Account security
Protect your sign-in methods, verify transaction requests and keep wallet secrets out of support conversations.
Use the official app
Open Wallet at app.supanova.app. Check the full hostname before signing in or approving a request, especially when following a link from a message or search result.
For help, start from the supanova contact page. A direct message from someone claiming to be support is not proof of identity.
Protect account access
Secure the email, Telegram account and external wallets you use to sign in. Enable the additional protections offered by those services, and keep track of the sign-in methods already linked to your supanova account.
Never share a login code, password, private key or seed phrase. Support does not need these to inspect a transaction reference or understand an error.
Read each request
Before confirming, check:
- Which app is requesting the action.
- Which account and network it will use.
- The asset and amount.
- The full recipient Party ID.
- The fee and any memo or other submitted data.
Cancel a request you did not initiate or do not understand. Do not sign a payment or message simply because someone says it is necessary to fix your Wallet.
Preapprovals have a purpose
One-step transfer preapprovals let eligible incoming assets be accepted automatically. Review the instrument and any cost when enabling an available option. See transfers and activity.
Do not treat every signature request as an incoming-transfer preapproval. Read the action described by the app.
Private keys and recovery
The current Wallet interface does not provide a documented private-key export workflow. The developer SDK has separate, configuration-dependent export capabilities; that does not mean they are enabled in the Wallet app.
Do not rely on a future export feature as your recovery plan. Keep access to your linked sign-in methods and review account access before switching devices or accounts.
If something looks wrong
Stop approving requests. Check Activity for transactions you do not recognize and secure the affected sign-in method. Contact official support with the relevant references and times. Do not post authentication details or full private account records in public channels.