Account and authentication data
We store your email address, a salted and peppered password verifier, and one-way verifiers for sessions and research API tokens. Full API tokens are displayed only when created. Token names, prefixes, creation times and revocation status are retained so you can manage your integrations.
Private research
Asset-analysis requests, job status, reports, source limitations and usage records belong to your account. Requests may be processed by configured market-data and model providers. Do not include confidential information in requests. Private client reports are not inputs to the public daily research blog, which uses a separate editorial account.
Cookies and analytics
A first-party session cookie is required for sign-in. It is HttpOnly and uses Secure and SameSite protections in HTTPS deployments. The client account excludes third-party analytics scripts. Public website pages may load the configured Google Tag Manager container; its downstream tags and consent configuration depend on the deployed website. We do not describe public analytics as cookie-free.
Security and retention
We keep account, security and usage records to operate access, enforce quotas and investigate incidents. This version has no automatic account-deletion or fixed-retention workflow. You can revoke API tokens and sign out in the account. To request access to or deletion of your records, contact privacy@killbot.cash. Requests are handled by the team; no immediate self-service deletion is promised.