Documentation

xenia.studio is an adult social network built on one idea. The XENIA filter rebuilds every photo into anime before anyone sees it, so you can show as much as you want and still never be identified. Most of what happens here is looking: a feed of verified adults (18+) remade as fantasy. The filter runs in your browser in XENIA Studio; your original photo is never stored, only the rebuilt image. You are seen, not identified.

If you want more than the feed, connection is here too, and it stays optional. In-app Messages are end-to-end encrypted: sealed in your browser with a key from your wallet, decrypted only when you open them, readable only by you. The server stores ciphertext and never reads a word. It is a quieter way to flirt and meet, whether you come alone or already have someone.

Money is just as direct. Every tip and every unlock is a wallet to wallet transaction on Solana mainnet, routed through a single on-chain program that drops 93% straight into the creator's wallet in the same atomic instruction, keeping a 7% fee. XENIA never holds funds, never issues balances, and never custodies a key.

SOLUSDCGoldjitoSOL5.50% APY

Spend, earn, save

Why XENIA exists

Most adult play comes with a cost. Exposure. The awkward run-in months later. A real face attached to it forever. XENIA gives you the upside and skips that bill. You get the freedom, the people, the rush of being wanted, and your face never leaves the building.

Single or in a couple, it is a safer way to explore what you are into. You decide what you share, who sees it, and what it costs. The filter rebuilds every photo and the original is never stored, so your likeness comes through without ever being identifiable.

There is more here than content. Encrypted Messages let you flirt and say what you want in private. A tip is how you show a creator you appreciate them. An External DM unlock opens a line off platform, on the creator's terms. How far any of it goes is up to you.

That is the whole thesis: you can publish your most passionate moments and wake up the next morning with excitement instead of regret.

How XENIA works

The whole platform is one loop: you create, you publish, you earn in the money you spend and get paid in, and you can save or grow that income without ever leaving the app.

1

Create

Redraw a source photo into anime in the Studio. Your original is never stored, only the rebuilt image, so you are seen, not identified.

2

Publish

Ship each creation to your page public, protected behind an unlock price, or to your circle. Everything lands private until you say so.

3Earn

Tips and unlocks settle wallet to wallet on Solana, 93% to you in the same atomic instruction. Your income arrives in the money you spend and get paid in:

SOLUSDC

Save or earn in the wallet

One tap swaps your balance into either, with no lockup, and back to dollars whenever you want.

Save in gold

Hold value in PAXG, one token to one ounce of vaulted gold.

Earn by staking

Stake into jitoSOL for yield, tradable the whole time.

1. Sign up with a username and email, verify the email with a 6-digit code, pass 18+ age verification (which also captures your private likeness), and create a non-custodial Solana wallet in the browser. Your profile lives at username.xenia.studio.
2. Create in the Studio at /studio. Upload a source photo, say what you want, and press Generate. The redraw runs on XENIA’s cloud GPUs, paid per render in SOL or USDC. Only the rebuilt image is kept.
3. Publish from the dashboard. Every upload lands as private. Flip each image to public (visible to everyone), protected (shown as an irreversible blur until unlocked for a price you set), or circle (a drop only your circle can see, no charge).
4. Viewers explore the global ranked feed and creator subdomains. Once they are logged in and verified, they can follow a creator, tip any image or profile, send encrypted Messages, unlock protected images, and buy a creator's External DM unlock.
5. Every payment settles on chain. The browser builds and signs the transaction. The server just verifies what already happened on chain and records the entitlement.

Where to start

• New here: walk through Getting Started and Age Verification to create and activate an account.
• Creators: the Creator Guide covers creating in the Studio, publishing, pricing, and earnings end to end.
• Here to connect: see Messages for encrypted in-app chat, profile tipping, and rating requests.
• Curious about privacy: read Privacy & the Filter and Security & Encryption.
• Developers: see The Smart Contract for the on-chain program and XENIA Studio for the create flow and pay-per-render model.

Core principles

1. The filter is the identity boundary. The source photo is never stored; only the rebuilt image exists. The platform stores, serves, and ranks only the transformed output.
2. Non-custodial money. Funds live in your own wallet. Tips and unlocks pay creators directly. The commission split happens inside one on-chain instruction, not in a database.
3. Encrypted storage. Every stored image is encrypted at rest with AES-256-GCM envelope encryption. Protected and private content is unreadable in database dumps or backups.
4. Verified adults only. Both email verification and 18+ age verification are required before an account can post, follow, tip, or unlock.

Platform at a glance

Creating an account takes a few minutes and happens entirely in the browser. XENIA has no passwords. Your non-custodial Solana wallet is your identity, and a passkey on your device is what unlocks it locally.

Here is the whole path, from a blank screen to your first earnings. The first four steps are the signup wizard below; the last is what happens the moment your page goes live.

The signup wizard

1. Username and email. Pick a unique username (it becomes your username.xenia.studio subdomain) and enter an email address. The email is required for activation and is never shown publicly.
2. Email code. A 6-digit code is sent to your address. Codes expire after 24 hours, allow 5 attempts, and resends are rate limited.
3. Identity verification. Verify with a government ID through Yoti (an ID document scan with a live face match, or the Yoti app), which proves both that you are over 18 and that the person is you. See Age Verification for exactly how it works and what is stored.
4. Wallet creation. The browser generates a Solana keypair, wraps it with a passkey, and shows you a 24-word recovery phrase exactly once. XENIA creates the wallet for you. You cannot import an external one, and your account is bound to this address for good. See Wallet for the full mechanics.
5. Create your account. Your passkey signs the account creation. The live face from your ID verification becomes your private likeness reference. It is stored encrypted and never shown publicly. It ties the account to one real verified adult, lets the Studio confirm your likeness in your renders, and backs enforcement if the account is ever abused. Sign-up does not complete without it.

Activation

Email verification and 18+ age verification both happen inside the wizard, before the account record exists, so a normal signup comes out activated from the start. Activation means both the email and the age check have passed. An activated account can post, publish, follow, tip, unlock, set DM handles, and create in the Studio. If an account ever drops one of the two (say an email later marked unverified), the dashboard shows an activation checklist and those actions stay blocked until you finish it. Browsing the public site needs no account at all, only the 18+ self-attestation gate shown on first visit.

Logging in

Login is a wallet signature, not a password. The server issues a single-use challenge, your passkey unlocks the wallet key for a moment, and the key signs a canonical string:

xenia-login-v1:{walletPubkeyBase58}:{nonceBase64url}

The server verifies the Ed25519 signature, burns the challenge, and sets a session cookie (30 days, httpOnly, shared across your subdomain). Secrets are zeroed from memory after every signature.

Optional two-factor authentication

Any account can add a second factor under Dashboard > Settings > Security. Two methods exist and you can enroll either or both:

• Authenticator app (TOTP). Scan a QR code, confirm one 6-digit code, and you are enrolled. Ten single-use recovery codes are generated at enrollment and shown once.
• Passkey. A server-side WebAuthn credential, independent of the passkey that wraps your wallet. You can enroll several, name them, and revoke them individually.

With 2FA on, login takes two steps. The wallet signature comes first, then a TOTP code, a passkey assertion, or a recovery code. Enrolling or removing a factor always requires a fresh wallet signature.

Your subdomain

Every account gets username.xenia.studio. It serves your public profile: avatar, bio, follow button, the DM unlock card, and your image grid with tip and unlock actions. A set of system and safety names (for example www, app, api, admin, docs, dashboard, login, xenia, support, and abuse) is reserved and cannot be registered.

Next steps

• Open the web studio at /studio and make your first render, pay-per-render in SOL or USDC: XENIA Studio.
• Learn the wallet, send / receive, and (optionally) funding it to spend: Wallet. Earning needs no funding.
• Start publishing and earning: Creator Guide.

XENIA Studio is the web studio at /studio. You upload a source photo and the XENIA filter redraws it as clean anime / 2.5D illustration. It redraws the hair, face, and body while holding your likeness, your pose, and the moment you shot. After that you can turn the still into a short looping clip. It runs in the browser. Nothing to download, nothing to install.

Your original photo is never stored. Only the rebuilt image exists, so what lands in your content shows you as anime, never your real face. Every session starts here.

Studio preview

New screenshots coming soon

Opening the Studio

The Studio lives at /studio once you are signed in. There is no app to download and no device to pair. The editor loads in the browser and is ready right away. Renders run on XENIA’s cloud GPUs, not your own hardware, so the same render takes the same time on a laptop or a phone.

The create flow

A session runs from source photo to finished render in a few steps. Drop a photo into the editor, set the result on the right, generate, and approve the payment that runs it.

1. Add a source photo. Drag in or pick the photo you want to transform. It uploads only to be redrawn and is never stored. Once the render is built, only the rebuilt image remains.
2. Direct the result. Set a theme, cast the characters, add style and effects (everything in the next section). Leave it all blank and the redraw stays true to the photo.
3. Generate. Press Generate. The Studio quotes the render and opens the payment.
4. Approve the payment. Confirm the on-chain SOL or USDC payment in your passkey wallet (see Pricing and payment). The render begins the instant the payment verifies on chain.
5. It lands in your Private Library. The finished render arrives in your Private Library, private until you move it. Rework it with a paid edit or a remix, then ship it to Content to publish, lock and price, mint, or animate it.

Directing the result

Everything you set lives in one inspector beside the canvas, and you work within the filter’s rules. Leave it all blank and the redraw converts the photo to anime. Opt in to as much or as little as you want.

Keyboard shortcuts: Cmd or Ctrl plus Enter generates, and R re-rolls the result on the easel into a fresh variation.

How the redraw works

XENIA Studio does not lay a filter over your photo. It runs an anime redraw that replaces the photo’s pixels with new anime art, while a stack of guidance models holds your likeness, pose, and anatomy in place. Every photo runs the full stack. Each enhancement stage is guarded, so if one trips it gets skipped and the render still finishes. The safety checks are the one exception. They can stop a render and are never skipped.

The pieces that keep it from melting:

• A director reads the real scene. A vision model studies the photo and writes down what is happening and where each hand sits. The redraw then follows the real situation instead of inventing mangled anatomy.
• High-strength redraw, not paint-over. A weak filter smears the photo. A strong redraw replaces it with real anime. Triple ControlNet (edges for likeness, depth for volume, pose for limbs) then locks it back onto the original.
• Dedicated hand and face passes. The two regions that always break get re-rendered large and clean.
• Colormatch and a final upscale give a faithful palette and a crisp HD finish.

Animating a still

Any finished still can become a short looping clip. Open Animate mode, pick one of your renders, and press Animate. The model reads the image and writes the motion itself, with no setup from you. Animation is its own render on XENIA’s cloud GPUs and is priced separately (see Pricing and payment). The finished loop lands in your Private Library like a still, a creation that plays.

The Private Library

Every creation lands in the Private Library, a gallery only you can see. Nothing leaves it until you say so. Rework it there with a paid edit or a remix, then ship a creation to Content on your dashboard. Content is where you act on it. From Content you can:

You can also mint a creation as an NFT to your own wallet straight from the gallery and then sell it on the marketplace. See Collectibles & NFTs.

Paid edits and tools

A creation is a starting point. From any item in the Private Library you can run a paid edit, a second pass that takes the existing render and reworks it. Each edit is its own render on XENIA’s cloud GPUs, priced like an image render (about $0.08), and approved on chain in your passkey wallet like a generation (see Pricing and payment). The result lands back in the gallery as a new creation, and the original stays put.

Pricing and payment

XENIA Studio is pay-per-render, on chain and non-custodial. Every render is a Solana payment in SOL or USDC, approved per render in your passkey wallet. A generation, an animation, and a paid edit are each their own render and their own payment. No subscription, no credits, no balance held by the platform. The render starts the instant the payment verifies on chain.

Prices are set in USD and charged in SOL or USDC at the spot rate, shown to you before you approve. You pick the currency at payment time. The same SOL drift tolerance used everywhere on XENIA absorbs normal price movement between the quote and the on-chain confirmation.

What a single render costs, in both currencies, off the live rate:

The safety gate (always on)

Consensual adult content of any kind passes through untouched. The gate exists so the tool cannot be pointed at the things it must never make.

Provenance badges

Every render carries a small set of provenance tags that record how it was made: your verified face, whether the body was left natural or enhanced, any theme, a third person in the scene, and so on. XENIA draws the tags as a credential stack in the corner whenever the content is shown, from one place in the code, so it reads the same everywhere. The badges run left to right and only the ones that apply show.

Because Natural and Enhanced are scoped to the body alone, they sit alongside the other badges instead of contradicting them. A few examples: XENIA · Natural is a plain conversion; XENIA · Enhanced had a fitness change; XENIA · Natural · DEMON is a real body in a demon costume; and XENIA · Verified · Enhanced · MMF · DEMON is your verified face, a fitness change, a third person, and a demon theme. XENIA renders the stack from the stored tags. On a still image it composites into the corner; on an animation it draws as a live overlay while the clip plays. The platform adds it on every view from the provenance it stored, so the disclosure never falls to the creator.

From the Studio to your page

The path of a finished render is the same for a still image and an animated loop.

Still images and loops behave the same way once they are in your Private Library. A loop is just a creation that plays. When you protect an item with a price, viewers see only an irreversibly blurred teaser until they pay, and the unlock is permanent and settles wallet-to-wallet on Solana (see Tips & Unlocks). Public items show full-quality on your page and flow into the shared Gallery feed, where the whole community’s work is ranked together and sortable by views, tips, and hearts. You can also mint any creation as an NFT and sell it on the marketplace (see Collectibles & NFTs).

To create, you need the account you already made and the web studio. That is it. No application, no payout forms, no minimums. This guide takes you from a fresh account to money landing in your wallet.

The arc is the same for everyone: verify once, create in the Studio, publish or protect what you make, optionally promote it, then earn and save. Here is the whole journey at a glance before the step-by-step.

1. Activate and open the Studio

Finish both verifications (Getting Started), then open the web studio at /studio (XENIA Studio). Creating requires an activated account. There is nothing to download and nothing to install.

2. Create

Upload a source photo, direct the result, and press Generate. Each render is pay-per-render: you approve a real Solana payment in SOL or USDC, $0.08 for an image and $0.75 for an animation, and the redraw runs on XENIA’s cloud GPUs the instant it verifies. The original photo is never stored. Every finished creation lands in your private review gallery, where nobody but you can see it until you decide otherwise.

From there you can push a creation further with a paid edit: add an effect, add a person with fine control, or enhance, each its own ~$0.08 render. You can animate any still into a loop, and you can mint a creation as an NFT to your own wallet (see Collectibles & NFTs).

3. Publish

• Public images appear on your profile and in the Gallery feed. They earn views and tips.
• Protected images appear everywhere as an irreversible blur with your unlock price. They earn views, tips, and unlock revenue. A protected image requires a price above zero, in USDC.
• Captions, prices, and visibility are editable at any time, and you can delete any image permanently.

4. Set up your External DM unlock

Under Dashboard > Messages, add any of Telegram, Discord, Keybase, SMS, or email, and set one reveal price. Handles are stored encrypted and revealed only to paying fans. This is for talking off platform. In-app Messages are end-to-end encrypted and free between verified adults. Details in External DM Unlock.

5. Share your page

Your profile lives at username.xenia.studio. It carries your avatar, bio, follow button, DM unlock card, and your grid. Link it anywhere. Viewers need no account to look, only to pay or follow.

6. Promote a post (optional)

For more reach, hit Promote on any published post in the Content tab and pay a flat fee in SOL or USDC: Standard ($10) or Premium ($30). The payment settles on chain to the platform, and the post jumps to the top of the feed and shows up more in search and suggestions for 30 days. Premium boosts harder. A promotion decays as it ages and drops back to organic ranking at the end of its run. See all your promotions, active and expired, in the Promotions tab, where you can re-promote one that has lapsed.

7. Build your community

Every image and animation has a comment thread. Any signed-in, verified member can join in, react with the XENIA emoji set, and like the comments they like. Likes float the best replies to the top of the stack, and comments feed the same rank score, so a busy thread pushes a post up the feed.

You stay in control of your space. Delete any comment on your own media, delete your own comments anywhere, and block anyone you would rather not have around. A blocked person can no longer comment on your work, heart it, like your comments, follow you, or unlock your DMs, and their comments drop off your posts. Lift a block at any time.

How the money works

• 93% of every payment (tips, image unlocks, DM reveals) arrives in your wallet in the same on-chain instruction the fan signs. There is no payout schedule because there is no payout: the money never stops anywhere else.
• Dashboard > Earnings lists every tip and unlock with its payer context. Dashboard > Wallet shows the complete on-chain history with CSV export.
• Fans pay in SOL or USDC; your prices are set in USDC and displayed in both.
• You never fund anything to start earning. A fresh wallet with a zero balance collects tips and unlocks from day one; depositing or buying crypto is only ever for spending.
• NFTs are another way to earn. Mint a creation as a collectible and sell it on the marketplace, or sell any NFT you own. You keep 93% of every sale, and minting costs only the Solana network fee. See Collectibles & NFTs.
• Generating costs are separate from earnings. The pay-per-render charge in the Studio (a generation, an animation, or a paid edit) is a separate per-render payment, not the 93/7 split. The 93/7 split applies to the tips and unlocks a published creation earns. See XENIA Studio.

Dashboard map

Your dashboard is where you run your account on XENIA. Sign in and the Overview opens first, a single snapshot of every interaction your account has had.

The map below lays out every surface at once: the Overview you land on, and the dedicated tabs that run each part of your account.

What the Overview shows

• Wallet balances. Your live SOL, USDC, gold (PAXG), and jitoSOL, read straight from the chain, with a total in USD. See Wallet for how funds move.
• Earnings and spend. Everything you have earned, split by source (tips, image unlocks, DM unlocks, collectible sales), and everything you have spent, with a 30-day earnings trend.
• Your content library. A breakdown of how many posts are public, locked, private, or DM-only, how many are videos, and how many are for sale.
• Renders. How many Studio renders you have made, image versus animation, and what you have spent creating them.
• Engagement and reach. Total views, hearts, and comments. Your follower and following counts. Your reputation score, which is the same signal that lifts you in the feed (see Ranking).
• Messages, collectibles, promotions, and circle. Your DM volume, listed and sold collectibles, promotion status, and the people in your circle, all in one place.
• Top posts. Your best work, ranked by how much it has earned.

The rest of the dashboard

Beyond the Overview, dedicated tabs run each part of your account: Wallet, Messages, Following (a feed of the creators you follow), Circle (manage your circle and co-scenes), Content and its visibility and prices, Market (collectibles and your promotions), Earnings, External DM pricing, and Settings.

Settings holds your account security, your two-factor authentication and passkeys, the verified sign-in email, your wallet backup, the option to replace an empty wallet with a fresh one, and account deletion. Your display name, bio, avatar, and borders are edited on the live profile itself at username.xenia.studio; your seven featured pieces are pinned from the Content tab, and your circle is managed from the Circle tab.

Your XENIA wallet is a real Solana wallet, created in your browser the moment you sign up. There is no app to install and no third-party wallet to connect. The keypair lives on your device, wrapped by your passkey, and the server only ever learns the public address. If our whole database leaked tomorrow, nobody could spend a cent of your funds.

The wallet is where your income and your savings live, and you are the only one who can touch them. You hold the keys. Fans pay you directly. You spend, swap, save in gold, and earn yield without a bank, a broker, or a custodian sitting between you and your money. That is the point of building it non-custodial: your livelihood stays yours.

Four assets, one wallet

Your wallet holds four assets, two to spend and two to grow. SOL and USDC are the money you pay and get paid in. Gold (PAXG) and jitoSOL are the Vault, where you save in real gold and earn staking yield without leaving the app. All four are real tokens you hold yourself, and any one swaps to any other in a tap. The prices below are live.

SOLNative · spend

$150.00per SOL

Solana's own coin, the network XENIA runs on.

Pays the tiny fee on every transaction, and you can tip, unlock, and get paid in it. Moves in under a second for a fraction of a cent.

USDCStable · spend

$1.00always ~$1

A digital dollar that always sits at about $1.

No price swings, so it is the steady way to get paid, price your work, and hold cash. Every price on XENIA is set in USDC.

Gold (PAXG)Save · gold

$4,078.00per ounce

PAX Gold. One token is one ounce of real vaulted gold.

Tap Save to turn SOL or USDC into gold and hold value over time. It sits in your own wallet, and you swap it back to dollars whenever you want.

jitoSOLEarn · staking

$92.00per jitoSOL

Liquid-staked SOL that quietly earns yield.

Tap Earn and your SOL stakes into jitoSOL, accruing staking and MEV rewards. No lockup, and it stays tradable, so you unstake to SOL anytime.

5.50% APY

In the wallet the four read as a single balance. The Total value view draws each asset as a tile sized by its share, so you see your whole position as one picture instead of a column of numbers.

38%

0.25 PAXG

$1,019.50

4.20 SOL23%

$630.00

6.00 jitoSOL21%

$552.00

480.00 USDC18%

$480.00

Money moves through the wallet in one loop. What you earn lands as SOL or USDC. From there a tap swaps any asset to any other, so the same balance can sit in gold, or earn yield as jitoSOL, then come back to dollars when you want it.

People who value your work

tips, unlocks, and sales, in SOL or USDC

Your wallet

SOLUSDC

the money you spend and get paid in

one-tap swap, any asset to any asset

Spend

Tip creators, unlock posts, and pay per render.

Earn · Staking

Stake into jitoSOL for yield, with no lockup.

Save · Gold

Hold value in real vaulted gold (PAXG).

How the wallet is created

The key that wraps your wallet comes from the WebAuthn PRF extension, tied to your device's hardware authenticator (browsers without PRF fall back to an HKDF derivation from the passkey credential id). The encrypted blob sits in the browser's IndexedDB, every signature takes a passkey unlock, and key material is zeroed from memory after each use. The 24-word phrase is BIP39, the portable form of the same wallet.

The server never sees the seed, the phrase, or the private key, at signup or after. The one thing XENIA stores is your public wallet address, which is public by nature and cannot be used to spend. It links your earnings to your account and drives your wallet view.

Replace an empty wallet

If your recovery phrase leaked, or you want a clean key, generate a new wallet from Settings and point the account at it. This works only while the current wallet is empty (no SOL, USDC, gold, or jitoSOL), so a rotation can never strand funds. The new wallet proves control with a signature, you see its fresh 24-word phrase once to save, and the old wallet stays put on chain.

Supported assets

Asset	Role	Details
SOL	Payment	Solana's native coin, used for payments and the small network fee on every transaction.MintSo11111111111111111111111111111111111111112(wrapped SOL, 9 decimals)
USDC	Payment	A digital dollar that always sits near a dollar, the steady way to price your work and get paid.MintEPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v(6 decimals)
PAX Gold	Savings	A Token-2022 from Paxos where one token is one troy ounce of vaulted London Good Delivery gold, your gold savings asset.Mint5GgRAEmv8ZxF2PR5hY72Qs5x1bnQ6UK2RbTPoqJ3wSwW(Token-2022, 6 decimals)
jitoSOL	Savings	Jito's liquid-staking token, SOL that earns staking plus MEV yield while staying tradable, your earn asset.MintJ1toso1uCk3RLmjorhTtrVwY9HJ7X8V9yYac6Y7kGCPn(9 decimals)

SOL and USDC are the payment assets: you spend, send, and receive in them. Gold (PAXG) and jitoSOL are savings assets: you hold and grow them in the Vault and swap them back when you want, but you do not pay other people in them. Any other token sent to the address is ignored across the product. Prices show in both currencies, $X USDC (≈ Y SOL), off a server-side quote cached for 60 seconds.

Buy SOL or USDC

Fund your wallet with a card or bank from inside XENIA. No exchange account needed. Open Dashboard › Wallet › Buy, pick SOL or USDC, and choose a provider (MoonPay or Transak). The provider opens prefilled with your address and the asset you picked, so the crypto lands in your XENIA wallet the moment the purchase clears. Pay by card, Apple or Google Pay, or bank transfer where the provider supports it. That provider runs its own identity check and is who you actually buy from. XENIA never touches the funds.

Receive by QR code or address

Already hold crypto somewhere else? Send it in. Tap Receive and your address shows two ways:

1. Scan the QR code. In your other wallet or exchange, choose send and scan the QR on screen. It fills in your XENIA address, so no typing and no paste error.
2. Copy the address. Tap Copy address and paste it as the destination in the sending app.

Send SOL, USDC, gold (PAXG), or jitoSOL on the Solana network only. No minimum and no processing step on our end. The funds are yours the moment the transaction lands, usually within seconds. Other tokens, or transfers on a different network, are not supported and could be lost.

Send

The wallet sends all four assets (SOL, USDC, gold, and jitoSOL) to any Solana address. Each send is built in the browser, confirmed with a passkey unlock, signed locally, and submitted to the chain. A withdrawal is a send to wherever you want the funds.

No fee, ever, on your own money. XENIA takes nothing on a deposit, a send, or a withdrawal. Moving your own funds in or out costs only the small Solana network fee, so you keep 100%. The 7% platform share applies to tips, image unlocks, and External DM unlocks (see Tips & Unlocks) and to NFT trades, never to your own balance. A full withdrawal drains to zero and reclaims even the small rent on a USDC token account, so no dust is left behind.

Swap any asset

The wallet swaps any of your assets for any other, SOL, USDC, gold (PAXG), and jitoSOL, in place, routed through the Jupiter aggregator for the best rate it can find. Pick what you pay and what you receive on either side. All four show on both, so you never flip the swap to reach a token. The panel opens on the live rate and the quote updates as you type, showing the price impact and the guaranteed minimum you receive before you commit. Confirm, and the swap signs with your passkey and settles on Solana for a small network fee in SOL. Slippage is capped at 0.5%, so a moving market cannot fill at a materially worse price than quoted. A swap trades your own assets inside your own wallet, and XENIA takes no cut.

250 USDC→0.0613 PAXG

A worked example at the live gold price ($4,078.00 an ounce): any asset swaps straight to any other in one tap, routed for the best rate. Save and Earn are just this swap, preset to buy gold or stake SOL.

Save in gold

Save holds real gold. It converts any amount of USDC or SOL into PAX Gold (PAXG) at the live price, where one PAXG is one troy ounce of London Good Delivery gold held in audited Paxos vaults. Your holding shows by the ounce and in dollars, and you can swap it back to USDC anytime. The conversion routes through Jupiter and signs with your passkey, so the gold sits in your own wallet, never with XENIA. It is a way to park value in gold without leaving the app or opening a brokerage account.

Earn by staking

Idle SOL can work for you. Earning stakes your SOL into jitoSOL, Jito's liquid-staking token, which accrues Solana staking rewards plus MEV yield and rises in value against SOL over time. There is no lockup: unstake back to SOL whenever you like. The live APY is shown from Jito's own published feed, the stake and unstake route through Jupiter, and both are signed with your passkey and held by your wallet. Like gold, jitoSOL is a savings asset you can swap back to SOL at any time.

History and CSV export

The History view reads the full on-chain history of your address and sorts every transaction into a labelled row: deposits and sends (received / sent), plus the XENIA money events it can attribute, payments you made (a tip you sent, a post or DM you unlocked) and earnings you received (a tip or unlock from a buyer). Each row shows the token and amount moved, the USD value and counterparty where XENIA knows them, and a link to the transaction on the Solana explorer. Those labels come from merging the raw chain transactions with your platform money events from /api/me/activity. The list paginates and exports to CSV for bookkeeping. Your earnings are also collected on their own under Dashboard > Earnings with full payer context.

Collectibles

The wallet also holds your collectibles: every Solana NFT your address owns, read live from the chain and shown as a grid in its own tab next to your token balances. From any collectible you own you can list it for sale on the marketplace or send it to any address, right from the portfolio. The same collection shows on your public profile. See Collectibles & NFTs for the portfolio, the showcase, and the marketplace.

Moving to a new device

Your encrypted seed blob also syncs to a passkey-encrypted server vault, so your wallet follows you to your other browsers with nothing to retype. Only the PRF-encrypted form is ever uploaded. Its wrapping key comes from your passkey and is never stored, so the server holds pure ciphertext and the wallet stays non-custodial. On a fresh browser, the vault is pulled down and your passkey unlocks it on the spot.

Where the synced passkey is not available, choose restore in the Backup tab and enter your 24-word phrase. The wallet is re-derived, wrapped under a fresh passkey on that device, and stored in its IndexedDB. The phrase itself never leaves your browser.

Collectibles are Solana NFTs your wallet holds. Your images and animations already earn tips and unlocks on their own, with no token involved. Separately, any NFT in your wallet gathers into a collectibles portfolio you can keep, showcase, send, or sell. That covers ones you minted from your own creations, ones you bought on the XENIA marketplace, and ones you picked up elsewhere on Solana. Collectibles are non-custodial like everything else on XENIA. The token lives in your wallet, not in a platform account, and only you can move it. Sell one on the marketplace and you keep 93%, the same split as tips and unlocks.

Minting your creations

Once a creation is published public, you can mint it into a Solana NFT from the Content manager. Your passkey wallet signs the mint and the token lands straight in your wallet. You pay the Solana network rent, around 0.01 SOL, and nothing to XENIA: there is no mint fee. The NFT carries the rebuilt anime image and a 7% royalty on any future marketplace sale. Minting needs a public creation, since an NFT image is world viewable.

Where a collectible came from

Every collectible reads as a standard Solana NFT in any wallet or explorer that speaks the Solana Digital Asset Standard. In your portfolio each one is tagged by origin: a Minted chip for a piece the creator made, or a Collected chip for one they bought from someone else. The portfolio reads live from the chain, so a collectible shows up the moment it is indexed.

Your collectibles portfolio

Your wallet carries a collectibles portfolio: every Solana NFT the wallet holds, read live from the chain. Open Dashboard › Wallet and the Collectibles tab to see the full set as a grid, each token with its art and name. Your SOL, USDC, gold, and jitoSOL balances sit in the wallet itself, and the portfolio is the collectibles view next to them. From any collectible you own you can list it for sale on the marketplace or send it out to any address.

Sending a collectible out

A collectible is yours to move. From the Collectibles view, choose Send on any piece, enter a destination Solana address, and your passkey signs an on-chain transfer of the token out of your wallet. A send carries no platform fee. It is a withdrawal of your own asset, not a sale, so it never touches the marketplace program. The transfer is final once it confirms, so XENIA validates the destination address before you sign. The piece leaves your portfolio and your profile showcase when the transfer finalizes.

Your collection showcase

Your public profile at username.xenia.studio carries a collection showcase: the collectibles your wallet holds, on display for any visitor to browse. It draws from the same on-chain portfolio, so it stays current as you buy or sell. Visitors get a read-only view. When your wallet holds nothing the showcase hides itself, so an empty collection never leaves a gap on your page.

The marketplace

XENIA runs an on-chain NFT marketplace through a second Anchor program, xenia-market, alongside xenia-pay. You can sell any NFT you own there, wherever it came from. Listing, buying, and cancelling are plain Solana transactions, built in your browser and signed by your passkey wallet.

A trade is enforced the same way a tip is. The program reads the platform commission wallet from its on-chain Config, never from a client constant, so a buyer can never be redirected to a different address. A canonical reference binds the buyer to the sale. The server records the sale only after it re-reads the on-chain event and confirms the seller was credited the net. One transaction settles at most one sale.

xenia:buy:{mint}:{buyerUserId}:{nonce}

Listings in the Gallery

Active marketplace listings surface in Gallery as a separate band above the ranked feed, so collectibles for sale sit next to the rest of the community's work. Each entry links to its listing and shows the art, the seller, and the price in both currencies. With no active listings the band hides itself, and the feed reads as usual.

Creators get paid two ways on XENIA: tips and unlocks. Each is a plain Solana transaction, built in your browser and signed by your passkey wallet, that routes through one on-chain program (xenia-pay) and drops 93% straight into the creator's wallet the instant you sign. No balance to top up, no payout to wait on.

One payment

A tip or unlock, paid in

SOLUSDC

splits atomically on chain

93%to the creator

7%

Nearly all of it is the creator's: 93% lands straight in their own wallet in the same instruction the viewer signs. The other 7% is the platform fee, capped in the xenia-pay program so it can never quietly climb.

The 7% that stays behind is the only cut XENIA takes on what a creator earns, and it is fixed in the contract so it cannot creep upward. It is the same on every earning action: tips, image unlocks, and External DM unlocks, in SOL or USDC, plus NFT mints and trades through the xenia-market program. Two things sit outside it. A paid promotion is a flat fee you choose to pay to boost a post, not a slice of your income. And moving your own money, whether you deposit, send, or withdraw, is never touched: those transfers cost only the tiny Solana network fee, so you keep all of it. See the Wallet for that.

Tips

• Free amount, in SOL or USDC, on any public or protected image, or to a profile directly. You can tip a profile on its username.xenia.studio subdomain, or gift a tip inside an encrypted message.
• Tips are the main ranking signal on the Gallery feed. Every dollar tipped moves the image up, and tips also feed the profile rating that lifts a page in the feeds.
• Tips accumulate on the image and in the creator's earnings view, each one tagged with the tipper's context.

Unlocks

• Image unlocks buy permanent access to a protected image at the creator's set price (in USDC). Before you unlock it, all you see is the irreversible blur preview.
• External DM unlocks buy permanent access to a creator's off-platform contact handles. See External DM Unlock. (In-app encrypted Messages are free between verified adults.)
• An unlock never expires, and it survives price changes. Once you own it, you own it.

Splitting a co-authored unlock

Some protected pieces are co-authored: a co-scene rendered with one or two of your circle members. When a fan unlocks one, the proceeds split evenly between every author, 50/50 for two authors and 33/33/33 for three. It is still a single Solana transaction: the 7% platform fee comes off first, the rest divides equally, and any one-unit rounding dust goes to the first author. The split works in SOL or USDC, the same as any other unlock.

Nothing is held in escrow. The one transaction moves each author's share straight to their wallet in the same instruction, so every co-author is paid the instant the buyer signs. The split is enforced on chain by the xenia-pay program (the pay_sol_split and pay_spl_split instructions), which the server re-verifies from the finalized transaction before the unlock lands. It settles trustlessly on chain, with no platform balance in the middle.

How a payment settles

1. The browser builds a transaction invoking the xenia-pay program with the creator's wallet, the amount, and a 32-byte ref_id that ties the payment to this exact intent.
2. Your passkey unlocks the wallet key for one signature and the transaction goes to the chain. The program transfers 93% to the creator and 7% to the platform wallet in the same instruction.
3. The client then calls POST /api/pay/confirm with the transaction signature.
4. The server fetches the transaction at finalized commitment, so no fork or reorg can drop a payment an entitlement was granted for. It confirms the transaction invoked xenia-pay and decodes the PaymentEvent the program emitted while it was the executing program, never a look-alike log line. It checks payer, creator, mint, amount, and ref_id, verifies on chain that the creator's balance rose by the net amount, and records each transaction signature at most once. The tip or unlock lands and the entitlement goes live.

The ref_id is the SHA-256 of a canonical intent string, so a confirmed transaction matches exactly one cart intent and can never be replayed into a different entitlement:

xenia:tip:image:{id}:{userId}:{nonce}
xenia:unlock:image:{id}:{userId}

Paying in SOL vs USDC

• USDC: you pay exactly the listed price (price × 10^6 base units). What you see is what is transferred.
• SOL: the client converts the USDC price to lamports at the quoted rate. The server accepts the payment if the on-chain amount comes to at least 98% of the USDC price at confirmation time. That 2% tolerance covers normal price drift between quote and confirmation. A real payer never gets bounced over a basis-point move, and a stale quote is too small a gap to game.

Prices everywhere display in both currencies, $X USDC (≈ Y SOL), and you choose the currency at payment time.

Messages are end-to-end encrypted direct messages between two verified adults. This is where the flirting happens, and XENIA holds no key to what you send.

Encrypted at rest, openable only by your wallet

A message is sealed in your browser before it leaves your device, using a key derived from your wallet. It stays encrypted at rest and only decrypts in your browser when you open it, which takes your wallet key and a live session. The XENIA server stores the ciphertext and routes it. It never holds a key and never reads a message.

• Sealed in your browser. Each message is encrypted on the sender's device and addressed to the recipient's wallet, so plaintext exists only on the two devices in the conversation.
• Decrypted only when you open it. Content unseals on demand in your browser, never on the server and never in a stored form the server could read.
• Opened only by your wallet. The decryption key comes from your wallet and works only while you are logged in. A database dump, a backup, or a XENIA operator sees ciphertext and nothing else.

Richly composable

A message is more than text. You can style what you write and attach XENIA images and animations, the same renders the filter builds in XENIA Studio. An inline attachment is one of your own renders, so a thread carries the same protected, never-identifiable look as the rest of the platform.

Tipping a profile

A tip puts money behind the compliment. Tip a profile directly on its username.xenia.studio subdomain, or gift a tip inside a message. Either way it settles wallet to wallet on Solana in SOL or USDC, through the same xenia-pay program that drops 93% straight into the creator's wallet in one atomic instruction, keeping a 7% fee. See Tips & Unlocks for how a payment settles.

The profile rating

Every profile carries a rating built from the views, comments, hearts, and tips it earns, the same signals that rank individual images. A higher rating pushes the profile higher in the feeds. See Ranking for how the score is built and how it orders the Gallery.

Rating requests

Fishing for a compliment is easier with a template. Messages include a 1-to-10 hotness rating you can send to anyone. The other person fires back a single number, plus a comment if they feel like it, and it never has to become a whole conversation.

Who can message whom

• Both people are verified adults (18+). Messages are part of the social network, not a public inbox open to anyone.
• Blocking applies here too. A blocked person cannot message you, tip you, or open a thread with you.
• Plaintext lives only on the two devices in a conversation. Lose access to your wallet and past messages stay sealed. Nobody, XENIA included, can recover them for you.

XENIA has its own encrypted in-app chat (see Messages). The External DM unlock is a different thing. One on-chain payment unlocks a creator's off-platform contact handles, so the conversation can continue wherever the creator wants it, away from XENIA.

Pay the unlock and the creator's outside handles appear on their profile for your account. The conversation picks up wherever they want to talk.

Supported services

For creators

• Configure any subset of the five services and one unlock price (in USDC) under Dashboard > External DM.
• Handles are encrypted at rest with the same AES-256-GCM envelope used for images. They are decrypted only for you and for buyers who have paid.
• Change handles or the price whenever you want. Existing buyers keep access. They bought your External DM unlock, not a snapshot of the handles you had that day.

For buyers

• Every creator profile with an External DM unlock configured shows an unlock card with the price.
• One payment reveals all the services the creator has configured, permanently. There is no per-service pricing and no renewal.
• Once you unlock, the handles render on the creator's profile for your account, and the reveal joins the rest of your entitlements.

The payment path

An External DM unlock is a normal xenia-pay payment. It drops 93% into the creator's wallet in one atomic instruction, with the 7% remainder going to the platform. The transaction's ref_id is the SHA-256 of the canonical intent string:

xenia:unlock:dm:{creatorId}:{userId}

The server confirms the transaction on chain and records the unlock. After that it serves the decrypted handles to your session.

The Gallery is one ranked stream of every creator's public and protected images. The order tracks what fans pay for and pay attention to. Two things ride above that order: a creator's own paid promotion and a featured account. Both are labeled placements that decay over time and expire. A moderator can also add a small boost to a single image. That boost is not a separate layer. It adds into the score below.

The rank score

Every image carries a score from four counters plus a moderator term:

base = tip_total_usd * 100 + comments * 20 + hearts * 10 + views + admin_boost

The weights stack up like a ladder. One tipped dollar moves an image as far as a hundred views. A comment counts for twenty views, a heart for ten. The model below sizes each factor by its weight, so you can see what actually lifts a post.

Because tips dominate, the default order surfaces what people pay for and talk about first, with hearts and then views breaking ties. On top of the base, each image gets a small logarithmic lift from its creator's profile rating (below), so a page fans love carries all of its work up a bit. XENIA computes the whole score in the query at read time. No batch job, no decay on the counters. The admin_boost term is a moderator adjustment on a single image, and it sits at zero for almost everything.

The profile rating

Each profile carries its own rating, from the same signals across all of a creator's public and protected work: views, comments, and hearts on those images, weighted the same way, plus every tip the creator has earned, counted at a hundredfold. That includes tips sent to the profile on its subdomain or gifted in an encrypted message. A higher-rated profile lifts all of its images in the Gallery, so a page that pulls attention earns more reach. The rating only moves on verified on-chain activity. You earn it. You can't buy it.

Sort tabs

How views are counted

• A public image counts a view when any clear variant is fetched: its grid thumbnail, display, or full copy.
• A protected image counts a view when its blur preview is fetched, so locked content competes on attention too.
• Views are deduplicated per image, per viewer, per day. Refreshing a page all afternoon counts once.
• Private images are never served to anyone but the owner and accumulate nothing.

What this means for creators

• Tips move the needle most. One tip from one fan beats thousands of passive views, and tip totals come from confirmed on-chain transactions, so nobody can edit them.
• Protected images rank next to public ones. A strong blur preview earns views, and every unlock and tip it pulls in feeds the same score.
• Comments count for two hearts each, so a post people talk about climbs faster than one that only gets likes. Replying keeps the thread alive on the feed.
• The feed tracks what each image has earned, not who you are. A new creator competes on the same terms as an established one.

Your circle is the relationship layer on XENIA. You decide who sits closest, and nobody joins until they consent. It fits anyone exploring polyamory in a mixed, open way, and it lives on your username.xenia.studio page.

Seven seats

Every page has the same shape. One twin flame sits in the top seat, your closest, your significant other. Below it sit up to six ranked seats, numbered 1 to 6 with 1 the closest. The twin flame holds one person. You can't suggest that seat when you reach out, but the person you invite can take it themselves when they accept. Seats you haven't filled show as dim engraved seals, so an empty circle still reads as an open invitation.

Sealed by a wallet signature

A coupling takes mutual consent. Tap an empty seat on your page, search the username you want, and they get a request. They approve it by signing with their own wallet, the same passkey signature that authorizes everything else on XENIA. No money moves and nothing is escrowed. The signature proves consent, nothing more.

• You ask, they choose. Suggest one of the six ranked seats or leave it open. The recipient picks their own seat when they approve, anywhere from seat 6 up to the twin flame. How close they sit is their call.
• Approval is a signature. Until they sign, it's only a pending request. Nobody lands in a circle without their wallet's explicit approval.
• Exit anytime, no notice. Either person can leave a coupling from the dashboard Circle tab. No lock-in, and the other side gets no notification.

Effects

Give each member and your twin flame a small living effect: a glow or flicker, fire, ice, a rotating spectrum, dark or light, angel or demon, hearts, eyes, bubbles, rain, stars, and more. It marks how you feel about each bond. Only you can set the effect on a seat in your own circle.

Circle-only drops

Alongside public and paid posts, you can publish a drop only your active circle sees. It's relationship-gated, not paywalled. Your circle gets it on your page and in their feed, and nobody outside the circle ever receives it. Choose Circle as the visibility when you publish from your Content.

Co-scenes

Your circle doubles as a creative consent layer. When you send or accept a request, you can tick a co-scene agreement. The agreement is two-way and per person: it lets either of you render the other into a scene together, from the verified likeness already on each account. It drops the moment either of you leaves the circle, and your likeness never appears in a scene you have not agreed to.

From the dashboard Circle tab you set up a co-scene. Pick a curated scene preset and one or two of your circle members as co-stars, so two or three of you appear together, then pay once to generate. That render is an on-chain SOL or USDC payment in your passkey wallet, the same pay-per-render model as every other Studio generation. The scene builds on the Studio's add-a-person (MMF / FFM) placement, but the added people are real circle members rendered in per their own verified likeness, not invented partners.

The result is a co-authored image. Every co-author is credited, and it surfaces on each of their profiles, not only the person who generated it. The casting picker shows only members who can be cast: those who have ticked the co-scene agreement with you and have a verified face (Yoti likeness) on file. There is no free-text scene prompt, so anything depicted comes from the curated library and was opted into by everyone in it.

Your likeness profile

Every creator has a likeness profile that lets a scene render them as themselves. Two parts make it up. The identity anchor is your Yoti-verified face, the same face that gates everything else on XENIA. Alongside it sits a body descriptor: your build, skin, hair, and anatomy. A face crop cannot carry a body, so the descriptor is what tells the render the rest of you, not a stand-in.

It takes no effort to keep. The profile is seeded from your own renders, read from the work you already make in the Studio, and you can adjust any field from the dashboard. A co-scene never asks you to fill anything in. The descriptor is simply there when a circle member casts you.

When you are cast in a co-scene, your face (whenever you are face-forward) and your body descriptor place you as yourself rather than a generic body. The creator who starts the scene is the point-of-view anchor, so a scene reads as the cast members seen together, their faces, not a crowd of faces.

Circle-only by default, public by unanimous consent

A co-authored piece is circle-only by default. Once published it reaches only the shared circle, the same circle-only drop tier described above, and never the public Gallery feed. Because every person in it is rendered from their real likeness, no single co-author can take it public alone.

To take a piece public (free) or protected (a paid unlock), one co-author opens a release request from their Content. Every other co-author gets an email and an in-app notification, opens it, reviews the piece, and either approves by signing with their passkey or rejects it. The signature is the approval, the same passkey-backed wallet signature that seals a circle bond.

• Unanimous to release. The piece flips to public or protected only once every co-author has approved.
• One rejection keeps it circle-only. Any single co-author declining cancels the whole request, and the piece stays a circle drop.
• The owner can cancel. While a request is still pending, the co-author who opened it can withdraw it.

Make it mutual

Circles can be one-sided. Someone adds you without you adding them back. In the Circles you're in list, anyone you have not added yourself shows an Add back button. Making a bond mutual is what unlocks co-scenes and circle drops in both directions.

Where it lives

• On every profile. The full seat scaffold is built into each username.xenia.studio page, members and placeholders alike.
• In your dashboard. The Circle tab is where you send requests, approve or decline the ones addressed to you, set effects, and leave couplings.
• As a notification. When someone requests you, a toast fires right away, same as a new message or tip.

XENIA is an adults-only platform. You need an account before you can post, publish, follow, tip, or unlock, and getting one requires full government ID verification through Yoti, the same vendor major adult platforms rely on. ID verification proves two things: that you are a real adult over 18, and that the person is really you. Browsing public content needs no account and no verification.

The two ID routes

What is stored, and what is not

• Stored: the verification receipt (the provider session id and a redacted result), the method used, a verified at timestamp, the verified face reference (encrypted, see below), and a one-way identity hash derived from the document (so each verified person gets one account and a banned account cannot re-register). The verification is also bound to the wallet that started it.
• Never stored on XENIA servers: raw ID document images, the document number, and the documents themselves. They stay with Yoti under Yoti's retention policy; XENIA keeps only the one-way hash, not the underlying number or name.
• Never shown publicly: your legal name, address, ID, or face. They are used for verification and records only, never for your profile, ranking, or advertising.

The verified face reference

Your face reference is the live face Yoti matched to your government ID during verification, a real likeness tied to your real identity. Verification has to return it. If it cannot, sign-up does not complete, so there is never a separate selfie to capture. It is stored as an encrypted blob, bound at rest to your account, and is never served publicly or used for ranking, advertising, or anything else. It stays server-side as the private likeness reference your renders are built around, so your work carries your verified face and no one else's. You cannot swap it, and it stays tied to the 18+ verification that produced it.

Verification states

Each attempt is tracked from start to decision. If a method is temporarily unavailable (say, the provider is not reachable), the UI says so and the other routes stay open. A failed attempt never locks the account. You can retry or switch methods at any time. Once it passes, verification does not expire.

XENIA's promise: be seen, not identified. The content is real, but it never shows the creator's actual face. The augmentation / fantasy filter rebuilds each photo as anime in XENIA Studio, and nothing identifying is kept.

The filter boundary

You start the redraw in the Studio from your browser, and it runs on XENIA's cloud GPUs. Your source photo goes up only to be redrawn, and it is never stored. Once the render is built, the rebuilt image is all that exists, tied to your verified account, and it is the only thing that enters your content. No unfiltered original lives anywhere on XENIA, so your real face never appears in what you publish.

Visibility states

Every render lands as private. From the dashboard you set, per image, what the world sees:

Visibility, price, and caption can be changed at any time, and deleting an image hard-deletes its stored blobs.

What viewers actually receive

The server derives fixed variants from each render and serves them according to the access decision:

Why the blur is irreversible

The protected preview is not a blurred copy of the full image. We resize the image down to 24 pixels wide, blur it hard, then scale it back up. The downsample throws away the detail before the preview exists. No sharpening, AI upscaling, or deblurring gets it back. Serving the blur leaks nothing.

Encrypted at rest

Every stored variant, including private images and face references, is encrypted with AES-256-GCM envelope encryption before it touches the database. Decryption happens only inside the image-serving route, after the access check passes. The full scheme is in Security & Encryption.

We assume the worst. Creator content is the most sensitive thing we hold, so we built XENIA so a database dump, a stolen backup, or raw filesystem access turns up nothing readable. A full server compromise moves zero funds.

Envelope encryption for every blob

Every stored image variant, face reference, and DM handle is encrypted with AES-256-GCM envelope encryption before it reaches PostgreSQL. The steps:

1. Each blob gets its own random 32-byte data encryption key (DEK) and 12-byte IV; the ciphertext is stored with the GCM tag appended.
2. The DEK is wrapped (again AES-256-GCM) by the master key, which lives only in the environment, never in the database.
3. The GCM additional authenticated data binds the blob id and kind, so a ciphertext cannot be detached and re-attached to a different row.
4. Key rotation re-wraps DEKs under a new master key; the data itself never needs re-encryption.

Decryption happens in one place: inside the image-serving route, after the access check passes. There are no direct object URLs and no static file paths to guess.

The blur destroys detail, it does not hide it

A protected preview is a 24-pixel downsample, blurred and upscaled. The detail is gone before the preview exists, which is why we serve the blur publicly. There is nothing left to recover.

Nothing secret is stored in plaintext

Transport authentication

• Logins are single-use Ed25519 signature challenges with a 5-minute TTL. There are no passwords to phish or leak.
• Studio renders are paid per generation with a real Solana transaction the browser builds and your passkey wallet signs. The render starts once the server confirms that payment on chain. See XENIA Studio.
• Sessions are httpOnly, SameSite cookies (Secure outside localhost) backed by hashed server-side records with sliding expiry. State-changing routes require a CSRF double-submit header and an Origin check in middleware.
• Rate limits apply per IP, and per account on the sensitive auth routes, answering 429 with a retry-after.

Upload hardening

• File types are sniffed by magic bytes (JPEG, PNG, WebP only); extensions are never trusted.
• Pixel-bomb guards cap the total decoded pixel count and reject truncated or multi-frame inputs; image files cap at 25 MB.
• The server computes a sha256 of the body; identical bytes deduplicate to the image already on file.

Browser security headers

• A strict Content-Security-Policy: default-src 'self', with connect-src opened only to the Solana RPC endpoint (HTTPS plus its WebSocket for transaction confirmation) and frame-src opened only to the Yoti age-verification widget. There are no third-party scripts, trackers, or analytics embeds anywhere.
• frame-ancestors 'none' plus X-Frame-Options: DENY on every route, so no XENIA page can be embedded in a hostile frame. base-uri 'none' and object-src 'none' close the remaining injection sinks.
• Referrer-Policy: strict-origin-when-cross-origin, X-Content-Type-Options: nosniff, and a Permissions-Policy that grants only the camera (to the site itself and the Yoti verification widget, for face capture) while denying microphone and geolocation, all across the board.

Payments

The server records a payment only after it re-reads the confirmed transaction from the chain, decodes the program event, and matches the ref_id intent hash. Transaction signatures are unique keys, so the same transaction can never be credited twice, and one buyer's transaction can never be replayed into another account's entitlement. Details in The Smart Contract.

Content safety: zero tolerance

Safety runs inside XENIA Studio on every render. The gate reads each one with two independent signals, the scene and a conservative face-age check, and hard-rejects anyone who looks under 18, any animal or bestiality, and abusive or non-consensual scenes. It checks the finished render again. The gate fails closed: anything uncertain is blocked, so prohibited content is never produced or kept. The same categories are banned everywhere on XENIA. A confirmed violation is an immediate permanent ban and removal of the account's content. We report child sexual abuse material to NCMEC and law enforcement and preserve the evidence, as the law requires. Identity signals are captured at age verification, so a banned person cannot open a fresh account and walk back in.

XENIA settles on two open Anchor programs on Solana, and nothing else. Each does one job with checked math and no custody: money passes through a single instruction and never rests with the program. Both are open source in the repository; the program addresses publish at mainnet launch.

How to audit them

Nothing here asks for trust. Anyone can confirm the programs do exactly what these docs say, in five steps:

xenia-pay, in depth

Tips, unlocks, External DM unlocks, and promotions all flow through one on-chain program: xenia-pay, an Anchor program on Solana mainnet. It does one job, and does it with checked math: split a payment between a creator and the platform commission wallet, atomically. There is no escrow, no stored balance, and no withdrawal path. Money only ever passes through inside a single instruction.

End to end, a single payment travels four steps: the payer signs in their passkey wallet, the program splits it 93/7 on chain, it emits one PaymentEvent, and the server re-reads that event from the finalized transaction before it grants the entitlement. The rest of this page is the detail behind each step.

State: the Config PDA

The program's whole state is a single account, a PDA derived from the seed [b"config"]:

pub struct Config {
    pub authority: Pubkey,                 // governance key
    pub pending_authority: Option<Pubkey>, // two-step transfer target
    pub platform_wallet: Pubkey,           // commission destination
    pub fee_bps: u16,                      // 700 at initialize
    pub bump: u8,
}

• authority can rotate the platform wallet and lower the fee. Authority itself moves only through a two-step propose / accept handshake, so a typo cannot brick governance.
• fee_bps starts at 700 (7%) and is bounded by a compile-time MAX_FEE_BPS of 700. The fee can drop and rise back, but never above 700. The cap is not a parameter. It lives in the bytecode.

Instructions

Payment math

fee = amount * fee_bps / 10_000   // u128 intermediate, checked, floor
net = amount - fee                 // creator receives net

• Because the fee floors, any rounding dust goes to the creator.
• Amounts below 15 base units would floor the fee to 0, so a hard MIN_PAYMENT of 1,000 base units (lamports or token units) keeps every split meaningful.
• For both pay_sol and pay_spl, the platform account passed in must equal config.platform_wallet. The same platform.key() == config.platform_wallet constraint guards each path, so passing any other account fails the instruction. On the SPL path the platform token account is then derived canonically from that constrained wallet.
• For pay_spl, both destination ATAs are derived canonically and created on the fly if missing (init_if_needed, payer funds the rent). The program works for any SPL mint. The platform itself only indexes USDC.

PaymentEvent

Every successful payment emits one event, decoded by the server:

pub struct PaymentEvent {
    pub payer: Pubkey,
    pub creator: Pubkey,
    pub mint: Pubkey,      // Pubkey::default() for SOL
    pub amount: u64,
    pub fee: u64,
    pub net: u64,
    pub ref_id: [u8; 32],
    pub kind: u8,
    pub timestamp: i64,
}

ref_id: binding a transaction to one intent

ref_id is the SHA-256 hash of a canonical platform reference string. It lets the server match a confirmed transaction to exactly one intent without a memo instruction, and it makes replaying a transaction into a different entitlement impossible. The four intent formats:

xenia:tip:image:{id}:{userId}:{nonce}
xenia:unlock:image:{id}:{userId}
xenia:unlock:dm:{creatorId}:{userId}
xenia:tip:user:{creatorId}:{userId}:{nonce}

Unlock intents carry no nonce, so the same buyer unlocking the same item always hashes to the same ref_id. That makes it idempotent: one entitlement, no matter how many times it runs. Tips carry a client nonce, so repeated tipping produces distinct references.

Server-side confirmation

1. The client submits the signed transaction, then calls POST /api/pay/confirm with the signature.
2. The server fetches the finalized transaction itself (retrying briefly for finalization) and requires an instruction invoking the xenia-pay program id.
3. It decodes PaymentEvent from the logs and checks every field: payer matches the session wallet, creator matches the expected wallet, mint is SOL or USDC, amount covers the price (with the SOL drift tolerance), ref_id equals the expected intent hash, and the signature has never been recorded before (unique index).
4. Only then is the tip or unlock recorded, inside a database transaction. The server trusts nothing it did not re-read from the chain.

Safety properties

• Overflow-checked release profile, and no unsafe anywhere.
• The CPI surface is limited to the System, Token, and Associated Token programs. Nothing else can be reached through xenia-pay.
• The test suite (bankrun, no local test cluster required) covers initialize and re-init guarding, exact split math across boundary values, both SOL and SPL paths, ATA auto-creation, rejection of platform-account substitution, fee cap enforcement, authority gating with the two-step transfer, and event decoding.

xenia-market, in depth

The collectibles market is a second Anchor program that mirrors xenia-pay's split, with one addition: it escrows the NFT. A seller lists a collectible they own by moving the single token into a program-owned vault, with a price, a settlement currency (SOL or USDC), and a royalty. A buyer calls buy_sol or buy_spl with a max_price slippage guard, and in one atomic instruction the NFT is released to the buyer while the payment splits 93/7 to the seller and the platform, with the creator royalty honored. A seller can cancel at any time to reclaim the escrowed NFT. Every sale emits a SaleEvent that mirrors xenia-pay's PaymentEvent field for field, so the same server-side confirmation re-reads it from the finalized transaction before recording the change of ownership.

Can anyone see my real face or body?

No. The augmentation / fantasy filter rebuilds every photo as anime in XENIA Studio, and the source photo is never stored. Only the rebuilt image exists, and that is all viewers ever see. Protected images go further. Their public preview is built from a 24-pixel downsample, so there is nothing recoverable in the blur.

What content is forbidden?

Anything involving minors, animals, or abuse and non-consent. XENIA Studio runs 18+ safety checks on every render and screens the finished result again, failing closed. The policy is zero tolerance. A confirmed violation means an immediate permanent ban, removal of the account's content, and a report to the authorities, including NCMEC and law enforcement, where the law requires it. Everything between consenting, verified adults is welcome. None of the above ever is.

Does a human ever review the content?

Yes. On top of the automated screens, every image and animation passes through an internal review queue, so a person looks at all media on the platform at least once. This does not hold up publishing. Posts go live immediately and the human pass runs behind them. Every piece of media also carries a report button any viewer can hit, and a report drops straight back into that same queue for a human to check. If something slips past the automated checks, the people looking are the backstop.

Does XENIA hold my money?

Never. Your wallet is non-custodial and lives in your browser; the server stores only the public key. Tips and unlocks drop 93% straight into the creator's wallet inside one atomic on-chain instruction, keeping a 7% fee. There is no balance, no escrow, and no payout queue.

XENIA cannot withdraw, freeze, or move your funds in any way. Only your passkey can authorize a transaction, and the keys never leave your device. If moderation freezes or bans an account, that hits published content only. The wallet and its funds stay in your custody the whole time.

Which currencies are supported?

SOL and USDC are the payment assets: tips, unlocks, and renders settle in them, on Solana mainnet. Your wallet also holds gold (PAXG) and jitoSOL (liquid-staked SOL) as savings, which you can swap, send, and receive. Prices are set in USDC and displayed in both payment currencies; payers choose SOL or USDC at payment time.

What does XENIA cost?

XENIA is completely free to use. Your account, your username.xenia.studio subdomain, posting, browsing, following, and every tool to earn cost nothing. The one fee is the 7% commission on tips, image unlocks, and External DM unlocks (in both SOL and USDC), taken through the XENIA wallet and enforced on chain with a hard 700 bps cap the program itself cannot exceed. Moving your own funds is never split. Depositing, sending, and withdrawing pay only the Solana network fee, so you keep 100% of your own money and 93% of every tip and unlock. You never have to fund your wallet to start earning either. A zero-balance wallet collects tips and unlocks from day one, and buying or depositing crypto is only ever for spending.

I lost my device. Is my wallet gone?

No, if you have the 24-word recovery phrase from signup. Enter it on a new device and the wallet is restored under a fresh passkey. If you have lost every passkey device and the phrase, the wallet is unrecoverable; nobody else ever had the key, so nobody can restore it.

How is identity and age verified?

Creators verify with a government ID through Yoti, either an ID document scan with a live face match in Yoti's hosted flow, or an ID share from the Yoti app. This proves both that you are over 18 and that the person is you. Browsing needs no account or verification. See Age Verification for what is and is not stored.

What personal data does XENIA keep?

A username, an email (never shown publicly), a wallet public key, your verification receipts (provider session id and redacted result), and your content, encrypted. Raw ID documents are never stored on XENIA servers. They stay with the verification provider. The face reference photo is encrypted and used only to confirm your likeness when you generate in the Studio. It is never shown publicly.

Can I delete my content or my account?

Yes. Deleting an image hard-deletes its encrypted blobs immediately. Account deletion cascades through everything you own. What cannot be deleted is on-chain history: transactions on Solana are public and permanent, but they contain only wallet addresses and amounts, never content or identity.

Why is an image blurry?

It is protected: the creator priced it. The price shows on the tile; unlocking pays the creator directly and the full image is served to your account permanently.

Do unlocks expire?

No. Image unlocks and External DM unlocks are permanent entitlements, recorded against confirmed on-chain transactions. Later price changes do not affect what you already unlocked.

Can I use Phantom or another wallet extension?

No. XENIA uses its own in-browser passkey wallet and nothing else. The wallet is also your account identity, and the signing flow runs on per-use passkey unlocks, so an extension does not fit. You can always move funds between the XENIA wallet and any external wallet with a normal send.

Is there a built-in chat?

Yes. Messages are end-to-end encrypted direct messages between verified adults, sealed in your browser with a key derived from your wallet and openable only by your wallet. They cost nothing between you, carry styled text and XENIA renders, and can include a tip to a profile. An External DM unlock is a different thing: a paid reveal of a creator's off-platform handles (Telegram, Discord, Keybase, SMS, or email) for talking elsewhere.

What does it cost to generate a render?

XENIA Studio is pay-per-render: $0.08 for an image, $0.08 for a second-pass edit, and $0.75 for an animation, priced in USD and charged in SOL or USDC at spot. Each render is a real Solana payment, approved per generation in your passkey wallet, with no subscription and no credits. This is separate from the 93/7 split on tips and unlocks. See XENIA Studio.

Does XENIA support two-factor authentication?

Yes, optionally: an authenticator app (TOTP) and server-side passkeys, either or both. Ten single-use recovery codes are issued at TOTP enrollment. Removing or disabling a factor requires a fresh wallet signature.