Security and privacy
Your trades never become our data.
You provide an exchange key. This page documents every connection, permission and storage boundary before you install anything.
- No vendor backend
- There is no NextScalp backend for the Journal. Nothing to send your trades to, nothing to breach.
- Read-only exchange access
- Trading, transfer and withdrawal permissions are never used, and the setup check warns you if your key has them.
- One connection in laptop mode
- On a laptop install there is one outbound connection in total: your exchange.
Every connection that leaves your server
This is the complete list. Nothing else is contacted at runtime. Fonts are compiled into the build rather than fetched from a CDN, the framework's own telemetry is switched off in the Dockerfile at both build and run time, and there is no error reporting service and no update ping.
| Destination | When | What it carries | Laptop install |
|---|---|---|---|
fapi.binance.com or api.bybit.com | Continuously, to import new fills | Signed read requests. No order or transfer calls. | Yes |
oauth.telegram.org | Only while you sign in | An OpenID Connect code exchange. No trade data. | Not used |
api.telegram.org | Only when a price alert you created fires | Your Telegram id and the alert text: a symbol and a price. | Not used |
api.anthropic.com | Only when you click an AI action | The trade or period you selected, sent with your own API key. | Optional |
The last three are avoidable. Set LOCAL_MODE and the journal runs on your laptop with a loopback sign-in and no Telegram at all - startup validation refuses to boot unless BIND_ADDR really is 127.0.0.1, so that mode cannot accidentally be reachable from the network. Leave ANTHROPIC_API_KEY empty and every AI feature is off, with no request ever made.
What the exchange key is allowed to do
The journal reads closed positions, fills, funding and public market data. That is the whole surface.
| Permission | Required |
|---|---|
| Read futures trades and fills | Yes |
| Read funding and income history | Yes |
| Place or modify orders | No |
| Withdraw funds | No |
| Transfer between accounts | No |
| Read your spot or margin balances | No |
Rather than take that on trust, here is the complete set of exchange endpoints the application can call. Every one of them is a read:
Binance /fapi/v1/userTrades closed fills /fapi/v1/income funding and fees /fapi/v1/exchangeInfo symbol metadata /fapi/v1/premiumIndex mark price /fapi/v1/ticker/* public prices Bybit /v5/execution/list closed fills /v5/position/closed-pnl closed positions /v5/market/* public prices, klines /v5/user/query-api your key's own permissions
That last endpoint exists for one reason: bun run doctor asks your exchange what your key is actually allowed to do and tells you off if the answer is more than reading. On Bybit it reads the key restrictions directly, on Binance it checks the API restriction flags. A key with withdrawal rights will boot and work, and the check will keep telling you it should not have them.
Where each thing lives
| Data | Stored in |
|---|---|
| Fills, trades and market context | Your Postgres |
| Journal notes and psychology notes | Your Postgres |
| Chart screenshots you paste in | Your Postgres, as bytes in a table |
| Discipline rules and price alerts | Your Postgres |
| AI analyses and coach reviews | Your Postgres |
| Exchange keys, database URL, secrets | Your server environment, never the database |
| Your session | A signed cookie in your browser. There is no session table. |
| Your licence key | Your installation, plus our purchase record on nextscalp.com |
The licence is the one exception, and it is on this website rather than in the product: buying leaves a row with your licence key, e-mail and payment reference so downloads can be unlocked. That record knows nothing about your trading.
What reaches the browser
Sent to your browser
- The figures rendered on the page you opened
- Chart data for the symbols on screen
- Your own notes and screenshots
Never sent to your browser
- Exchange API key or secret
- Database connection string
- Session secret, cron secret, Telegram bot token
- Anthropic API key
This is enforced, not just intended. The build runs a scan of the compiled client bundles for server secrets and fails if it finds one, and that scan is a step in the Docker build itself - so it runs on your machine when you build your own image, not only on ours.
What NextScalp can and cannot do
Can NextScalp see my trades?
No. There is no NextScalp server for them to reach. Your fills, trades, notes and AI reviews are written to the Postgres database on your own machine, and the application has no code path that sends them anywhere else.
Can NextScalp log into my journal?
No. Sign-in is Telegram OpenID Connect restricted to the Telegram ids you list in ALLOWED_TELEGRAM_IDS, and sessions are signed with a secret you generate. On a laptop install there is no remote sign-in at all.
Can NextScalp restore my database if I lose it?
No, and this is the real cost of self-hosting. There is no copy anywhere else. Backups are yours to take.
Can NextScalp use my exchange key?
No. The key lives in the environment of your own server and is never transmitted anywhere except to your exchange, over the signed read requests the application makes.
Can the journal place a trade or move funds?
No. It never calls an order, transfer or withdrawal endpoint. Every exchange call it makes is a GET against a read endpoint, and bun run doctor warns you if the key you configured carries more permission than that.
Does my trade data go to an AI provider?
Only if you set an Anthropic key and then explicitly ask for an analysis. Leave ANTHROPIC_API_KEY empty and every AI feature is off, with no request ever made. When you do invoke it, the selected trade or period goes from your server straight to Anthropic on your own key, never through NextScalp.
What self-hosting puts on you
Owning your data means owning the problems that come with it. This is the honest half of the trade.
Your responsibility
- The security of the machine you run it on
- Backups of your database
- Keeping your environment file private
- Creating an exchange key that is genuinely read-only
- Applying updates when they ship
What we cannot do for you
- Recover a database you did not back up
- Reset a password (there are none) or unlock an install
- See your data to debug it, unless you show it to us
- Revoke an exchange key on your behalf
Check it for yourself
Before you buy
- Walk the live demo - it is this same application
- Read the page guide to see what each screen does
- Compare the endpoint list above against your exchange
- Ask anything at journal@nextscalp.com
After you buy
- Read the source: you get all of it
- Run
bun run doctorto have it audit your key - Run
bun run verify:bundleto scan the client build - Run it in LOCAL_MODE, behind your own firewall
- Watch its traffic and compare it with the table above
Still not sure?
The demo answers more than any page can. It is the same code, with a realistic few months of trades already in it, and it asks you for nothing.