Privacy
What Skarb knows about you, why, and how to make it forget. Written to be checkable against what the code actually does.
Version of 25.10.2026.
Who is responsible for the data
Skarb (skarb.dev) is responsible for the data: it decides what is kept and why, and answers for it. Questions and requests about your data go to [email protected] or to the bot @nickcatinvestbot.
What is stored
Signing in with Telegram — your Telegram id, first name, surname if you have one in Telegram, username and language: the bot already knows them, and the first sign-in creates the account from them. Signing in with Google — the Google account's id, its e-mail and whether Google verified it; nothing else is taken from Google. There is no password. Phone, birthday and gender are kept only if you gave them in the profile. They count towards nothing: you see them, the owner of Skarb sees them in the user's card, and the export of your data carries them. And then only what you put in: broker and exchange connections, imported trades and trades typed by hand, cash movements, assets off the exchange typed by hand — their kind, name and amount, and a deposit’s rate and end date — the futures history of the exchanges you connect — positions with their side, leverage, prices and times of opening and closing, the Bybit fills they are put together from, closed positions' results, commissions and funding — their spot journal: trades, conversions, deposits and withdrawals with the transaction hash, Binance P2P orders — the coin, the amount and the time, without the other party or the payment method — Earn rewards, and a lot's price if you set it yourself — the watchlists with the names of the lists if you gave them any, alerts, quiz results, your settings, the names of your portfolios if you gave them any, the filters of the screener and the views of the market map you saved, with their names, the assets you last opened from the search, and the key of a public portfolio's link while it is on. Passkeys are stored as public keys, which cannot be used to sign in anywhere else. From an IBKR report Skarb takes the trades, the cash movements, the transfers, the corporate actions, the holdings and the account’s cash. From the Account Information section Skarb takes only the day the account was opened: it neither reads nor keeps the name, addresses, email or date of birth there, even where they are ticked in the query. The IBKR report itself is stored nowhere. A sign-in is remembered with where it came from: the browser and the system, as the browser itself reports them, and the approximate place — the city and country Cloudflare puts the address in. The sign-in record holds no address: Skarb keeps it only in the server's memory, to limit how many sign-in codes one address can ask for and how many requests it sends from the bot's mini app. You can see all this in the settings, in the list of sessions, and the bot tells you about every Telegram sign-in and every new passkey at once — a sign-in or a key that isn't yours should not go unnoticed. The exception is Skarb’s own account for the reviewers of Claude’s connector directory: it is entered with a code, a session lasts a day, and the address of every sign-in is written to a log the owner of Skarb sees. A sign-in with Telegram and a link of Telegram to an account are confirmed by a code from the bot: the code lives two minutes and is kept nowhere — Skarb remembers only to whom and when it was given. After a link the bot tells that Telegram which account it was linked to — the e-mail masked, like an***@example.com — and a button in the bot unlinks it. The trade check and the asset score in the bot's mini app ask Skarb directly: Telegram's signature says who you are, and Skarb takes only your Telegram id and language from it and keeps none of it. An alert from the bot's mini app can be set without a Skarb account. It is then kept under your Telegram id with the mini app's language — so the bot knows whom to write to and in which language — and moves to your account once there is one. An opening of the breakdowns feed in the mini app is recorded — your Telegram id, where it was opened from and when, at most once an hour — so the bot's dashboard can show how many people read it. The investor's diary holds your entries about assets: the asset, your stance, the text, a link if you gave one, the reminders and the closing price on the day of the entry. An entry from the bot's mini app can be made without a Skarb account: it is then kept under your Telegram id and moves to your account once there is one. A deleted entry loses its text and link at once; a row without words stays — the asset, the stance and the time — because the day's limit counts deleted entries too. An opening of the diary in the mini app is recorded the same way as an opening of the feed. Skarb takes Tribute payments itself. Tribute sends your Telegram id, username, the product's name, the amount, the currency and how long it is paid for, and Skarb keeps the payment record, the plan bought and the subscription to the closed channel — to know which plan you have and until when the channel is paid. If you bought one of the bot's paid courses, or were given one by hand, that is kept too — your Telegram id, the course and when — so the bot opens the course to you; once a purchase is refunded, its line is deleted. Once a day this is checked against Tribute's own list of subscribers. No card details are in any of it. A plan the owner of Skarb gives by hand is kept the same way — its period and a note on why it was given. A bank statement you send the bot or upload on the site to count a FOP's taxes is read by Skarb and forgotten at once: the file is written to no database, log or cache, and the bot or the page gets the count alone. For income on a currency account Skarb asks the NBU for its rates — the currency and the days only, no amounts or names. A statement is counted for whoever has an account in Skarb. The FOP group a statement is counted for is kept in your profile: the one you set there or picked in the bot or on the site. A search of the investor's glossary that found no term is written down, so Skarb sees which terms are missing: the search, its language and time — with your account if you are signed in, with your Telegram id in the bot, and without signing in on the site with a hash of your address from which the address cannot be told. No more than 20 searches a day from one person, kept 180 days.
Broker and exchange keys
Exchange and Freedom24 keys are sealed with AES-256-GCM. The master key lives in the server's environment and is not in the database: a stolen database dump is a pile of ciphertext. The key you give should be read-only, with no trading and no withdrawal rights. Skarb never sends an order and never moves a coin. Skarb asks Binance, BingX and Bybit what the key may do on every sync: if it can trade or withdraw, the connection shows a warning. Backpack and WhiteBit do not say. Freedom24 is the exception: it has no read-only keys, and its key can trade and withdraw money. So it is taken only with your explicit consent on the connect screen, and Skarb sends Freedom24 just two read commands with it — the broker report and the positions; the code sends no other command. Every time a stored key is read, it is written to an audit record. Revoking a connection deletes the key — there is no archived copy.
Why
To show you your own portfolio, and nothing beyond that. Your data is not sold, not shared with advertisers, and not used to train anything.
API and MCP
An API token is stored only as its SHA-256 fingerprint — Skarb cannot show it again. Stored with a token are its name, scopes, expiry, the address it was made from, and when and from which address it was last used; making it, revoking it and its first request from a new address are written to the log, and the day’s number of requests to the daily counters. An address that sent more than twenty wrong tokens in ten minutes is shut out for an hour, and that is written down too. Trades and cash movements sent over the API are stored like the rest of your data, on the same server in the European Union, and are deleted with the account. Through MCP an AI agent gets what it asked Skarb for: holdings, scores, alerts, diary entries. Those answers go to the AI provider you connected yourself — Anthropic, Cursor or another — and from there live by its rules; Skarb has no say in that. Skarb itself does not record what the agent asked or what it got: only the number of calls a day and when the token was last used are kept. If a tool breaks, the error itself goes to the error log, as with any failure of the site.
Where it is
On a server in the European Union, with Cloudflare in front of it. Daily backups go to storage that is also in the EU and are deleted after 90 days. Broker keys stay sealed in them, and sessions and tokens are kept as hashes only.
Who else sees something
A portfolio you made public in the settings opens without signing in for anybody who has its link: the names of the assets, their shares, the profit in percent of what was paid, the score, the signal and the health score — no amounts, no prices and not your name. The link is closed to search engines; switch it off and it stops opening, switch it on again and there is a new one. Telegram — the bot delivers sign-in prompts and alerts; it sees your Telegram id and the text being sent. An entry written in the bot's mini app comes to you in the bot as a card, with your whole text and link, so the bot sees them too. Before a sign-in it is given the browser and the approximate place it started from, to show them to you. The pictures the bot sends — the calculator card and the course certificate — are drawn by Skarb: the bot sends the numbers, the finished lines and, for a certificate, your name from Telegram. Neither the picture nor the name is stored or logged. The suggestions in the diary's form are the assets written about most in everybody's entries over 30 days: an asset gets there only once at least three different people wrote about it, and only its ticker is shown — no counts and no names. The entries themselves are shown to nobody but you. Resend sends the e-mails with confirmation codes to people with no Telegram: it sees the address and the text of the e-mail with the code. When you sign in with Google, Google sees that you sign in to Skarb. Market data providers see which tickers are asked for, not who asked. The logo on an asset’s card is loaded by your browser straight from Brandfetch: Brandfetch sees your IP address, the ticker or ISIN, and that the request came from skarb.dev. Brokers and exchanges see the read-only key you gave them. Payment for a subscription goes through Tribute in Telegram, by card through Paddle or in crypto through NOWPayments, and Skarb never sees your card or your wallet. Paddle sells the card subscription in its own name: it takes your email, country and card, works out the tax and makes refunds itself. Skarb hands it the plan, the price and the numbers of its order and of your account, and gets back whether it is paid, until what day, and whether it was refunded. Skarb hands NOWPayments the amount and the order's number, and gets back the payment's status, amount and coin.
Analytics
PostHog, EU region. PostHog keeps nothing in the browser — no cookie and no local storage: before sign-in every visit is new to PostHog; after it, visits are linked by Skarb's internal id — not the Telegram id, not an email — and the plan is the only thing sent with it. Session recording is off until the site asks for consent to it. Automatic capture is off, because it would record the text of whatever was clicked — in this application that text is somebody's money. What is sent is named events: which screen was opened — by its kind, not by the address that holds the ticker; a broker was connected and how a sync ended; which indicators were switched on; a trade check was started and the light it ended on; an SEC filing was opened — from where: the card, the dashboard or the report materials — and which exhibit of a report was read: the press release, the presentation or another; the plan changed. Events carry no amounts, tickers, company names, wallet addresses or account names — only the asset class, flags and codes. Failures go to the same place: what broke and on which screen, never what it was about. This is what stands in for a separate error service; the server and the browser report them the same way.
Cookies and the browser
Skarb sets only its own cookies — no advertising or third-party ones — and only to sign you in: the session (skarb_session) for 30 days, and, for the minutes a sign-in takes, skarb_login, skarb_google and skarb_webauthn. You cannot sign in without them, so Skarb does not ask for consent to them. The browser's storage keeps the language and the interface's conveniences — favourite screens, table columns and sorting, whether screens show their descriptions. For someone signed in the conveniences are kept in the account too, to be the same on every device. Paddle.js loads only on the “By card” button, and Paddle's payment window works under Paddle's rules.
How long
While the account exists. A sign-in session expires by itself after 30 days and is deleted together with its device and place, a sign-in code lives two minutes, a one-time sign-in link the owner of Skarb issues when the bot does not answer lives an hour and works once, a revoked connection is deleted at once, audit records of no account — a deleted one, or an app's sign-in that never reached an account — after 180 days, and a backup holding deleted data is gone within 90 days. The bot's /forget command also erases what Skarb keeps under your Telegram id without an account: payments and plans, the channel subscription, alerts, diary entries, trade checks and glossary searches not found from the mini app, feed and diary openings and the day's counters. A payment record stays without the Telegram id — it is a line of the channel's revenue.
Your rights
You can ask for everything Skarb holds about you, for a correction, or for the account and all of it to be deleted. Write to the bot @nickcatinvestbot or to [email protected]. Deletion means deletion — the account, the trades, the keys and the history go, what is left in a backup ages out within 90 days, and the audit records within 180.
Not investment advice
All content reflects the author’s personal opinion and is not financial advice. The author is not responsible for your investment decisions. Any investment involves the risk of partial or total loss of capital. The calculators are models rather than forecasts.