> For the complete documentation index, see [llms.txt](https://dyorhq.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dyorhq.gitbook.io/docs/platform/self-custody-and-security.md). # Self-Custody & Security DyorHQ is non-custodial end to end. This page explains what that means in practice and the protections built into the app. ## What DyorHQ never does * **Never holds your keys.** An Email & Password or imported wallet's key is stored in the iPhone Keychain, marked "this device only" so it is never synced to iCloud. A passkey account's key is derived from your passkey each time you unlock it and is never stored, on the device or on a server. Apple and Google sign-ins use a Privy embedded wallet whose key is held by Privy, not DyorHQ. * **Never holds your funds.** Every product routes through public contracts on Monad (venues' own routers, Perpl's exchange, the DyorHQ Launchpad and Moments contracts). DyorHQ has no deposit address and no pooled balances. * **Never signs for you.** Every transaction is signed on your device after you tap the confirm button, and only for exactly what the confirmation sheet showed. * **Never asks for your key.** Support will never ask for a recovery phrase, password or private key. Anyone who does is not DyorHQ. ## What you are responsible for * **Your password** (Email & Password wallets). It is the wallet. There is no reset that keeps your funds. * **Your recovery phrase or private key** (imported wallets). DyorHQ can show you an imported wallet's key again (behind Face ID), but if you delete the app or sign out, only your own backup brings the wallet back. * **Your MON balance for gas.** ## Protections built in | Protection | What it does | | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Confirmation sheet before signing** | Every wallet transaction (swaps, sends, curve trades, launches, collects, claims, on-chain perp orders) opens a sheet that shows every detail, simulates the transaction so a revert surfaces before you sign, and skips approvals you've already granted. Three exceptions: the bridge signs straight from its own screen, orders sent through One-Click Trading are signed by your Perpl trading key instead of your wallet, and the one-time Enable One-Click Trading transaction is sent from Profile → Perpl Trading. | | **Require Face ID (App Lock)** | Profile → Security → **Require Face ID**. On by default for a new install on an iPhone with a passcode. It asks for Face ID (or your passcode) before the wallet signs ("Confirm Swap", "Confirm Send", "Confirm bridge"…). That includes One-Click perp orders, take-profit/stop-loss changes and the one-time Enable One-Click Trading transaction. It also asks before connecting Perpl trading, signing out, deleting your account or turning App Lock off. Passkey accounts don't use it, because their passkey is the lock. | | **Privacy cover** | The instant the app leaves the foreground, an opaque cover hides the screen so the iOS app-switcher snapshot can never capture a phrase, key or balance. | | **Secret fields are privacy-sensitive** | Phrase and key fields are hidden by default (Reveal/Hide) and re-hidden whenever you leave the app. | | **Clipboard hygiene** | An exported private key expires from the clipboard after 90 seconds. After importing, the app clears the clipboard if it still holds your secret. | | **Keychain, device-only** | Imported and Email & Password keys use the strictest Keychain class: available only when the phone is unlocked, never synced. | | **Economics locked at launch** | Launchpad launches and Moment publishes carry a hash of the terms you saw. If the terms changed between you reading and your transaction landing, the launch or publish reverts. | | **Immutable contracts** | No proxies. Locked liquidity has no withdrawal function. Nothing about a live Moment can be changed by anyone, including DyorHQ. | See [Risk Disclosures](/docs/resources/risk-disclosures.md) and [Contracts & Addresses](/docs/resources/contracts-and-addresses.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://dyorhq.gitbook.io/docs/platform/self-custody-and-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.