Free
- Join any number of circles
- Own one circle at a time
- End-to-end encrypted text messages
- Messages kept 7 days, last 500 per circle
- Automatic key hand-off and rotation
- Member list with device-signature checks
01 · What it is
A group chat that checks the door and can't read the room.
Zirkle lets you open a circle: a chat room tied to one Solana token and a minimum holding. Holders join with a wallet signature; non-holders can't get in. Everything said inside is encrypted in members' browsers with a key the server never has, and that key is replaced whenever someone leaves.
- For communities around a token — holders-only rooms without a bot that reads every message.
- For small teams and friends — gate a room on any token you all hold, even native SOL.
- Answers one question well: “Can only the people who hold this read what we write?”
- Nothing to install — a browser and a Solana wallet are enough.
02 · What you're looking at
The orbit is the circle. The core is its key.
Core = the circle key
“E3” means the key is on its third epoch (it has been created once and rotated twice). Its colour is derived from the current key's fingerprint, so a rotation visibly changes it.
Dots = members
One per member wallet. The broken ring around each dot is an identicon from the wallet address, so the same wallet always looks the same. Small satellites are that member's devices.
Hollow, outside the ring = waiting
A member whose device hasn't received the circle key yet. Any member's open browser hands it over automatically after checking the device signature.
Pulse + ripple = a sealed message
A packet flies from the sender into the core and ripples outward: a real message was encrypted and posted. Its content never leaves the members' browsers in the clear.
Gold beam = a key hand-off
One member's device wrapping the circle key for another device. This is the only way a key ever moves, and it is encrypted to that one device.
White flash + sweep = rotation
Someone left, was removed or no longer holds enough. A fresh key is made and wrapped to every remaining device; the epoch number goes up.
Before you open a circle, the core shows a short fingerprint of this browser's device key and the orbit shows the circles you're in (click one to open it). Nothing on the canvas is simulated: it only draws state the server returned to you and events that really happened.
03 · How it works
Five steps from wallet to sealed message.
- 1
Bind a device
Your browser creates an X25519 key pair; the private half is non-extractable and stays in IndexedDB. Your wallet signs a sign-in text that contains the public half.
- 2
Check the door
The server reads your balance of the circle's token from Solana (
getTokenAccountsByOwner, orgetBalancefor SOL) and compares it with the minimum. It re-checks at most every 10 minutes while you're active. - 3
Hand over the key
A member's browser verifies your device signature (Ed25519), then wraps the circle key for your device: X25519 shared secret → HKDF-SHA-256 → AES-256-GCM.
- 4
Seal and store
Messages and files are encrypted in the browser with AES-256-GCM, bound to the circle, the key epoch and the sender. The server keeps the ciphertext for 7 days by default, then deletes it.
- 5
Rotate on exit
When anyone leaves, is removed or stops holding, posting pauses until the next member online makes a new key and wraps it for every remaining device.
Limits, honestly: a new member can only read messages from the current key epoch onward. If no member's browser is open, a newcomer waits for the key until someone is. Circles hold up to 250 members and 400 devices. Live updates use one Server-Sent Events stream per open circle; there is no polling of Solana while nobody is active.
04 · Built with
Small, auditable, no frameworks.
- WebCrypto onlyX25519, HKDF-SHA-256, AES-256-GCM, Ed25519 verification. No crypto libraries shipped to your browser.
- Non-extractable device keysThe private key object is stored in IndexedDB and can be used, but not read out, by page scripts.
- Epoch key rotationCompare-and-set on the server so two members can't rotate at once; posting is refused under a stale key.
- Zero-dependency Node serverPlain
http, atomic JSON files, token-bucket rate limits, strict CSP with a per-request nonce. - Canvas 2D orbit rendererDPR-capped, pauses off-screen and in background tabs, still frames under reduced motion.
- Hand-encoded Solana burnAn unsigned v0 transaction (burnChecked + memo) built server-side; verification reads v0/v1 transactions including lookup-table keys.
05 · Features
Free to use. A burn opens the bigger room.
Unlock with the coin
75,000 tokens burned · 30 days · stacks
- Own up to 12 circles
- Messages in your circles kept 30 days
- History of 5,000 messages per circle
- Encrypted file sharing — up to 5 MB per file, 100 MB per circle
Premium applies to circles you own while your unlock is active; everyone in them benefits, and joining stays free.
Checking…
Burning destroys tokens permanently. It does not give you any return, revenue share or financial right. The free version of this app stays free.
06 · The coin
Its one job here: be burned to unlock.
In Zirkle the coin has a single use. You burn it from your own wallet, in a transaction you sign yourself, and the server reads that burn back from the chain before turning premium on. Tokens are destroyed by the SPL Token program — nobody receives them, not us, not anyone. The coin is coming soon; until it launches, burn features show “Coming soon”.
Burning destroys tokens permanently. It gives no return, revenue share or financial right. The free version stays free.
Burn ledger
Public and verifiable on-chain.07 · Privacy & safety
What we can see, and what we can't.
The server can see
- Circle titles, token mints and minimums
- Member wallet addresses and their device public keys (plus the signed text binding them)
- Who posted, when, and how large each ciphertext or file is
- Your IP address while a request is handled — kept only in in-memory rate limiters, never logged or stored
The server cannot see
- Message text, file contents or file names
- Circle keys (only wrapped copies, each encrypted to one device)
- Your device private key — it is non-extractable and never leaves the browser
- Your wallet's secret key, seed phrase or funds — never asked for, never touched
The trust model, plainly
You trust this server to check holdings honestly. It decides who passes the door. A dishonest operator could admit a wallet it controls, and members' browsers would then hand that wallet's device the key. What it cannot do is swap a real member's device key: your browser verifies each device signature against the member's wallet before wrapping anything, and every member and device is listed in the circle's member panel.
Zirkle is not anonymous. Members see each other's wallet addresses. Former members keep whatever they already decrypted; rotation protects what is written after they leave.
Abuse: every message has a Report button. A report sends the message id and your reason, and — only if you tick the box — the decrypted text you choose to share. The operator can remove messages or circles after signing a takedown with the operator wallet. Rate limits, size caps (4,000 characters, 5 MB files) and expiry apply to everyone. Illegal content is forbidden by the terms below.
08 · FAQ
Questions people ask.
Can Zirkle read my messages?
No. Messages are encrypted in members' browsers with the circle key, and the server only receives ciphertext. It has wrapped copies of the key, but each is encrypted to a member's device key, which it never sees.
Why am I “waiting for the circle key”?
Keys travel device to device. When you join, another member's browser has to be open to wrap the key for you; that happens automatically within seconds once one is. If you created the circle, your own browser makes the first key.
What happens if I sell my tokens?
The next time the server re-checks you (at most every 10 minutes while you use the circle, or in a slow background check), you're removed and the key rotates. You keep what you had already read; new messages are sealed under a key you don't get.
I cleared my browser data. What now?
Your device key was deleted with it. Sign in again: a new device key is created and a member's browser will hand it the current circle key. Messages from earlier key epochs can't be recovered on the new device — that's the point of not storing keys on the server.
Which wallets work, and on mobile?
Any wallet that supports the Wallet Standard with message signing (Phantom, Solflare, Backpack and others), plus Phantom's injected provider. On a phone, open Zirkle in your wallet's in-app browser.
Does it cost anything?
No. Signing in is a free message signature and circles are free. The only optional on-chain action is burning the coin to unlock premium, which costs the tokens burned plus a normal network fee.
What exactly happens when I burn?
The server builds an unsigned transaction with one SPL burnChecked instruction for the exact amount shown, plus a memo. Your wallet shows it, you sign and send it, and the server reads it back from the chain before extending your unlock by 30 days.