Your funds never leave your exchange.
This page explains, in plain English, exactly how Daily Trade interacts with your money — and exactly what we cannot do, even if we wanted to.
The core promise
When you create your API key, you disable withdrawals. From that point on, Daily Trade can place buy and sell orders on your behalf, but we cannot move funds out of your exchange. Period.
1. What permissions Daily Trade needs (and doesn't)
On Bybit and Binance, every API key has independent permissions. The bot needs only two — and you should explicitly disable all the rest.
✓
Spot trading — REQUIRED
So the bot can place limit buy and sell orders on BTC/USDT.
✓
Read account info — REQUIRED
So the bot can see your balance and confirm fills.
✕
Withdrawals — MUST BE DISABLED
This is the most important toggle. The bot does not need it. Leave it OFF and Daily Trade physically cannot move your funds.
✕
Futures / margin / derivatives — NOT NEEDED
The bot is spot-only. Leave these off too — no leverage means no liquidation risk.
✕
Sub-account transfers — NOT NEEDED
The bot only places orders on the main spot account.
2. How your API key is stored
When you paste your API key + secret into Settings, here is exactly what happens, in order:
- Sent over HTTPS. Encrypted in transit using TLS (Let's Encrypt certificates). No plaintext over the wire, ever.
- Immediately AES-256 encrypted using
openssl_encryptwith a server-side master key. The plaintext API key is never written to disk. - Stored encrypted in our database. If our database were stolen, the attacker gets ciphertext, not your keys.
- Decrypted only in-memory inside your bot's isolated process, on a separate server, only when the bot needs to place an order.
- Erased on process exit. When you disable the bot or it restarts, the decrypted key disappears from memory.
What this means in practice: Even the founder of Daily Trade does not have a plaintext copy of your API key. There is no "master spreadsheet." The encryption is one-way from our side — we can decrypt only inside the running bot process.
3. How we run your bot
One process per user, per exchange
Each user's bot runs in its own isolated operating-system process on a dedicated VPS. Your keys live in your process's memory only — they never enter another user's environment. If one user's process crashes, no one else is affected.
The bot is dumb on purpose
The bot does exactly one thing: place limit orders at fixed price levels around an anchor price, and replace them when they fill. It does not chase trends. It does not "predict" the market. It does not have an "AI brain" making creative decisions. The simpler it is, the easier it is to audit.
Emergency exit
If BTC drops more than 8% below the anchor price, the bot triggers an emergency exit and stops placing new orders. This is a safety mechanism — not a guarantee against loss, but a hard floor that limits the damage in a strong downtrend.
4. Account & password security
- Passwords: bcrypt-hashed on signup. We cannot read your password. We never email it. If you forget it, you'll need to reset it.
- Sessions: HTTP-only secure cookies. Session tokens expire automatically.
- Audit log: Every account-level action (login, key save, bot enable, settings change) is logged with IP and timestamp. You can request a copy of your audit log at any time.
- 2FA: Not yet on Daily Trade itself, but your exchange account should have 2FA enabled. That's the layer that matters most — without exchange 2FA, an attacker with your password could create a new API key with withdrawal permissions outside of Daily Trade entirely.
5. What we cannot protect you from
Being honest: no system is risk-free. Here are the things outside our control:
- Market losses. If BTC crashes, you lose money even with a correctly-functioning bot. The bot does not — and cannot — predict the market.
- Exchange failures. If Bybit or Binance has an outage or freezes withdrawals, that's between you and the exchange.
- Your own password reuse. If you use the same password on Daily Trade as on a hacked website, attackers can log into your account. Use a unique password.
- Your own exchange security. If your exchange account itself gets compromised, no setting on our side helps. Enable 2FA, anti-phishing codes, and IP whitelisting on the exchange.
6. Reporting a security issue
If you find a bug, vulnerability, or anything that looks suspicious in Daily Trade, please email info@daily-trade.app. I read every email personally and treat security reports with priority.