Crypto stamps, born digital
A purely digital cinderella philately on Bindaro. Stamps are minted in series, cancelled onto letters you send to other collectors, and — if you hold a full set — burned to forge the publisher sheet. It borrows the vocabulary of real philately because the mechanics are the same ones.
Series and designs
A series is one run of stamps with its own mint window, designs and rules — either a definitive (the everyday issue, cheap or free, open edition) or a commemorative (limited, tied to an event, priced along a Dutch curve). A series holds between 1 and 64 designs, and each design carries its own edition size, so one value can be far scarcer than its siblings.
Cancel onto a letter
Write up to 8,000 characters, name a recipient wallet, and choose public or private. Bindaro seals the letter and computes its content hash; you sign the cancellation yourself, from the wallet holding the stamp. There is deliberately no edit — only discard — because the cover is later verified against that hash.
Covers and first-day covers
The cover is the envelope: a separate NFT, in its own collection, minted to the letter's recipient — one per stamp, at most, ever, and claiming is idempotent. A stamp cancelled while the series' first-day window is open is flagged FDC on-chain, permanently, which is what makes an early cover worth more than a late one.
Provably-fair errata
Before a series can be minted, its issuer commits to a secret seed on-chain — publishing its hash, not the seed — together with the misprint rate and the number of variants, none of which can change afterwards. Whether a stamp is a misprint is a pure function of that seed and the token id, revealed in daily batches over 30 days by default and then sealed by publishing the seed.
Sets and the publisher sheet
A set is one unspent copy of every design in a series; a stamp you cancelled is spent and no longer counts. Hold a full set and you can burn it to forge the publisher sheet — the rarest object in the series, tradeable like any other token, and not a stamp: it cannot be cancelled onto a letter. Every series page shows who completed the set and who got there first.
Collectors decide what gets issued
Not every series is decided by Bindaro. An issuer can submit one as a proposal, and collectors holding unspent stamps back it. Your weight is the number of unspent stamps you hold at the moment you vote, written down then rather than recomputed afterwards. Cross the threshold before the closing date and the series is greenlit.
What the chain knows about a letter
- Content hashThe letter's fingerprint, written on-chain together with the cancellation.
- PostmarkThe send date lives in the contract, and it is not a date anyone gets to pick.
- ProvenanceWho sent it — and, for a public letter, to whom.
- CancellationOne stamp, one letter, forever. The state moves one way and there is no call that moves it back.
- Private modeA private letter's recipient is stored as a commitment — a hash of the address and a secret salt — so no field and no event carries the address.
- The bodyKept off-chain, so you can delete it and the proof still stands.
Recompute the letter's hash and compare it with the chain. It matches, or it does not — there is nothing else to appeal to, and nothing to trust but the arithmetic.
The artwork is committed before the first stamp exists
Every design's artwork is anchored by a keccak-256 hash written on-chain, and a series must be frozen — design list and hashes locked — before the contract will mint from it. That is what makes the hash a real commitment: no stamp can ever have existed while its design was still editable, and a swapped file is detectable by anyone holding the original.
Network and standards
Both contracts — stamps and covers — live on Polygon and nowhere else. Stamps, covers and publisher sheets are ERC-721 tokens with 5% on-chain royalties, and they behave like any other NFT you hold: they appear in your wallet, go into albums, and trade on the marketplace under the same rules as anything else. Cancelling a stamp does not move it — it stays yours and stays tradeable. What it loses is its unused status.
The post office moved onto the chain
A letter used to carry exactly one stamp, and that stamp was simply spent. The post office replaces that with what real philately is built on: stamps have face values, letters have classes, and you cover the one with the other by putting as many stamps on the envelope as it takes.
Mixed franking
Up to ten stamps may pay for one letter, and they may come from different issues. Every one of them is cancelled — overpaying is exactly what a philatelist does, and it costs you something real.
Face values and classes
Each design carries a value printed on it, in Shards. Each letter names a class with a tariff to cover. Nothing is charged for a face value and nothing is transferred — the letter spends the stamps, and an underpaid letter is refused by the contract, not just by the app.
Commemorative postmarks
An occasion is a window of time announced on the chain before it opens. A letter posted inside it is cancelled with that pattern instead of the ordinary one. The mark changes; the date never does, so nothing can be backdated into an occasion.
The time capsule
Seal a letter until a date and the recipient sees the envelope, the postmark and a red wax seal — and not a word of the body. The date is signed into the cancellation, so nobody opens it early: not the recipient, not the sender, not us.
The travelling cover
An envelope you hold can be posted onward, and each leg strikes its own transit mark onto the artwork. Twelve fit on one envelope. A marketplace sale moves the cover and marks nothing — only the deliberate act of posting counts.
Watermarks
A hidden trait drawn by its own lottery, which only the holder can uncover — one transaction, once per stamp, with the wallet and the moment recorded on-chain for good. An inspection is a bet placed before the answer exists.
Registered letters
The body opens only against a dated receipt: taking the envelope IS the signature, and the sender sees it. Refuse it and the letter stays shut for you for good. Let the term run out and the non-collection can be recorded on-chain — on the blockchain's clock, which we cannot move either.
End-to-end encrypted letters
Set up a letter key once and your wallet's signature is the only thing that opens it — nobody else reads the letter, Bindaro included. The key is never stored on your device, so each session costs one signature and no gas. Replace it whenever you like: new letters seal to the new key, and your whole history stays readable.
Tracking and proof of posting
Every letter gets a tracking number and a public timeline — posted, franked, sealed, signed for, delivered — with each step linking to the transaction behind it. Look a number up without an account, or download the proof of posting and let anyone check it for themselves.
Where the proof stops. A receipt on the chain is evidence, and between people who accepted Bindaro's Terms it is what those Terms treat as delivery. Write to an address that is not a Bindaro user and you still get evidence of posting and receipt — but “deemed delivered” does not bind them, because they never accepted anything. It is not a statutory electronic-delivery service and not a qualified trust service, and nothing here claims the effects of one.
Impossible Post FAQ
What is Impossible Post?
A purely digital cinderella philately on Bindaro — a stamp collection that was never printed. Stamps are minted in series, cancelled onto letters sent to other collectors, and a complete set can be burned to forge the publisher sheet. Stamps, covers and sheets are ERC-721 tokens on Polygon.
What does cancelling a stamp actually do?
It uses the stamp to send a letter. The stamp stays in your wallet and stays tradeable, but it can never carry another letter and can never be part of a set you forge into a sheet. The chain enforces it: the state moves one way, so there is no undo and no support request that reverses it.
What is a cover, and who pays for it?
The cover is the envelope NFT the letter's recipient can claim — one per stamp, at most. Bindaro's relayer mints it, so the recipient pays no gas. It is bound on-chain to the stamp's token id and to the letter's content hash, and the covers contract refuses to mint against a stamp that is unknown or was never cancelled.
How do I know the misprints were not rigged?
The issuer commits to a secret seed on-chain — its hash, not the seed — before a single stamp exists, together with the misprint rate and the number of variants, and none of it can change afterwards. Which stamps are misprints is a pure function of that seed and the token id, so no one can pick token ids by outcome while the seed is secret. When the reveal is sealed the seed is published, and anyone can recompute every outcome; a single mismatch is provable, permanently.
Can a private letter stay private?
The recipient of a private letter exists on-chain only as a commitment — a hash of the address and a secret salt — so no field and no event carries the address. The sender is public either way, because they sign the transaction. Claiming the cover for a private letter writes the recipient's address on-chain, so the app asks for an explicit confirmation first; you can leave the cover unclaimed and read the letter anyway.
Where do I use it?
In the Bindaro web app and the mobile app: browse series, mint, manage your collection and read your mailbox. Proposing a series, the collector opt-in board and the issuer console are web only.
Can I put several stamps on one letter?
Yes — up to ten, and they may come from different issues. Each design carries a face value in Shards, each letter names a postage class with a tariff, and your stamps have to cover it; the contract refuses an underpaid letter outright. Overpaying is allowed and deliberate. Every stamp you attach is cancelled with the letter, in one transaction, so a letter can never claim postage that was not actually spent.
Can anyone at Bindaro read my letters?
Not an encrypted one. You set up a letter key once — your wallet signs a message and the key is locked so that only that signature opens it. The key is never stored on your device, so each session asks for one signature and costs no gas. The app also refuses an envelope that was sealed to different stamps than the ones it arrived on, so a swapped envelope cannot be passed off as the original.
How does a registered letter work?
The body stays shut until the recipient signs for it, and taking the envelope is that signature — dated, and visible to the sender. Refusing sends it back unopened and it never opens for them again. If the term runs out, the non-collection can be recorded on-chain, on the blockchain's clock. A receipt is evidence, and between people who accepted Bindaro's Terms it is what those Terms treat as delivery; write to someone who is not a Bindaro user and you still get the evidence, but nothing binds them. It is not a statutory electronic-delivery service and not a qualified trust service.
ERC-721 on Polygon · stamps, covers and publisher sheets