Security
Last updated: 10 October 2026
Read-only by design
Zen Trader cannot place, change or cancel orders and cannot move funds. Order execution is switched off on the server.
Hyperliquid: no key at all
Hyperliquid account data is public on-chain. You paste your wallet address and we read positions, fills and funding from it. We never ask for a private key, a seed phrase, a signature or a wallet connection.
Bybit: read-only key, checked
When you paste a Bybit API key we ask Bybit what the key is allowed to do. A key that can withdraw is rejected. The check is repeated every day, and you see the key's status and expiry date in the app.
How the key is stored
The key and secret are encrypted with AES-256-GCM before they are stored, bound to your account so one user's record cannot be decrypted as another's. They are decrypted only on the server, only to call Bybit, and are never sent back to your browser. Your browser cannot read the stored values from the database.
Your data is yours alone
Database rules restrict every table to the signed-in owner of the row. Screenshots are stored in a private bucket in a folder only you can read.
You can leave cleanly
Delete a key or a connected account at any time. "Delete my account and all data" in Settings removes everything, including your sign-in.
AI
AI features are rate-limited per user and labelled "AI-generated". They receive only what the specific request needs.