The webhook URL is the secret
Each webhook URL contains a long random token (up to 48 hex characters) generated with a cryptographic randomness source. Treat the URL like a password: anyone who has it can post alerts to your channel. If it leaks, delete the webhook and create a new one. Your TradingView alert is the only place it should live.
Abuse protection
- Per-webhook rate limit (60 requests per minute by default).
- Request body capped at 64 KB.
- Identical payloads within 30 seconds are deduplicated.
- Malformed input never crashes delivery. If nothing parses, the delivery shows what was present.
Bot token
Your Telegram bot token is validated with Telegram when you add it, then stored encrypted with AES-256-GCM. It is never displayed again in the dashboard and never appears in logs.
Data handling
- TickerShare keeps a delivery log (status, speed, mode, symbol, error) so you can audit and debug.
- Rendered cards are delivered to Telegram and hosted there. TickerShare keeps no permanent image archive.
- You can delete your account and all associated data at any time from Settings.
See the full security page for the complete picture.