Security at CandleOdds
How your money and your account are protected, in plain language.
We can never withdraw your funds
Your money sits in your own wallet on the Polygon blockchain, not with us. Nobody at CandleOdds can move it or withdraw it.
You can protect withdrawals with two-factor (fingerprint, Face ID or an authenticator app) in Wallet → Security.
Learn more
The key that controls your wallet is created and protected by Privy. Your key never reaches our servers. Every withdrawal, and every trade you place yourself, is approved by your own wallet in your browser.
If you turn on CandleOdds Auto, you give CandleOdds a limited permission to place buy orders on Polymarket for you, within the limits you set. That permission can't withdraw, send or move money, and you can remove it at any time.
Everything settles on Polymarket and the blockchain
Every trade happens on Polymarket and settles on the Polygon blockchain, so you don't have to take our word for anything.
Learn more
Your fills, settled trades and wallet each link to their real records on Polygonscan and Polymarket, from the Positions and Wallet screens.
What we do
Encrypted connections, strict checks on every request, least access for every part of the service, and regular security reviews.
Learn more
- Encrypted connections. Everything between your device and CandleOdds is encrypted, and your browser is told never to connect to us any other way.
- Strict checks on every request. Our servers only pass on the kinds of requests the app needs, only for your own wallet, and limit how often they can be made to stop abuse.
- A locked-down website. Your browser only runs the code we serve, and CandleOdds can't be hidden inside another website to trick you into clicking.
- Least access. Each part of our service gets only the access it needs to do its job, and nothing more.
- Regular security reviews of our code and infrastructure, with issues fixed and re-checked.
- Two-factor authentication on the accounts we use to run CandleOdds.
We will never ask for your private key or seed phrase
Nobody from CandleOdds will ever ask for your private key, seed phrase or login code: not by email, chat, phone or social media. Anyone who asks is trying to take your money.
Your key is only ever shown in Privy's secure window, when you choose Export private key under Wallet → Security. Never type or paste it into a website, and only enter your email login code on candleodds.com.
The only official site is candleodds.com
Before you sign in, check that the address bar shows candleodds.com.
Learn more
Watch out for lookalike addresses, ads and links in messages that lead somewhere else. Bookmarking the site is the easiest way to always land on the real one.
Found a security issue? Tell us
Email security@candleodds.com with what you found and how to reproduce it. We'll reply, keep you updated while we fix it, and credit you if you'd like.
Please don't access other people's accounts or funds, disrupt the service, or share the issue publicly before it's fixed.
Last updated October 2026