Documentation
Everything an organiser, attendee, door volunteer or self-hoster needs: how to use Unlisted, what it protects, what it costs, and how it works underneath.
Unlisted is RSVPs for groups whose attendee list would hurt people if it leaked: support groups, union organisers, journalists and their sources, activists. A small refundable deposit in shielded ZEC stops no-shows. The deposit hides who paid, the ticket is a secret that lives only on the attendee’s phone, and the refund goes back to an address only the attendee knows.
The result: the server never has a list of people to leak. Its whole database for an event is random ticket hashes and one-time refund addresses, and it deletes those when the organiser purges the event.
If everyone comes, there are no forfeited deposits to pay network fees. The dashboard will ask you to send a small top-up (about 0.001 ZEC, no memo) to the event address, and refunds then go out automatically.
You need a Zcash wallet that holds shielded ZEC and can pay a payment link with a memo, such as ZODL.
u1). It must be fresh: never one you used for another Unlisted RSVP. The page checks it can receive a private (Orchard) refund before you pay.Your tickets are listed on the home screen under Your tickets, on this device only.
| If your payment is returned | Why |
|---|---|
| The event was full | Seats go in block order. Returned minus 0.0001 ZEC. |
| The amount didn't match | Every RSVP must pay exactly the deposit, so payments look identical on chain. |
| RSVPs had closed | The organiser closed RSVPs or the deadline passed. |
| The refund address was used before | Reusing an address would link your attendance across events. |
| The memo was changed | Without the memo there is no ticket. A payment with no readable refund address can't be returned. |
Open the door link on a phone and tap Start scanning. Each ticket shows Welcome in, Already checked in, Not a valid ticket or Wrong event. You can also paste a ticket code by hand.
The door keeps a copy of the event’s ticket hashes, so it keeps working if the connection drops. It queues check-ins and syncs them when it’s back online. It never sees names or refund addresses, and it records whether a ticket was used, not when.
UNL1 <event> <ticket hash> <refund address>. Only the event’s wallet can read it.Why only Zcash can do this: cards and PayPal give the organiser a name; Bitcoin and Ethereum put payer and refund on a public ledger. Shielded Zcash hides sender, receiver and amount, and carries the refund instructions inside the payment.
| Deposit | Set by the organiser, minimum 0.0005 ZEC. Refunded in full to everyone who checks in. |
| Returned payments | Refunded minus 0.0001 ZEC, so junk payments can't drain the event's fees. |
| Network fees for refunds | Paid from forfeited deposits and organiser top-ups, never from refunds. |
| When a refund counts as paid | Once its transaction is mined with 3 confirmations. One that expires unmined is sent again automatically; it is never paid twice. |
| No-show money | Swept, minus the network fee, to the organiser's no-show fund address once refunds have confirmed. Without an address it waits in the event wallet, and the event can't be purged until it is swept. |
| When refunds can go out | A deposit becomes spendable after 10 confirmations (about 12 minutes). Refunds queued earlier simply wait. |
| Who holds the money | Unlisted's wallet holds deposits until the event is settled. Keep deposits small: the price of a coffee. |
The server never stores names, emails, phone numbers, check-in times or ticket secrets, and the API keeps no access logs. (Your hosting provider’s edge may still log IP addresses; use Tor for high-risk events.) Organiser and door links keep their secret after the #, which browsers never send to any server. Attendees never send the server anything that points at their ticket.
Read the full threat model for what is stored, every known leak and how it is closed, and what you are trusting.
Unlisted is three pieces: this web app, a FastAPI service, and unlisted-wallet, a light-client Zcash wallet built on librustzcash that syncs from a public lightwalletd server over Tor, so no full node is needed.
# On a fresh Ubuntu server, as root: wallet + API + HTTPS, secrets generated for you curl -fsSL https://raw.githubusercontent.com/linoxbt/cashr/main/deploy/install.sh | bash -s -- api.example.com # Back up the wallet volume and, separately, UW_SEED_KEY. Both are needed to move funds.
Put HTTPS in front of the API, then deploy web/ to Netlify or Vercel with NEXT_PUBLIC_API_URL set to the API’s URL. Run exactly one API process: it refuses to start if another holds its database. Full settings are in docs/DEPLOY.md.
JSON over HTTPS. Organiser and door routes take Authorization: Bearer <token>.
| Method & path | Auth | Does |
|---|---|---|
GET /meta | — | Chain mode, network, current block, reject fee. |
POST /events | — | Create an event. Returns the event, the admin token and the door token (once). |
GET /events/:id | — | Public event details and counts. |
GET /events/:id/tickets | — | Every ticket hash, plus returned payments. Statuses appear only once the event settles. |
GET /events/:id/admin | Admin | Everything stored for the event, the wallet balance and payouts. |
POST /events/:id/admin/:action | Admin | Actions: close, reopen, settle, retry, purge, scan. Purge refuses while money is left in the event wallet. |
POST /events/:id/admin/fund | Admin | Body {"address"}. Set the no-show fund address; a settled event’s leftovers are swept to it. |
GET /events/:id/door/manifest | Door | Confirmed ticket hashes for offline checking. |
POST /events/:id/door/checkin | Door | Body {"ticket_hash"}. Result: ok, already, unknown or event_closed. |
POST /events/:id/door/sync | Door | Upload check-ins recorded offline. |
No. They see how many tickets were checked in, never whose. The deposit's sender is hidden even from the event's own wallet.
It can't be recovered: no one else has the secret. Save the ticket image when you RSVP.
The event keeps working for attendees, but no one can settle it. Funds stay in the event's wallet account, which only the server operator can move.
Paying from a transparent balance exposes your address. Pay from your shielded balance; refunds always go to a shielded address.
Your payment needs one block (about 75 seconds) to confirm. If it never confirms, check the amount and memo were unchanged.
No. It holds only hashes of tickets, and the door needs the secret behind the hash.