Polymarket's smart contracts have been audited by Quantstamp. We will continue to audit and battle test our contracts in the future, but note that an audit does not guarantee that a project is foolproof.
Where are my funds if you don't use MetaMask?
All of your USDC and market shares are securely held in a blockchain wallet. This wallet can only be accessed by the owner of the email with which it is linked. Polymarket has no access to these funds. All funds would remain in your wallet, and you will be able to retrieve them using your email address. You can read more here.
Why does Magic Link need my email?
Magic Link links your email to provide you with an Ethereum Wallet that is unique to you. They are a trusted and audited solution. Read more about their security here.