Each key is encrypted before it is stored (X25519 + AES-256-GCM, bound to its wallet). The website can create and import wallets but cannot decrypt them; only the separate signing process holds the decryption key.
Good practice
- Use dedicated wallets for automation and keep only the ETH needed for gas and mints on them.
- Collect profits regularly with Treasury → Collect ETH / Collect WETH.
- Turn on two-factor authentication in Settings → Security.
Support will never ask for a private key or seed phrase. Messages that look like a seed phrase are blocked and not stored.