Account and security

Sign-in

You sign in through Discord or Google (OAuth). They tell us which account you are; we keep the account id, name and picture, and the email address for Google accounts. We never get a password.

This means your Halolauncher account is exactly as safe as that Discord or Google account. Turn on two-factor sign-in there, and keep it to yourself.

Sessions

A sign-in lasts 30 days on that browser. One cookie holds it, readable by this site only, over https only. Signing out ends it on that browser. When an account is suspended, every sign-in of it ends at once.

How your keys are kept

• Your wallets are made on our servers, and their keys are stored encrypted.
• Every account runs in its own copy of the app, as its own system user: one account cannot read another account's files.
• Keys are used only for what you do on the site and for the rules you set: launches, buys, sells, claims and sends.

Not built yet

Some protections larger services have are still on the way. Until they arrive, plan around them:

• No two-factor code at sign-in on this site (your Discord or Google two-factor protects the sign-in).
• No email or code confirmation before a withdrawal: a send goes out as soon as you confirm it on the site.
• No key export yet. See Importing and exporting keys.