Security

Gully ID never asks for your seed phrase, recovery phrase or private key. Anyone who does is not Gully ID.

How to recognise the real Gully ID

• The address is gullyid.xyz, over HTTPS. Your passkey only works on this address, so a look-alike site cannot use it.
• Gully ID asks for a passkey, an email code, a Telegram or Farcaster confirmation, or a wallet signature of a readable sign-in message. Never for a password of another site, a seed phrase or a private key.
• A wallet signature to sign in never moves funds. Payments are shown as payments, with the amount, before you approve them.
• When an app that is not made by Gully Labs asks to sign you in, the consent screen names it and says it is a third-party app.

Report a problem

Found a vulnerability, or a site pretending to be Gully ID? Email [email protected] with the details (for a fake site: its address). We answer quickly and credit reporters who want it. Machine-readable contact: /.well-known/security.txt.

How we protect your account

• Passkeys instead of passwords; Gully ID stores only their public keys.
• Account recovery adds a new passkey only after a waiting period that every email on the account can cancel.
• Strict security headers, no third-party tracking scripts, and sign-in pages that cannot be framed by other sites.

More: Privacy · Terms · About Gully ID