Don't Trust
the Coin._

Architecture

Two Wallets, Two Jobs

This platform deliberately uses two different wallets that never do each other's job. Mixing them up is where most "trust me bro" crypto products go wrong, so here's the split, in plain terms:

Your connected wallet

What We Can See vs. What We Can't

The honest version

The Session Wallet Holds Your Funds — Here's Exactly How

We're not going to claim this platform "never touches your funds," because automated trading means transactions get signed without you clicking each one. Here's the real deal instead:

• Your session wallet is a Privy embedded wallet. Its private key is split across Privy's MPC infrastructure — no private key is stored on our servers, encrypted or otherwise.
• Automation requires a permission you grant: the "Enable Automated Trading" step delegates signing for this wallet to the trading engine. Until you grant it, nothing can auto-sell for you (and the desk warns you loudly if you hold a position unprotected). You can revoke it.
• With that delegation granted, the platform can sign trades for that specific wallet on your behalf — that's the entire point; it's what makes take-profit/stop-loss automation possible without a wallet popup on every trade. Treat it accordingly.
• It only ever holds what you deliberately deposit into it. Nothing else you own is ever touched or drained to fund it — you send SOL to it yourself.
• You can withdraw at any time to an address you choose. (Accounts from the earlier server-wallet era additionally authorize withdrawals with a fresh signature from their connected wallet — that older path is still honored.)

Treat a funded session wallet the way you'd treat any hot wallet: fund it with what you're comfortable actively trading, not your entire net worth.

Step by step

What Actually Happens, In Order

1. Accept the terms — before any account exists at all.
2. Sign in — email, Google, Apple, or a wallet, through Privy's hosted flow. Nothing moves. This is identity proof, not a trade authorization.
3. Your session wallet is created — a Privy embedded wallet whose key lives in Privy's split-key infrastructure, not on our servers.
4. Enable automated trading — an explicit, revocable delegation step. Skip it and the bot cannot sign anything for you (manual trading and monitoring still work; auto-exits don't).
5. Fund it — you send SOL to the session wallet's address yourself, a transfer you review and approve.
6. Trade — the engine signs trades from the session wallet under the take-profit / stop-loss / trade-mode settings you configured.
7. Withdraw anytime — to an address you choose, capped by your own rolling daily withdrawal limit.

Under the hood

Security Architecture

• Embedded-wallet private keys never exist on our servers — they live split across Privy's MPC infrastructure, and automated signing works only through the delegation you explicitly grant.
• No passwords stored here, anywhere. Identity is verified via Privy access tokens (or an ed25519 wallet signature) — there's nothing password-shaped in our database for a breach to leak.
• Session tokens are random, single-purpose bearer tokens stored only as SHA-256 hashes and looked up server-side (not a decodable JWT) — revocation is just deleting the row.
• Withdrawals are bounded by a rolling 24-hour cap per account; legacy server-wallet accounts additionally require a fresh signature tied to the exact amount and destination.
• Every sign-in and trading endpoint is rate-limited against abuse, with a site-wide request floor behind those.
• All database queries are parameterized — no hand-built SQL strings.
• Secrets (API keys, RPC keys) live only in server environment variables — never in this codebase, never sent to your browser.

Boundaries

What We Don't Do

• We don't ask for your seed phrase or private key — ever. If anything claiming to be us ever does, it isn't us.
• We don't move funds out of your connected wallet without your direct, explicit approval.
• We don't hide take-profit/stop-loss, slippage, or fees behind a black box — every setting is visible and yours to change.
• We don't guarantee profit, safety, or outcomes. Every score and check on this platform is a risk read on public on-chain data, not a prediction.

Independent review

Audits Not yet audited

This platform has not yet had an independent third-party security audit. We won't put an "audited" badge anywhere on this site until that's actually true — when it happens, the report will be linked directly from this page.

Track record

Incident History No incidents to date

Nothing to report. If that ever changes, this is where you'll hear it from us first — not somewhere else.

Track record

The Trading Record, As Recorded Paper only — no live capital yet

Data

What We Actually Store

• Your connected wallet's public address (so we know it's you across sessions)
• Your session wallet's public address and Privy's opaque wallet identifier — never its private key. Key shares live split across Privy's MPC infrastructure, as described above; there is no key material in our database
• Your trading configuration and trade history on this platform (so the dashboard/journal work)
• If you purchase a paid unlock: the email Stripe's checkout collects for the receipt, tied to your access key

We don't need or request your name, phone number, or any other off-chain personal information to use the platform.

Questions

Report a Concern

Found something on this page that doesn't match how the product actually behaves, or a security concern you want to report? Reach out through wherever you found this link — we haven't published a dedicated security contact yet, and we'd rather leave this honestly blank than list an address nobody's watching.