Read-only, by design
Pond only ever takes read-only access to a wallet. It never holds keys and never moves assets.
Pond Link asks a user for a public address and, where an app needs proof of ownership, a signed message. Pond never receives a private key or seed phrase and cannot sign transactions or transfer assets. Every connection is visible to the user in Pond Permissions and can be revoked at any time, which stops all further reads. Production access requires a completed company and application profile.