Security.

We don’t hold your funds

WatchCrypto is a terminal, not an exchange or a wallet, and it never takes deposits or holds your money. You deposit into your own account on the exchange: even the terminal’s deposit panel sends USDC from your wallet, through Hyperliquid’s bridge, to your own Hyperliquid account. Trading on Hyperliquid or Bulk happens in that account, your funds stay on the venue, and the fee approval you sign can be revoked there at any time.

If you sign in with Google or email instead of a wallet, Privy creates a non-custodial wallet for you: you control it, not us. Its key is split across three Shamir shares in a secure enclave, so we never hold it, and neither does any single party.

How credentials are stored

• Passwords are hashed with Argon2 — the current industry standard — and never stored or logged in plaintext.
• Exchange API credentials you connect are encrypted at rest with AES-GCM. Plaintext keys are never written to the database.
• Least privilege by design: WatchCrypto never needs withdrawal permissions, so never grant them. Hyperliquid API wallets and Bulk agent keys — the credentials the terminal uses — cannot withdraw funds at all; that restriction is enforced by the venue, not by us.

Transport and application security

• All traffic is HTTPS with HSTS; the site sends a Content-Security-Policy, X-Frame-Options DENY, and nosniff headers.
• The public API is rate-limited to blunt abuse and scraping.
• No ads and no third-party trackers beyond standard analytics — what runs on the page is what we shipped.

Compliance

Access from comprehensively sanctioned jurisdictions is blocked at the application layer. Compliance logs store hashed IP addresses — not raw ones — and are retained for 10 years, the period U.S. sanctions recordkeeping rules require. Details on data handling live in the privacy policy.

Found something?

If you’ve found a vulnerability, we want to hear about it before anyone else does. Email [email protected] (also listed in security.txt), or message us on X or Telegram and we’ll respond quickly. Please give us a reasonable window to fix the issue before public disclosure.