Security
Signing in keeps you signed in. Two-step verification, which you switch on yourself, asks for a second factor before any move of money. Your recovery key is the way back if you ever lose it.
Updated
On this page
What a signed-in session can do
You sign in with email or Google, and the session lasts 30 days, renewed quietly. Your Follow wallet signs every move of money from the browser without a confirmation window: a Follow, a Sell, a Withdraw to any address, and the cash yield moves. Follow’s own server never signs with your wallet. So without a second factor, whoever holds a live session, or your email account, holds your money. Two-step verification is the answer to both: the second factor is asked before the wallet’s key is used, and when the wallet is set up on a new device.
When it asks
Every action that uses the wallet’s key, including revealing the recovery key again.
A verification holds for 15 minutes on that device, so a run of actions asks once.
Browsing, portfolio pages and the rest of Account never ask.
It is yours to switch on, under Account → Security. Nothing changes for anyone who leaves it off.
The authenticator app
The second factor is an authenticator app: a six-digit code that changes every 30 seconds, kept on your phone or in your password manager. Google Authenticator, 1Password and the others all work, and the app never talks to Follow, so there is nothing on our side to take over. Codes by SMS are not offered: a phone number can be taken over at the carrier, which is how accounts protected by SMS are emptied.
Your recovery key
The recovery key is your wallet’s own secret, shown by Privy, which keeps the wallet, in a window of its own on its own origin, so neither Follow nor a script on this site can read it. Copy it as a 64-character key or as a 24-word phrase, whichever you prefer, and keep it in your password manager or on paper. Then confirm your backup: paste it back under Account → Security. It is shown in full there, so it can be written down from the page, and your browser checks that it opens your wallet address and sends nothing anywhere; only that it was confirmed, and when, is recorded. Confirm also overwrites your clipboard, so the key does not stay there; a clipboard history your system keeps is yours to clear. Two-step verification can be switched on after that, not before.
The key never changes, so it cannot be shown “once”: you can reveal it again whenever you need to, and once two-step verification is on, the second factor is asked first. Whoever holds the key holds the money, two-step verification or not. That is the nature of every self-custody wallet, and the reason the key is yours to keep and the whole thing stays opt-in.
If you lose your second factor
Nobody can lift a second factor you have lost: not Follow, and not Privy, whose design keeps it that way. The recovery key is the way back. Sign in as usual, which never needs the second factor, open Account → Security and choose Recover. Paste the key or phrase, name an address, and everything you hold moves there: each follow is sold through the usual sale, your cash at work comes back from the vault, and the wallet’s USDT is sent. Follow’s server runs the sale as it always does; the key signs the wallet’s part in your browser in place of the second factor. Nothing waits on anyone.
The sale costs what any sale costs, under Selling. The old sign-in keeps an empty wallet with the second factor still on it, so a fresh Follow account needs another email address; name its wallet as the address and you are back.
What Follow never asks
Follow asks for your recovery key or phrase in exactly one place: Account → Security, in the field that appears after you chose Reveal or Recover. Never in an email, a message or a reply, never on another page, and never for support. A page that asks for it anywhere else is not Follow, whatever it looks like.
What the site itself does
The two moments the key is typed into a Follow page last seconds at enrolment and minutes at recovery, after which the wallet is empty. In those moments the key stays in the tab: no server route accepts it, nothing logs or stores it, no analytics runs on it, and one small module holds it, kept sealed by a check that fails the build if it ever gains a way to send anything. The browser is told, by a policy the server enforces on every page, that this site may talk only to Follow, to Privy and to the networks’ own nodes, so even a script injected into a page could not carry the key off through the ordinary channels. No third-party script loads besides Privy’s. What no site can stop is someone persuading you to type the key elsewhere, which is why the rule above matters most.
Something unclear or wrong? Tell us.