Skip to main content

​
The custody boundary

For trading and custody, Tickside acts only as a frontend interface. Tickside does not hold customer funds and cannot withdraw them, recover them, freeze them or reverse a venue action. Funds remain in your wallet or selected venue account. Tickside has a backend for login, public account data and operational records. That backend never stores your wallet private keys, Hyperliquid API wallet private keys, Polymarket account API secrets, seed phrases, recovery codes or encryption passphrases.

​
How each key is protected

Privy manages login and the embedded wallet connected to your main Tickside identity. Tickside receives the public address and asks the Privy provider to sign approved actions. The private key is not exposed to the Tickside frontend or backend.You can export this wallet from the account menu. Tickside asks you to restore the matching Privy session, then Privy opens its secure export window. The key is displayed by Privy and is not returned to Tickside. Export only on a trusted device and never send the result to support.
An imported Polymarket private key is entered directly in the browser. It is never sent to the Tickside backend.If you choose Remember on this device, the browser stores only encrypted ciphertext. The key that decrypts it is non extractable and stays in this browser. If you choose a passphrase, the passphrase is not stored. If you choose session only, the private key remains in memory and is removed when the session ends.
Hyperliquid uses a master wallet for funds and a separate API wallet for trading. Tickside refuses the master wallet private key because that key can withdraw funds.The API wallet private key is encrypted locally in the browser. Remembered mode uses a non extractable device key. Passphrase mode derives the encryption key from the passphrase you enter. The passphrase is never stored or sent to Tickside. The decrypted API wallet key exists only in browser memory while the session is unlocked.Removing an account from Tickside removes the local encrypted copy. It does not revoke an approved API wallet at Hyperliquid. Revoke it from the Hyperliquid API page as well.

​
Orders and API credentials

Orders are signed in the browser and submitted to the selected venue. Temporary Polymarket API credentials are created and used in browser memory. They are not stored on Tickside servers. Hyperliquid orders use the unlocked API wallet in browser memory.
Nobody from Tickside will ask for a private key, API wallet key, API secret, seed phrase, recovery code or encryption passphrase. Any message asking for one is fraudulent.

​
Disconnect

Disconnect ends the Tickside session on that browser. Locking a venue session removes the decrypted trading key from memory. Neither action cancels working orders or closes positions at a venue.

​
Operational data

Tickside records the information needed to operate and investigate the product, including public wallet addresses, order identifiers, fills, prices and P&L states. Secret fields are removed from diagnostic events. Never paste a secret into a support message.
Clearing browser data can remove locally saved venue credentials. Keep your own secure recovery path with Privy, Polymarket and Hyperliquid. Tickside cannot recover a secret that was never stored on its servers.
Read more about Privy wallet security and secure wallet export.