Ordinary peers send the same BIP157/158 block summaries they can send to any compact-filter client. Winnow matches those filters against Sofía's scripts on her device and downloads a full block only after a match.

No explorer or indexer receives a list of her addresses. Explorer links remain available for a person who deliberately wants a faster second opinion, but Winnow warns before opening one.

The privacy boundary: peers can see a network connection and requested public chain ranges. They are not sent Sofía's addresses, keys, or balance.

Rivera reserve · any 2 of 3

Elena RiveraFamily steward
Leo SantosHarbor Exchange custodian
Marina OrtizCeiba Trust officer
Brisa Café savings

Closing time: sweep the excess cold.

Sofía moves funds she does not need tomorrow into a Taproot 2-of-3 reserve. The script path names three independent keys, but any two can authorize a spend.

Elena and Leo return normal operating liquidity. The signers exchange PSBTs, and each device reviews the actual transaction before adding its partial signature.

Verified: hot-wallet funds fed the cold reserve, and an Elena + Leo spend confirmed on public signet.
Winnow vault cosigning screen reviewing a partially signed Bitcoin transaction.

Cosigning is transaction review, not blind approval.

Recovery · Leo + Marina

Years later: one person can be absent.

If Elena cannot sign, Leo and Marina can use the same 2-of-3 policy after the family's real-world recovery checks. Bitcoin enforces the threshold; Winnow does not invent a coordinator account that can override it.

The recovery spend in the story moved funds toward Elena and Mateo's next-generation reserve without using Elena's signature.

Verified: the independent Leo + Marina path confirmed and credited the intended recovery output.

Joint reserve · both sign

Elena RiveraNonce and signature contribution
Mateo RiveraNonce and signature contribution
On chainOne 64-byte key-path signature
Elena + Mateo

Two people cooperate. The chain sees one signer.

MuSig2 lets Elena and Mateo combine public keys and signature contributions. Both must participate. Winnow keeps each secret nonce only in the active signing screen; leaving before round 2 abandons that session, and signing consumes the nonce.

The final spend uses Taproot's key path: no multisig script is revealed, and an observer sees the same witness shape as a single-key Taproot spend.

Verified: the public-signet transaction confirmed with one 64-byte witness item and no revealed script.
Winnow import report showing a replacement phone's verified wallet data.

The replacement phone verifies forward from the exported history.

Sofía's replacement phone

A backup includes more than twelve words.

Winnow scans forward from a wallet's creation height. Its portable export therefore carries public history and scan state alongside the material the user explicitly chooses to include.

The story imported a redacted-preview seed-bearing bundle into an isolated replacement phone, verified forward, and matched balance, UTXOs, transaction history, replacement links, scan height, and peer connectivity.

Leaving is a feature: the app exports the history it would otherwise have to rediscover through an expensive back-scan.

How it works

Every block is summarized. The phone keeps what matters.

Winnow verifies the proof-of-work header chain, downloads compact summaries from ordinary Bitcoin peers, and checks them against wallet scripts on the device. A peer serves public chain data rather than answering “what belongs to Sofía?”

blocks winnowed 0 yours 0 addresses revealed 0

The last counter is the point: standard wallet discovery does not send an address to a wallet server. Read the architecture →

What Winnow changes

The phone is a participant, not a remote control.

01 · local first

Keys now, chain later

Create and back up a wallet without waiting for header synchronization. The recovery phrase remains available from Settings behind device authentication.

02 · read privately

Bitcoin peers, not wallet queries

Headers establish chainwork. Compact filters bring public block summaries to the phone. Matching happens locally.

03 · pay directly

Review, sign, relay, replace

Transactions are assembled and signed on-device, relayed to peers, and tracked through explicit RBF replacement links.

04 · custody fits the money

Hot, shared, and jointly private

One app expresses a daily BIP86 wallet, script-path k-of-n reserves, and MuSig2 n-of-n reserves without a coordinator service.

05 · portable history

Recovery includes context

An export carries the wallet's public history and scan frontier so a replacement phone can verify forward instead of asking an indexer to reconstruct the past.

06 · honest switches

External services are visible

Explorer links and experimental Silent Payment receiving sit behind plain warnings. A convenience does not quietly become the wallet architecture.

The honest trade

Privacy does not erase constraints.

These are product boundaries, not footnotes.

Signet is a proving ground

The public story uses signet, where coins have no value. Mainnet is not presented as release-ready by this demonstration.

Filters describe blocks

Normal discovery happens at confirmation. A bounded receive-screen relay window can show an earlier observation, but “seen” is not “confirmed.”

Explorer visits disclose

Opening a transaction or address at a selected explorer gives that service an IP address and the item requested. Winnow warns first and never uses Esplora as its default read path.

Silent receive is experimental

Sending to a BIP352 code is self-contained. Mobile receiving needs extra per-block tweak data before filters become useful. The live story did not complete that receive-and-spend proof.

Filters are not consensus commitments

Winnow compares peers and can fetch a matched full block, but a fully eclipsed phone remains a real threat. Manual peer controls let advanced users choose their own node.

Forward-only recovery is deliberate

A seed alone cannot cheaply recreate Winnow's whole history. The export bundle belongs beside the recovery phrase because it records where verified forward scanning begins.

Verified on public signet

The story left transactions behind.

Standard payments, replacement, both 2-of-3 paths, and the MuSig2 key-path spend were observed and confirmed. Silent receiving remains outside the pass set.

Confirmed

Customer funding

Brisa Café's hot wallet receives its first UTXO.

44890b72…935c0
Confirmed

Final RBF replacement

The higher-fee supplier payment confirms.

543a9cf3…ff65
Confirmed

Cold-reserve funding

Sofía's hot wallet feeds the Rivera reserve.

0e860e41…e791
Confirmed

Elena + Leo

The ordinary 2-of-3 path returns liquidity.

46081b3d…698a
Confirmed

Elena + Mateo

MuSig2 produces a Taproot key-path spend.

1b126138…dc03

Read the sanitized evidence summary →

Public beta · open source

Try the story. Inspect the choices.

Winnow defaults to public signet so the architecture can be tested without risking money. The implementation and its open issues are available for review.

Try Winnow on TestFlight Inspect the source

Open the 15-minute presentation · Read the canonical paper