Security and payments
In short: Qubo only reads public market data and the transactions you type in yourself. It never connects to your exchange, never holds or moves crypto, and never sees your full card number.
1. Your funds
- Non-custodial: Qubo never asks for your private keys or recovery phrases (seed phrases), and never connects a wallet. You record your purchases and sales by hand, or connect an exchange in read-only mode: a Hyperliquid public address, or a Binance, Kraken or Coinbase API key with reading permission only. Any key that can trade, transfer or withdraw is rejected when you add it. Keys are encrypted in our database with a master key kept in a separate vault, are used only by our servers and are never shown again; you can delete them at any time.
- Read-only: you can add public wallet addresses (Bitcoin, Ethereum, Solana, Arbitrum, Base). Qubo only reads their balances from public blockchain data; a public address gives no way to move funds.
- Qubo therefore has no technical way to hold, move or withdraw your crypto, or to place orders on your behalf.
- The whale tracker follows public blockchain addresses. Watching an address gives no access to it.
2. Payments
- Subscriptions are collected by Airwallex, a licensed payment provider certified PCI-DSS Level 1, the highest card security standard. You enter your card on Airwallex’s secure checkout page, not on Qubo.
- Qubo never receives or stores your full card number. Airwallex applies 3-D Secure verification when your bank requires it.
- Prices are shown excluding taxes; any applicable taxes are shown before payment. Paid plans renew automatically until cancelled; you can cancel at any time from your profile, and you keep access until the end of the paid period. The terms of use describe the right of withdrawal and refunds.
3. Your data
- Your account, portfolio and preferences are stored in a database hosted in the European Union (Ireland), encrypted at rest and in transit (HTTPS).
- Each account can only read its own data: access rules are enforced by the database itself (row-level security), not only by the app.
- Passwords are stored only in irreversibly hashed form. Nobody at Qubo can read them.
- No advertising inside Qubo, no audience measurement, no sale of data. The only advertising tracker, the Meta Pixel, stays off unless you accept it in the cookie settings.
- You can delete your account and all your data at any time from your profile. Details in the privacy policy.
4. Your account
- Choose a unique password that you do not use elsewhere.
- Qubo will never ask you for your password, a verification code, a seed phrase or a payment by email, message or phone.
5. Phishing and impersonation
The only official website is asterio.app, and the only support address is support@asterio.app. Qubo never asks you to send crypto, never offers guaranteed returns and never manages money for anyone. Any message claiming otherwise is a scam: please report it to us.
6. Reporting a problem
If you find a security issue on asterio.app, write to support@asterio.app with the details. We reply as quickly as possible and do not take action against good-faith research.