Security

Your money stays in your wallet

• Your wallet is created with Privy's embedded wallet technology. Its key is split and secured so that it can only be used when you are signed in. Mintoo never sees or stores it.
• You approve every payment on your device. Our servers never sign payments for you and can't move money out of any wallet. Mintoo never adds extra signers to your wallet, and our servers refuse wallets that have them.
• On the test network, a Mintoo server key adds test money to new wallets. It can only add test money; it has no control over any wallet.

Signing in and approving

Sign-in

A one-time code sent to your email, a passkey, or Apple or Google if you choose. No passwords to leak.

Large payments

From €500, a payment also needs Face ID or your fingerprint, with a key that has been on your account for at least 24 hours. Each confirmation is valid for one payment only.

Account changes

We email you when a Face ID or fingerprint key is added or removed, and before you delete your account we ask for a new sign-in code.

Recovery

You can export your wallet's key in Settings › Recovery, so you can reach your money even without Mintoo.

How we protect the service

• All connections are encrypted (HTTPS, with HSTS). Mintoo's session cookie is secure and can't be read by scripts.
• An enforced Content Security Policy limits which sites the app can load code from or talk to, and the app can't be framed by other sites.
• Our code is scanned for leaked secrets and checked for vulnerable dependencies on every change.
• Rate limits and checks for unusual activity protect against abuse. In an incident we can pause new payments for everyone; balances aren't affected.
• Emails about money waiting for you only link to Mintoo, never carry links written by other people, and are capped per address, so they're hard to misuse for phishing.

What we'll never ask you

• Your sign-in code, by phone, chat or email.
• Your wallet key or a recovery phrase.
• To send money to "verify", "unlock" or "protect" your account.
• To install an app that lets someone else control your phone or computer.

If someone asks for any of these, it isn't us. Stop, don't pay, and tell us.

Report a vulnerability

Email office@agentwave.ltd with the subject "Security". Please include what you found and how to reproduce it. We'll confirm within 5 business days and keep you updated until it's fixed.

Please don't access other people's data or money, disrupt the service, or share the issue publicly before it's fixed. We won't take legal action against research done in good faith within these rules.