What TheBotAnalyzer sees of your account
The question deserves a precise answer rather than a general promise. Here is exactly which data travels, in which direction, and what is structurally impossible.
No broker credentials
We ask for neither your MetaTrader password, nor your investor password, nor any access to your client area. TheBotAnalyzer never connects to your broker: it does not even know its server address other than as a string your terminal declares to it.
Two modes, two levels of exposure
Report analysis
You drop in a file you exported yourself. It is read, its transactions extracted, then kept for thirty days and deleted. Nothing links that file to your trading account beyond what the report already contains.
Live bridge
Your terminal sends the account state and closed transactions. The direction of communication is always that one: your machine speaks, our server listens and answers with a queued command, if any.
The account token
Every connected account holds a randomly generated 48-character token. It is the only shared secret. It authorises two things: sending data to that TheBotAnalyzer account, and fetching pending commands for that account.
It grants access to no other part of your workspace: not your report analyses, not your other accounts, not your profile. You can regenerate it at any time from the account page; the old one stops working immediately.
What commands can do
The protocol contains exactly six commands: suspend a robot, resume it, close positions, close a symbol's positions, test the link, update the configuration.
Opening a position is not among them. This is not an option disabled by default nor a permission setting: the command does not exist in the protocol, and the bridge Expert Advisor has no code to interpret it. Every executed command is logged and visible on the account page.
Your data
- Passwords are hashed with PHP's default algorithm, never stored in clear and never reversible.
- Sessions use HttpOnly and SameSite=Lax cookies; over HTTPS the Secure attribute is added.
- Every form carries an anti-CSRF token verified server-side.
- No data is sold, rented or passed to any advertising third party.
- Account deletion is immediate and erases imported files.
The public directory
A robot appears in the directory only if its owner explicitly made it public, and only in aggregate form: average grade, median drawdown, median profit factor. An entry is published only from three distinct owners onward, so that no statistic can be traced back to one person.