How your money is held

You fund a wallet that you own. We can place trades with it. We cannot take money out of it, and we cannot give ourselves permission to. That isn't a policy we promise to follow — it's a restriction we are unable to lift.

What we can and can't do

Place a trade with your funds	yes
Convert your deposit so it's tradeable	yes
Send your funds to another address	no
Send your funds to ourselves	no
Change these rules	no
Stop you withdrawing	no

Why "no" actually means no

Your wallet's keys are held by Privy, inside hardware that will only sign a transaction if it passes a rule set attached to the wallet. We are registered as a signer on your wallet with a rule set that permits swaps, and permits turning your deposited SOL into the wrapped form a swap needs. A transfer to any other address matches none of those rules and is refused before a signature exists.

The rule set and the wallet are both owned by your sign-in, not ours. So we can't edit the rules, and we can't add a second, less restricted signer. Both attempts are rejected for lack of a signature only you can produce.

We tested this rather than assuming it

Against the live system, on a real wallet:

We sign an ordinary trade	signed
We try to send funds to an outside address	refused
We hide a transfer inside a genuine trade	refused
We try to rewrite the rules	refused
We try to add an unrestricted signer	refused
You withdraw	signed

The third row is the one we cared about most: a transfer smuggled into the same transaction as a legitimate action. It fails, because every instruction in a transaction has to satisfy the rule, not just one of them.

These checks live in test_privy.py in the bot repository and run against the real API, so you can run them yourself rather than take our word for any of the above.

What we know about you

Your email address, your wallet address, and the trades made in it. That's the list. We never see a private key or a seed phrase, because none is ever given to us — there is nothing in our systems that could be stolen and used to move your funds.

What this does not protect you from

Being unable to steal from you is not the same as being safe. Honestly:

Trading losses. The guardrail stops theft, not bad trades. We can lose your money by trading badly, and these are memecoins — most go to zero. Nothing here changes that, and no result is promised.
Your email. It's how you get back in, which means whoever controls your inbox controls the wallet. Use an email with two-factor authentication on it.
Privy. They hold the key material, so you're trusting their security, not only ours. We think that's a better trade than trusting us with a key, but it is a real dependency and you should know it exists.
The chains and exchanges we trade through. Trades route through Jupiter and the underlying pools. A failure there can cost money regardless of who holds what.
Us, staying up. If our systems stop, open positions stop being managed. You can always withdraw — that path doesn't depend on us — but nobody is watching your stop while we're down.

Getting your money out

From your wallet page, any time, without asking us. It's signed in your browser by your own sign-in. Closing the wrapped-SOL account returns its rent deposit as well, so you get back slightly more than you put in; the only cost is the network fee, currently about 0.000005 SOL.