Keys stay on the device
Wallet secrets are created and held locally. The app is designed around a desktop key store, so signing remains a user action on the machine instead of a remote account operation.
Back to control
Custody notes
The longer version behind the home-page control section: what stays local, what gets reviewed, and how release integrity is checked.
Every cross-chain path is readable before signing
The review screen separates source chain, destination chain, recipient, amount, fee context, and message state. The goal is to keep a route understandable before a signature exists.
Release files should match published checksums
Installer links point to local release files, while checksum references are published on the checksums page. Until a binary appears in releases, the matching download URL intentionally returns not found.
Desktop-first, with a conservative network surface
The wallet can be reviewed in a disconnected workflow where possible. When network access is needed, route state is presented as protocol status rather than hidden background activity.
The recovery phrase is the control point
A lost device is recoverable only with the recovery phrase. It should be stored offline, away from screenshots, shared notes, cloud drives, and browser-based password prompts.