Data & privacy
Exactly what leaves your machine —and what never does.
RSForex Bot sends data for two jobs only: computing each XAUUSD decision, and proving your licence and device. Here is the precise list of fields, straight from the code that sends them — no more, no less.
- HTTPS everywhere
- Broker password never sent
- Login & IP stored as hashes
What leaves the machine
Three channels, and the exact fields on each
Everything that leaves your PC travels over one of these three channels — all over HTTPS to rsforexbot.com. This is the complete list.
- CH 01
The trading snapshot
Sent to the RSForex server on the trading cadence while the engine is ON
- Account number — your MT5 login
- Account holder name, as your broker records it
- Currency and leverage
- Balance, equity, and margin (used and free)
- Open positions — ticket, side, volume, entry price, stop-loss, take-profit, and running profit
- Up to 250 recent 1-minute XAUUSD bars — open, high, low, close, volume
- The gold symbol’s public market spec — bid/ask, spread, tick size, contract size
- CH 02
Closed-trade telemetry
Sent once, after a trade closes
- The ticket number
- The side — buy or sell
- The volume — lot size
- The profit or loss on the trade
- A win / loss flag
- CH 03
Sign-in & activation
Sent when you sign in, activate a key, or the app re-checks your licence
- Your email and platform password — your RSForex account, not your broker
- Your licence key
- A hardware fingerprint — a one-way hash of this PC’s Windows ID; the raw hardware ID never leaves
- Your MT5 account number, broker label (e.g. FTMO / OANDA), and server
- The symbol being traded (XAUUSD)
- A device name for your dashboard’s device list
What never leaves
The data that stays on your machine
These are the things the software is built never to transmit — true of how the code works, not just of a policy.
Never transmitted
- Your broker / MT5 trading password — the bot never asks for it and never sends it
- Your raw hardware ID — only a salted hash of it is sent
- Your raw MT5 login, IP address, or licence key — the server keeps these only as hashes
- Your funds — the software has no custody and cannot deposit or withdraw
- Anything else on your PC — files, screenshots, keystrokes, or other apps
How it’s protected
In transit and at rest
The identifiers that do leave are minimised, encrypted on the wire, and stored so a leak wouldn’t expose the raw values.
TLS
Encrypted in transit
Every call to the RSForex server goes over HTTPS (TLS) to rsforexbot.com. Nothing in the list above travels in plain text.
Salted hashes
Login & IP kept as salted hashes
Your MT5 login and IP address are stored only as salted one-way hashes (HMAC-SHA256, keyed with a server secret) — never the raw values.
Hashed key
Licence stored as a hash
The server keeps your licence key only as a one-way hash, so a database leak would never expose a usable key.
DPAPI
Local key is PC-locked
On your PC the licence key is saved only encrypted with Windows DPAPI — readable by your Windows user on this machine alone. Your password is never stored, in any form.
Localhost
One loopback control server
The app’s control server listens only on your own machine (localhost). It is not reachable from your network or the internet.
No custody
No custody of your money
The bot trades inside your own MT5 account. It cannot deposit, withdraw, or move funds — your money stays entirely with your broker.
The desktop app
How the app runs — honestly
No hidden background service and no surprises. Here is exactly what the app needs to do its job, and what it leaves behind.
Stays running
It has to stay running
The app must stay open for the bot to trade — minimised or in the background is completely fine. It never needs to sit in the foreground.
Fail-safe
Close it and new trades stop
Closing the app stops any new trades. Positions already open keep their stop-loss and take-profit at your broker, exactly where they were.
Opt-in
Autostart is opt-in
The installer does not add the app to Windows startup. Launching on boot is off by default — you turn it on only if you want to.
Stay awake
It keeps the PC awake while trading
While the engine is ON, the app keeps your computer from sleeping, so a nap can’t interrupt a live trade. It stops holding the machine awake when you switch off.
Uninstall
Uninstalling leaves two things
Removing the app deliberately leaves your licence store in %APPDATA%\RSForexBot and the Expert Advisor files in your MetaTrader folder — so a reinstall keeps your activation. Delete them by hand if you want them gone.
Installing it
Two ways to install — and the honest difference
Same app either way. They differ only in who signs the download, which changes whether Windows shows a warning.
Direct download
The direct .exe isn’t code-signed yet
The installer you download from the dashboard is not code-signed today, so Windows SmartScreen may warn that the publisher is unknown. That warning is expected — it reflects the missing signature, not anything the app does.
Microsoft Store
Currently in testing
A signed Microsoft Store build is in certification
The same app is packaged for the Microsoft Store, where it ships as a Microsoft-signed package — no SmartScreen warning, plus Store auto-updates. That build is currently in Store certification, not available to download yet; until it clears, use the direct .exe above. When it goes live, this page will link it.
Independent security audit: Not yet independently verified. The privacy claims on this page describe how the current code behaves; they have not been reviewed by an outside security firm. When that changes, this page will say so plainly.
The whole point, in one paragraph
Data leaves your machine for two reasons only: so the platform can compute each XAUUSD trade decision, and so it can prove your licence and device. It all travels over HTTPS. Your broker password is never sent; your MT5 login and IP address are stored only as salted hashes; your licence key is stored only as a hash; and the app’s control server never leaves your own computer.
RSForex Bot is trading software, not investment advice. These privacy and data-handling measures do not remove market risk, do not guarantee a profit, and do not guarantee any prop-firm challenge outcome. Trading gold carries risk, and you can lose money.
Data & privacy
See preciselywhat your bot sends.
Start a trial and watch it run in your own MetaTrader — the same data flow described here, on your own account. Or read the security overview first.