Built for transparency. Designed for user control.

ProjectDCA can create or import blockchain wallets for use with automated DCA strategies. Where private keys are stored by the service, they are encrypted before being written to the database.

The application uses a dedicated wallet-encryption secret supplied through protected server environment variables. Each encrypted entry includes a unique initialization value so identical private keys do not produce identical stored records.

• Private keys are not intended to be stored in readable plaintext inside the database.
• Wallet credentials are decrypted only when required to create a wallet signer and execute a requested transaction.
• A newly created wallet’s private key is displayed to the user so it can be recorded securely.
• ProjectDCA does not ask users to post private keys or seed phrases in the Telegram community.

Sensitive application configuration is intended to remain in Railway environment variables rather than being written directly into public website files.

Railway restarts and deployments are handled with shutdown logic intended to stop active timers and the Telegram bot cleanly before the application process exits.

Stripe subscriptions

Stripe hosts the subscription checkout and processes supported card payment information. ProjectDCA does not need to store full card numbers or security codes.

Stripe webhook requests are checked using the webhook signing secret before ProjectDCA accepts an event as authentic.

• Completed checkout sessions carry the Telegram user ID and plan name required to activate the correct account.
• Subscription cancellation or pause events can move the account back to the Free plan.
• Live Stripe API keys and the webhook signing secret remain server-side.

Cryptocurrency payments

ETH and USDC payments are confirmed using public transaction data on Base. Payment requests use an exact requested amount so the service can match a confirmed transfer to the pending Telegram account.

Crypto payment access is time-limited and tracked separately from recurring Stripe subscriptions.

DCA purchases and wallet funding transactions occur on Base. Blockchain transactions can be independently reviewed through a public block explorer using the wallet address or transaction hash.

• Wallet addresses are visible on-chain.
• Transaction amounts and gas usage are publicly recorded.
• Token transfers can be reviewed through Base block explorers.
• Users can independently confirm whether a transaction succeeded.

ProjectDCA is designed to let users determine how their strategy operates rather than automatically choosing investment decisions for them.

Encryption and access controls reduce certain risks, but they do not eliminate all possible failures. ProjectDCA depends on several external systems that may experience outages, vulnerabilities or unexpected behaviour.

• Telegram availability and account security.
• Railway hosting and database availability.
• RPC-provider accuracy, uptime and rate limits.
• Base network performance and transaction finality.
• Uniswap contracts, pools and liquidity.
• Third-party ERC-20 token contracts.
• User device and browser security.

ProjectDCA has not been presented as independently audited. Users should not assume that the service, its wallet handling or its transaction logic has received a formal third-party security audit unless that is explicitly announced in the future.

• Start with a small amount and confirm the strategy works as expected.
• Verify the token contract address and pool ID before starting DCA.
• Use ProjectDCA wallets only for automation, not for primary savings.
• Store any displayed private key offline in a secure location.
• Never share a seed phrase or private key with support members, administrators or community users.
• Protect the Telegram account with a strong password and Telegram two-step verification.
• Review active bots, wallet balances and recent transactions regularly.
• Stop the bot immediately if transactions or balances appear unexpected.
• Confirm the withdrawal address carefully before moving funds.
• Avoid following token addresses or support instructions sent by unknown private accounts.

ProjectDCA is under active development. Potential future security and account-management improvements may include:

Planned items are not guarantees and may change based on development priorities and technical requirements.

Report suspected security issues, unauthorized account activity or suspicious ProjectDCA impersonators through the official Telegram community.

Do not include private keys, seed phrases, complete payment information or other secrets in a public support message.