Keys stay on the device
Wallet secrets are created and held locally. The app is designed around a desktop key store, so signing remains a user action on the machine instead of a remote account operation.
Back to control
Custody notes
The longer version behind the home-page control section: what stays local, what gets reviewed, and how release integrity is checked.
Every cross-chain path is readable before signing
The review screen separates source chain, destination chain, recipient, amount, fee context, and message state. The goal is to keep a route understandable before a signature exists.
Release files should match published checksums
Installer links point to local release files, while checksum references are published on the checksums page. Each download URL serves the matching release artifact directly.
Desktop-first, with a conservative network surface
The wallet can be reviewed in a disconnected workflow where possible. When network access is needed, route state is presented as protocol status rather than hidden background activity.
The recovery phrase is the control point
A lost device is recoverable only with the recovery phrase. It should be stored offline, away from screenshots, shared notes, cloud drives, and browser-based password prompts.