How the app keeps your funds safe

The app is a custodial wallet: it holds your crypto for you. There is no KYC — you never upload an ID, a selfie, or a proof of address. Instead of identity documents, your funds are protected by server-side controls that make a stolen session hard to cash out.

What protects your account

• A verified email (required). You can’t use the money features until your email is verified. The email is the out-of-band channel that authorizes any change to your other security settings. See email verification.
• A PIN or Face ID for withdrawals. Sending crypto to a new address must be confirmed with your account PIN or Face ID. Once an address is confirmed, it’s trusted for future withdrawals.
• The withdrawal address allow-list. You can restrict withdrawals to addresses you’ve explicitly saved. Turning it on is instant; turning it off is delayed on purpose. See the allow-list.
• Withdrawal limits. A per-transaction and a daily maximum apply per asset, capping how much a compromised session could move. See withdrawal limits.
• AML screening. Every withdrawal destination is screened; sanctioned and high-risk addresses are rejected.

Why no KYC still means secure

These controls are layered. Even someone who got into your Telegram session would still need your PIN or your device’s Face ID to withdraw to an address you haven’t used before, would run into your limits, and would trip the allow-list — all while you receive a critical Telegram message about it.

Your part

• Verify your email and keep access to that inbox.
• Set a PIN, and enroll Face ID if your device supports it.
• Turn on the allow-list for the addresses you actually withdraw to.
• Treat every critical Telegram security message as real, and act on it if it wasn’t you.