Security.
The short version: we never hold your funds, credentials are encrypted or hashed with modern standards, and if you find a hole we want to know first.
We don’t hold your funds
WatchCrypto is a terminal, not an exchange or a wallet. There are no deposits and no custody. Trading on Hyperliquid happens on your own Hyperliquid account — your funds stay on the venue, and the builder-fee approval you sign on-chain can be revoked there at any time.
How credentials are stored
- Passwords are hashed with Argon2 — the current industry standard — and never stored or logged in plaintext.
- Exchange API credentials you connect are encrypted at rest with AES-GCM. Plaintext keys are never written to the database.
- Least privilege by design: connect read-only or trade-only keys — WatchCrypto never needs withdrawal permissions, so don’t grant them. Hyperliquid API wallets cannot withdraw funds at all; that restriction is enforced by the exchange itself.
Transport and application security
- All traffic is HTTPS with HSTS; the site sends a strict Content-Security-Policy, X-Frame-Options DENY, and nosniff headers.
- The public API is rate-limited to blunt abuse and scraping.
- No ads and no third-party trackers beyond standard analytics — what runs on the page is what we shipped.
Compliance
Access from comprehensively sanctioned jurisdictions is blocked at the application layer. Compliance logs store hashed IP addresses — not raw ones — and are retained for 90 days. Details on data handling live in the privacy policy.
Found something?
If you’ve found a vulnerability, we want to hear about it before anyone else does. Message us on X or Telegram and we’ll respond quickly. Please give us a reasonable window to fix the issue before public disclosure.