PIN, biometrics and safety

Two different kinds of safety matter here, and confusing them causes losses. One is about your device. The other is about the blockchain, and it is permanent.

Step by step

Set a PIN you do not reuse. Four digits, gating the money screens on this device.
Turn on Face ID or a fingerprint. Faster, and no weaker — the PIN is still the fallback.
Hide the balance in public. The eye beside the figure on Home.
Add your email. It is the recovery path if your phone number changes.
Check the network before every deposit. This is the permanent one. The chain you send on cannot be undone by anybody.

What to expect

Signing out does not touch your money. It removes the sign-in from that phone; your balance, your history and your account are untouched. If you cannot get back in, create an account again to get into the app, then contact support with the number you first signed up with and roughly the amount you held.

Kpali never asks for a gift-card code, a PIN or a wallet phrase — not by email, not on WhatsApp, not on any social channel. The app has a screen for checking whether a handle claiming to be Kpali really is.

What goes wrong

Sending stablecoin on a network you did not select.
Sharing a gift-card code before redeeming it. It is a bearer instrument.
Reusing a PIN from a bank card.
Believing a message that claims to be Kpali asking for a code.

Why this matters

Two kinds of risk live in this app and they behave completely differently. Confusing them is what costs people money.

The first is device risk: somebody picking up your unlocked phone. The PIN and biometrics handle it, the balance can be hidden, and none of it is permanent — a lost phone is an inconvenience, not a loss, because the balance belongs to the account rather than the handset.

The second is chain risk, and it is absolute. A stablecoin transfer sent on a network you did not select is gone. Not delayed, not recoverable through support, not retrievable by the exchange that sent it. This is a property of blockchains, not a Kpali policy, which is why the warning sits above the address instead of below it.

Between those two sits impersonation, which is neither technical nor permanent but is the most common loss of all. Kpali never asks for a code, a PIN or a recovery phrase. Any message that does is not Kpali, however convincing the profile.

Finally, a word about what safety is not. It is not a padlock icon or a promise in a footer. It is a small number of specific behaviours: a PIN you do not reuse, an email you actually check, a network you verify before every deposit, and a refusal to give anybody a code no matter how convincingly they ask. Those four cover almost every way people lose money on a product like this.

What you will see

Real screens follow, taken from the app rather than assembled for marketing. These are the screens this page refers to when it says pin, biometrics and staying safe. Both the light and the dark theme appear, because the app follows your phone.

Kpali sign-in screen with Face ID and a four digit PIN (light theme)
Kpali sign-in screen in dark mode with Face ID and PIN (dark theme)
Kpali wallet with the balance hidden for privacy (dark theme)
Kpali network choice warning that the wrong chain cannot be recovered (light theme)
Kpali help answering whether your balance is safe after signing out (light theme)

Questions

Is my money safe if I sign out?

Yes. Signing out removes the sign-in from that phone. It never touches your money, your history or your account.

I signed out and cannot get back in — what now?

If the app only shows a PIN, create an account again to get into the app, then contact support with the number you first signed up with and roughly how much you had. The original balance is restored.

Does Kpali ever ask for my PIN?

Never. Not by email, not on WhatsApp, not on any social channel.

What is the one irreversible mistake?

Sending stablecoin on a network you did not select. Nobody can undo it.

Can I hide my balance?

Yes — the eye beside the figure on Home.