What Crest can and can't do with your exchange

Crest's connection flow tells you exactly what to enable when you create the key — on Binance, "Enable Reading" and nothing else; on Bybit, "Read-Only" permissions only. Crest never asks for withdrawal or trade-execution scopes. It can see your trades. It cannot move your funds or place an order.

Your API key and secret are encrypted before storage, using Fernet (AES-128 in CBC mode, authenticated with HMAC-SHA256) — a standard, widely-used symmetric encryption scheme. The encryption key itself is held in server configuration, not in source code, and your exchange keys never leave Axrie's own infrastructure.

Crest never imports your trade history. Your journal starts fresh the moment you connect — nothing before that is pulled in, stored, or analyzed. That's not a limitation, it's the point: a pre-trade note and an emotional tag only exist for trades you made after connecting a mirror that's actually watching.

In the app: Profile → connected exchange → Disconnect. That confirms with you once, then deletes your stored key from Crest's servers entirely — it's not a soft toggle, the key is gone. You can also revoke the key directly from Binance or Bybit's own API management settings at any time, which works independently of anything Crest does on its end.

A self-serve account deletion flow isn't built yet — right now, deleting your account and data means emailing support@tradecrest.co and we'll remove it manually. Disconnecting an exchange (above) does immediately and permanently delete that exchange's stored key on its own, independent of a full account deletion.

Crest is built by Axrie. Reach us at support@tradecrest.co.