Privacy Policy

Last updated: 2026-08-26

The short version: the Holdbound app collects nothing about you. Your trades, balances, notes, and backups stay on your computer. The only things I ever see are what you hand over on purpose on the website — at the checkout, in the feedback form, or in the optional reminder form on the download page — and the ordinary server logs of the website.

This page spells that out in detail, because "we don't collect data" is easy to say and I want you to be able to check it.

1. Who I am

Holdbound is built and run by an independent developer. Contact: support@holdbound.com. Japan is the governing jurisdiction (see Terms of Service).

2. The app itself: zero telemetry

The app is a single HTML file that you open in your browser. Inside it:

• No analytics, no tracking pixels, no crash reporting, no usage statistics, no "anonymous" metrics. There is no opt-out toggle because there is nothing to opt out of.
• No account. You never sign up or log in. The download page offers an optional email reminder; that form is a page on the website, and the app on your disk has no connection to it and no knowledge of it.
• No upload of your data. Your transactions, holdings, cost-basis results, notes, and settings are stored in your browser's local storage (IndexedDB) on your device. JSON backups are files you save to your own disk. None of this is sent to me or to anyone else.
• The license key is checked offline inside the app. Entering a key does not contact a server.

You can verify this: the file is plain HTML and JavaScript, and your browser's network tab will show you every request it makes.

The app's only network connections

The app makes network requests in exactly these cases:

That is the complete list. If a future version adds any connection, this page and the changelog will say so before the version ships.

3. The website

The website at https://holdbound.com is static pages plus the checkout.

• Server logs. The web server records, for each request, the IP address, timestamp, method, path, status code, response size and timing. It does not record query strings, the referring page or your browser's user-agent. Logs are rotated daily and deleted after 30 days. The checkout also stores a salted hash of your IP address (never the address itself) for up to 30 days, used only to count unique downloads and to stop abuse of the order and feedback endpoints.
• The optional reminder form. The download page offers to email you a reminder before the 30-day trial ends. It is optional, it appears only after your download has already started, and nothing on the site depends on it. What is stored and for how long is in Section 4.
• No third-party analytics (no Google Analytics or similar), no advertising, no embedded social-media widgets.
• Cookies. None. Neither the informational pages nor the checkout set any cookie or session; an order page is addressed by its own random order reference in the URL, which you can keep or discard. There is no cookie banner because there is nothing to consent to.
• Fonts, scripts, images are served from my own site, not from third-party CDNs.

4. What I keep: the reminder list, purchases, and messages

The trial reminder list

If you enter your email on the download page, three things are stored: the address, the date you entered it, and which version you downloaded. That is the entire record.

It is used for at most two messages:

• one reminder about 25 days after the download, that the trial is nearly up;
• a notice if a security fix ships for the version you downloaded.

Nothing else is ever sent to this list. It is not sold, rented, or shared. It is kept separate from order records: no purchase, licence key, or payment is attached to it, and nothing from inside the app reaches it — the app has no connection to this list.

Every message carries a one-click unsubscribe, which deletes the address rather than flagging it. Addresses that are never unsubscribed are deleted 90 days after the day-25 reminder goes out, because after that there is nothing left to send.

Checkout and license records

When you buy a license I record:

• an order reference (random ID) and the time of the order;
• the license type bought (one-time v1.x or yearly membership), amount, and the license key issued;
• the TRON (TRC20 USDT) transaction hash, the paying address, the receiving address, and the amount received — this is public information on the TRON blockchain; I store a copy to match your payment to your order and to be able to refund you;
• your email address, only if you enter one. It is optional. If you give it, it is used to send you the license key and, for membership holders, release notes with download links. It is never sold or shared, and you can ask me to delete it at any time (see Section 6).

I keep order and license records for as long as the license is valid plus the period my tax and accounting obligations require — up to 7 years. Email addresses of lapsed members are deleted within 12 months of expiry unless you ask earlier.

Feedback and support

Feedback-form submissions and support emails are stored so I can answer them and so I can see which features and problems come up most often. I keep them for up to 24 months, then delete them. Emails you send to support@holdbound.com are kept in the mailbox under the same rule. If you include an email address I use it only to reply to you.

When the trial ends, the app may show a one-click "why are you not buying?" question. Answering is optional; the answer is sent through the same feedback endpoint with no identifier attached.

Backups

The checkout database — order and license records, the reminder list, feedback, and the hashed IPs from Section 3 — is copied to a backup every night, and the newest 30 nightly copies are kept, so each copy exists for about 30 days. I keep them so that a disk failure cannot erase the record of who bought what: without them I could not look up your license or refund you. The consequence to be plain about: an address or IP hash deleted from the live database can still sit inside earlier backup copies for up to 30 days after its deletion, until those copies age out. If a backup ever has to be restored, the restore procedure ends by re-running the deletions described on this page, so a restore does not bring deleted data back.

Drafting replies

I use AI tools to draft support replies, which I review and approve before anything is sent. Your message may be processed by such a tool for that purpose only.

5. Sharing

I do not sell, rent, or trade any information. I share data only if the law requires it, or with a service provider that hosts the website or mailbox, under terms that limit them to acting on my instructions. Blockchain transaction data is public by nature; I did not make it public and cannot make it private.

6. Your rights

Wherever you live, you can email support@holdbound.com to:

• ask what I hold about you (it will be a short list: at most an order record, an address on the reminder list, and your messages);
• ask me to correct or delete it — I will, except for records I must keep for tax or accounting law, which I will delete when that period ends;
• withdraw consent to release-note emails at any time (every such email has an unsubscribe line).

If you are in the EU/EEA or UK you also have the right to complain to your data-protection authority.

For the app data on your device, you don't need to ask anyone: it is yours, and you can delete it from your browser's storage settings or with the app's Settings → Clear all data action.

7. Children

Holdbound is not directed at children under 16 and I do not knowingly collect information from them.

8. Changes

If this policy changes, the "Last updated" date changes and the changelog at https://holdbound.com notes it. A change will never make the app start collecting data without an explicit statement here first.

9. Contact

support@holdbound.com