Security and safety

What the app stores, what signatures mean, and how to keep your account safe.

What you sign

Action	What it is	Gas
Sign in	One typed-data message that links a browser signing key to your wallet	No
One-Click Trading	Approves a browser session key that can trade only, not move funds	No (relayed)
Orders, closes, cancels, leverage	Signed messages, relayed	No
Take profit / stop loss	A signed request to the TP/SL service	No
Deposit, withdraw, transfer	On-chain transactions from your wallet	Yes

Which actions cost gas:

No gas (relayed or signature only)	Costs gas in USDC (sent from your wallet)
Signing in Perpetual orders, market and limit closes Cancelling orders, including cancel all Leverage changes; switching margin mode needs no signature at all Approving One-Click Trading Take profit / stop loss requests Spot orders when the funds are already in your trading balance	Deposits, and token approvals for them Withdrawals Transfers to another account Spot orders funded straight from your wallet Revoking One-Click Trading on-chain

Applies to Arc Testnet. Arc Mainnet: Coming soon

Read every wallet prompt before you approve it. A trading action on RealTime never asks for your seed phrase.

What is stored in your browser

• Signing key and API credentials: sign-in stores a signing key plus an API key and secret in your browser, for 7 days with Remember Me, or 1 hour for this session only without it. Remove them on the Settings page (G then S), Signing Keys tab.
• One-Click session key: valid for up to 30 days. When you switch One-Click off, you choose between revoking the approval on-chain (costs gas) and deleting the key from this browser only, which leaves the approval valid until it expires.
• Preferences: your watchlist, slippage, colours and sound effects are stored in this browser. Notification preferences are saved to your account.

Use a browser profile only you can access. On a shared computer, untick Remember Me, and remove the signing key when you are done.

Stay safe

• Check the address. Only use the app at https://arc-testnet.realtime.exchange, and bookmark it.
• Never share your seed phrase, private key or API secret. Support will never ask for them.
• Check recipient addresses before a transfer, because transfers can't be reversed.
• Remember it's a testnet. Test tokens have no value; don't send real assets to testnet addresses.