Privacy and your data
Last updated: 2026-08-26
The short version: the app collects nothing. This page explains what that means in practice and how you can check it yourself. The legal wording is in the Privacy Policy.
What stays on your computer
Everything you import or type: transactions, accounts, transfer decisions, notes, manual prices, settings, and your license key. It is stored in your browser's local database (IndexedDB) and in the JSON backups you save. I have no copy and no way to get one.
The only network connections the app makes
| When | Where | What goes out |
|---|---|---|
| You click Refresh prices | CoinGecko's public API | The tickers in your portfolio (so it knows which prices to return) and your IP address, as with any web request. Not your amounts, not your trades. |
| Right after a price refresh | https://holdbound.com | A request for a tiny version.json. No identifier, no license, nothing about your portfolio. Skip price refresh and this never happens. |
| You click Send in Feedback | https://holdbound.com | Only what you typed, the feedback type, the app version, and your license type (trial / one-time / member). Email only if you typed one. |
That is the complete list. No analytics, no crash reporting, no usage statistics, no "anonymous" metrics, no tracking pixels. There is no opt-out switch because there is nothing to opt out of.
How to verify that
You don't have to take my word for it:
- Open the app, press F12 (Developer tools), open the Network tab.
- Use the app: import, edit, switch methods, export. The Network tab stays empty.
- Click Refresh prices: you will see requests to
api.coingecko.comand one tohttps://holdbound.com/version.json. Nothing else.
The file is plain HTML and JavaScript; anyone who reads code can read it.
Exchange API keys
The app never asks for them and has nowhere to put them. It works from CSV exports only. A file that held your exchange keys would be a file worth stealing; this one isn't.
The license key
Checked inside the app with a public key embedded in the file. Entering it does not contact a server. The key encodes your license type, version coverage and an order ID; it contains no personal information.
What I do keep on my side
Only what you hand over on the website — at the checkout, in the feedback form, or in the optional reminder form on the download page:
- The trial reminder list: if you left an email on the download page, the address, the date, and the version you downloaded. Used for one reminder around day 25 and for security-fix notices, and nothing else. One-click unsubscribe deletes the address; addresses are deleted automatically 90 days after the reminder goes out.
- Orders: an order reference, license type and key, the TRON transaction details (public on the blockchain anyway), and your email only if you entered one, used to send the key and, for members, release notes. Kept as long as tax and accounting rules require, then deleted; emails of lapsed members within 12 months.
- Feedback and support emails: kept up to 24 months so I can answer and see which problems recur. Drafting of replies may use an AI tool; I review every reply before it is sent.
- Web server logs for the website (IP, page, time), deleted after 30 days. No third-party analytics on the site either.
Nothing is sold or shared. You can ask me to delete anything above at any time: support@holdbound.com.
Deleting your data
- On your computer: Settings → Clear all data removes everything the app stored in that browser (type DELETE to confirm). Backup files on your disk are yours to delete.
- On my side: email support@holdbound.com with your order reference or the email you used.
Why it works this way
A tracker that holds your whole trade history on someone's server is a target, and a business that holds your data has an incentive to keep you paying. Keeping everything local is simpler to build, simpler to trust, and matches how most people in crypto already think about custody.