Self-custody
Keys are encrypted on your device. We do not hold server-side seeds or recover lost phrases.
Home · Security
Trust & threat model
Security at Riddle
Self-custody first. Production payments only. Guide never needs your seed.
PIN is local
Unlock PIN / vault password stays on the device. It is never sent to Riddle servers or Guide.
Re-auth every 1 hour
Idle sessions require re-auth after 1 hour before high-risk actions (send, swap, bridge, NFT settle).
Payload warnings
Sign screens must show network, amount, destination, and irreversible copy. Do not approve blind QRs.
Never share a seed with Guide (or chat, email, or anyone claiming to be Riddle). Guide is assistance only — it cannot restore wallets and must never receive recovery words, private keys, or PINs.
What you must protect
- Seed phrases and private keys
- Device PIN and OS unlock
- Phishing — only use hosts under riddlewallet.com (Wallet: wallet.riddlewallet.com)
- Payload details before you sign
What we do not do
- Recover lost seeds
- Reverse user-signed transactions
- Guarantee third-party bridge or market outcomes
- Provide financial advice