Privacy Policy
Effective and last updated: November 13, 2026
HoldStats is operated by Xi Yan as an individual. This policy explains how HoldStats handles information when you use our portfolio tracking service.
Information we collect
When you sign in with Google or Apple, we receive your provider identifier, name and email address when available, and email verification information. We store account and login timestamps and session records. We request basic identity information, not access to your Google mail, contacts or calendar. A new login identity may be linked to an existing HoldStats account using a matching verified email address.
Portfolio and connection data
We store the portfolios, account labels, holdings, quantities, prices, costs and display preferences you enter, plus public wallet addresses and the balances and positions returned by supported connections. If you connect an exchange, we store its API credentials encrypted and decrypt them on the server to perform synchronization. Use read-only API permissions. HoldStats does not place trades or initiate withdrawals, and does not ask for wallet seed phrases or private keys.
How we use information
We use information to provide sign-in, maintain your portfolios, synchronize accounts, calculate estimates, respond to support requests and protect the service. Technical information, such as connection IP addresses and request status, may be processed for security, rate limiting and troubleshooting. Authorized administration includes account information and login statistics. We do not sell your personal information or share it for targeted advertising.
Cookies and browser storage
We use necessary session cookies to keep you signed in, temporary cookies to secure the login process, and browser session storage to remember the portfolio page to return to. The production session cookie is Secure and HttpOnly. We do not currently use advertising cookies or third-party behavioral analytics. Google and Apple handle their own sign-in pages under their respective privacy policies.
Providers and disclosures
Tencent Cloud hosts the production service in Tokyo, Japan. Infrastructure providers process information needed for hosting and backups. Google and Apple process authentication. Your chosen exchange receives authenticated requests when you connect it; wallet addresses are sent to supported blockchain data providers, including OKX Web3, for balance lookups. Market-data providers receive asset lookup requests. We may disclose information when required by law or reasonably necessary to protect users and the service. We do not intentionally send your complete portfolio to market-price providers.
International processing
Your information is stored on our server in Japan. Authentication, infrastructure and connected data providers may process information in other countries. Where applicable law requires safeguards for international transfers, those requirements apply to our handling of your information.
Retention and deletion
We retain account and portfolio information while needed to provide the service, and retain operational records and backups as needed for recovery, security or legal obligations. You can edit or remove supported portfolio entries in the app. To request account deletion, contact us using the address below; we may verify that you control the account. Deletion from active systems does not immediately remove restricted backup copies, which remain until their rotation or deletion. If a backup is restored, applicable deletion requests must be reapplied.
Security
We use HTTPS, access controls and encryption of stored exchange credentials. Authorized operational access may be necessary for maintenance and support. No storage or transmission method is completely secure. Never send passwords, API secrets, private keys or seed phrases in support email.
Your choices and rights
Email us to request access, correction, an export or deletion of your personal information. You can stop synchronization by removing the connection or revoking its API key with the provider. Depending on your location, you may also have rights to object to processing, restrict processing or complain to a data protection authority. Where applicable, we rely on providing the service you request, legitimate interests in security and operation, and legal obligations; where consent is required, you can withdraw it.
Children and changes
HoldStats is intended for adults aged 18 or older. Contact us if you believe a child has provided personal information. We may update this policy as the service changes and will indicate the updated date on this page. Material changes will be brought to users’ attention as appropriate.
Contact
The operator and contact for privacy requests is Xi Yan. Email: blogbbs@gmail.com.