Security & Fund Safety
This page describes how BOOPOLY protects your wallet and funds, and the controls you keep at all times. The foundation is simple: you own your wallet and its key, and BOOPOLY never sees the key. If you turn on 24/7 trading, a server signer can act on your wallet only within a fixed policy — the section below lists exactly what that policy allows.
NoteBOOPOLY is in Beta and trades real funds on Polymarket. The protections on this page are designed to limit what can happen to your funds and to keep you in control; like any security measures, they reduce risk rather than remove it.
#Your keys live in Privy, not in BOOPOLY
When you log in, Privy creates an embedded wallet for you. The private key is generated and held inside Privy's secure infrastructure (hardware-backed encryption in a secure enclave). BOOPOLY never sees your private key — signing happens inside the enclave, and the app only receives the resulting signature.
That is why you can start without a browser extension or a seed phrase: the key exists, and it is protected by Privy's key management rather than stored in your browser.
#You can export your key at any time (self-custody)
You are never locked in. In the account menu, the key icon (Export wallet) opens a short guide. Its Open Privy to export button takes you to Privy's recovery site — sign in there with the same method you use on BOOPOLY (email, Google or Discord), then export your private key. You can import that key into MetaMask or another standard wallet.
#What the exported key controls
Your exported key is the owner of your Polymarket smart-wallet deposit address, which works slightly differently from a regular wallet:
| With the key alone, you can | Things to know |
|---|---|
| Sign any operation on the deposit wallet as its owner | Your USDC balance won't appear in MetaMask, because it is held by a smart-contract wallet rather than your EOA |
| Move all funds out with the open-source boopoly-rescue tool, even if this site is offline | A regular MetaMask "Send" button can't move funds held by the contract wallet |
Day to day, Withdraw USDC in the account menu is the simplest way to cash out; the rescue tool is an independent backup that works without BOOPOLY.
TipExporting your key does not change how your account is protected, but the exported key gives full control of your funds. Store it offline, enter it only at
privy.ioor in the official rescue tool, and don't share it with anyone.
#Gas sponsorship means no MATIC to manage
On-chain gas for normal trading is sponsored — wallet setup, approvals, conversions and withdrawals go through a gasless relayer — so you never need to fund your wallet with MATIC/POL to place orders or approve tokens. Fewer steps also means fewer chances for a transaction to get stuck. (See Fees.)
#Collateral auto-wrap
Trading collateral is wrapped from USDC.e into pUSD automatically in the background — when a deposit arrives, or when you place an order if any USDC.e is still unwrapped. You don't sign a separate transaction for each wrap, and the conversion stays inside your own wallet: it only turns USDC.e into the collateral your wallet uses to trade.
#24/7 copy trading uses a restricted server signer
Live copy trading and automated trading need to place orders even when your browser tab is closed. BOOPOLY does this without ever holding your key: you authorize a server signer through Privy's Key Quorum + Policy system, and Privy's secure enclave checks every signing request against that policy before signing.
The policy allows only these actions:
- Polymarket order signatures, restricted to Polymarket's exchange contracts on Polygon — used to place your copy trades and automated orders.
- Batch operations on your own deposit wallet, restricted to deposit wallets registered with BOOPOLY. These run auto-wrap (USDC.e → pUSD) and auto-redeem of settled winnings. The list of registered wallets is pinned in the policy and re-synced every hour.
Any other signing request is refused by Privy. Token approvals needed to trade are set once in your own browser, during trading setup.
Your controls:
- Pause or stop at any time. Pausing a copy trade, or stopping an automated run, stops the server from placing orders for it.
- Set risk limits for each copy trade in Copy Trading Settings.
- Keep self-custody. You can export your key and withdraw your funds at any time, with or without 24/7 trading turned on.
A batch is a list of calls your deposit wallet executes, so the policy's protection lies in limiting which wallets and which contracts the signer can be used with, while BOOPOLY protects access to the signer on its servers. As with any server-side signing, these measures reduce risk rather than remove it. Removing the signer authorization itself is not yet available as an in-app control; pausing your copy trades and automated runs stops all server-placed orders.
Note24/7 trading places real orders on your behalf, and trades can lose money. Enable it for strategies and traders you understand, and set your risk limits before you start.
#If BOOPOLY is ever unavailable
Your funds do not depend on BOOPOLY's servers. The open-source boopoly-rescue tool runs on your own computer, talks directly to Polygon, and moves your USDC to any wallet you choose.
- Requires: your exported private key, and about 0.12 POL on your sign-in wallet (EOA) for gas — the full rescue is roughly 8–12 transactions.
- Takes: about an hour, because of a safety timelock built into the Polymarket contract itself (not a delay BOOPOLY added).
#Recommended practices
- Secure your login account. Your BOOPOLY/Privy login is how you reach your wallet — protect that email or social account with a strong password and two-factor authentication.
- Keep your exported private key private. BOOPOLY will never ask for it.
- Back up your key if you want a self-custody safety net, and store the backup offline.
- Use Withdraw USDC in the account menu for normal cash-outs; keep the rescue tool as a backup.
- Review your 24/7 copy trades from time to time and pause the ones you no longer use.
- Start in simulation when trying copy trading, so you can learn the mechanics before using real funds.