Stay shielded all the way to the exit.
Guides today tell you to unshield before depositing, because shielded deposits get frozen. A Vintage proof lets the deposit stay shielded and still clear. This page lists exactly what each party sees when you use it.
One txid, three hops, no logs.
The API's domain is not proxied through Cloudflare, so Cloudflare serves the pages but never carries a check.
Each party, line by line.
| Party | Sees | Never sees |
|---|---|---|
| The exchange or rail | The deposit txid it already has, the event, and the verdict: these coins predate that block. | Your amount history, other accounts, senders, any key. |
| Our verifier | The txid and event, for the length of the request. Your IP, at the connection level. | Any key. It writes none of it down: no access log, no request log. |
| zec.rocks | The txid and the block ranges our server asks for, from our server's address. | Your IP or who asked. |
| Cloudflare | That you loaded a page of this site. | The txid, the verdict. No analytics script is allowed to run. |
| Anyone on chain | That the transaction used an older anchor than most wallets would. | Amounts, senders, receivers, history: all stay shielded. |
Age proofs need no key of any kind, not even a viewing key.
Amounts, senders and history stay encrypted on chain.
No logs, no analytics, no cookies, no third-party requests. Fonts are served from this site.
The verifier is open source. Your machine, a public lightwalletd, nobody else.
One counter. Nothing else.
Each finished check adds 1 to a daily total, keyed by the UTC date, the event and the verdict. A check against your own height is counted as "custom height", without the height. That is the whole record.
No transaction ids, no IP addresses, no times of day, no user agents. The web server in front of the API has access logging turned off, for plain HTTP as well as HTTPS. The totals are public, so you can see exactly what is stored.
{
"since": "2026-10-23",
"days": [
{ "day": "2026-10-23",
"counts": {
"PASS": 5,
"LINK_PASS": 1,
"total": 6 } }
],
"by_event": { "vintage-demo-2026-10": 6 }
}Theme choice (light or dark) is saved in your own browser's storage, and passed between this site and the app in the part of the address after #, which browsers never send to a server. No cookies.
What a proof does give away.
Most wallets anchor a few blocks back. A Vintage send anchors further back, and anyone reading the chain can see that. It says nothing about who you are or how much you sent, but it does mark the transaction as one that chose to prove its age.
Use it when you deposit somewhere that already knows you, such as an exchange account.
For coins received after an event, the link check shows the rail one single-use receipt account's viewing key. That reveals the funding payments, the amounts received, the receipt address and the deposit. Nothing from your other accounts. The viewing key cannot spend.
Our API drops the key when it answers: never written to disk, a log or a cache. Better still, the rail runs vintage link verify itself, so the key goes to nobody else. Rotate to a fresh receipt account for every use.
Check without us.
The verifier is the same code as the API. Run it on your machine and the only other party is the lightwalletd server you choose. Point it at your own Zcash node and there is no other party at all.
Exchanges can run vintage-api next to their own node, so nobody, including us, learns which deposits they check. See the integration section.
$ vintage verify <txid> --before bitget-2026-09 \
--server your-node.example:443