Who holds the keys
Every key in the system — yours, the treasury, the sponsor wallet, the referral account — who holds it and what it can and can't do.
Overview
Piconero is self-custodial: the only key that can move your balance is yours, and it lives in your browser. The app itself runs with a few keys and accounts of its own. None of them can sign for your wallet.
| Key | Held by | Where | Can | Can't |
|---|---|---|---|---|
| Your wallet key | You | This browser, encrypted by your passkey or password | Sign your trades, deposits and withdrawals | Be seen by the server; be recovered by us |
| Treasury key | The operator | A file on the operator's own machine — never on the server | Move treasury funds: buybacks, burns, referral payouts | Touch your wallet or your balance |
| Sponsor wallet key | The server | Server environment only (when the offer is on) | Send a small one-time SOL amount to a new wallet | Sign for your wallet; spend more than its own small balance |
| Referral account | The operator | Public address on the server; its owner key stays with the operator | Receive the app fee shown in the quote | Take more than the quoted fee; touch your wallet |
Your wallet key
- Created in your browser and stored there encrypted by your passkey (or password). The server never receives it — no route accepts a private key, seed or password.
- It signs every transaction locally, after a simulation. Nobody else can sign for you, freeze your balance or reverse a trade.
- We can't recover it. Your backup is the 12 words (or the private key for imported wallets) — see Wallet & security.
Treasury key
The treasury collects the app fee and funds buybacks, burns and referral payouts (see Token & flywheel). Its key is a file on the operator's own machine, used only by the payout scripts. It is never in the website's environment or on the hosting provider, so a server compromise can't reach it. It controls treasury funds only — not user wallets.
Sponsor wallet
A new wallet without SOL can't open its permanent bridge address. When the sponsored setup is on, a dedicated, low-balance server wallet sends that one-time SOL amount, and the app repays it in wXMR from your first deposit. The worst case if this key leaked is the loss of its own small balance; it can't sign anything for your wallet. It is never the treasury key.
Referral account
Swaps go through Jupiter with a referral account attached, so the app fee shown in the quote goes to that account's fee token accounts (one per token, e.g. wXMR and SOL). The server only knows the public account address; claiming the fees is done by the operator's wallet that owns it. The fee is part of the quote you see before signing — it can't be raised after you sign.
Keys held by others
- wxmr.io bridge — the wxmr.io team holds the native XMR behind wXMR (custodial). See Bridge & partners.
- Exchanges (ChangeNOW, SideShift, StealthEX) hold your funds for the minutes a swap takes.
- Your Monero wallet — its keys stay with you; the app only ever sees the address you withdraw to.