Security

How PollyPay is built, and how to tell us when it is wrong.

Report something

Email security@pollypay.uk with steps to reproduce. We reply within three working days. Please do not test against other people's pages or run denial of service tests. There is no paid bounty today, and we will credit you if you want that.

Non custodial by design

PollyPay never holds your money. There is no PollyPay balance to steal and no payout queue to freeze. The fee moves inside the same transaction that pays the creator.

Sign in

An emailed sign in link or a passkey. No passwords anywhere. Session cookies are opaque, stored only as a hash, marked Secure and HttpOnly, and expire after 30 days of inactivity or 90 days absolute. You can see and end every session from your settings.

Who holds the keys

A payout account made with your email is held by Privy, a company that keeps the key in pieces and only joins them in your own browser after you enter their code. PollyPay never has the key and cannot move your money. The way out is always open: Settings, Cash out lets you send the balance to any account you name, with no bank or card in between, and the public network accepts that transfer whether or not PollyPay exists. Key export as a file is not offered yet. If you use your own account instead, none of this applies; the keys were never anywhere but with you.

Changing where money goes

A payout address change needs a signed proof from the new address, an email to the address on file, a one hour delay with a cancel link, and it signs out every other session. This is the one change we deliberately make slow.

Screening

Payout addresses are screened against the OFAC list at signup and on every change, and the result is recorded. Signups from Cuba, Iran, North Korea and Syria are refused.

Content safety

Everything a person types is stored and rendered as plain text. Uploaded images are re-encoded and size limited. Pages carry a strict content policy header and cannot be framed except for the embed button, which carries no cookies and cannot sign anything.

Records

Every money and sign in change writes an append only audit record. Ask us for your own entries at security@pollypay.uk if you ever suspect a sign in you did not make.

Questions: hello@pollypay.uk. Abuse and impersonation: abuse@pollypay.uk. Security: security@pollypay.uk.