Privacy Policy

Last updated: September 8, 2026

This Privacy Policy explains how Daniel Otto ("we", "us", "our") collects, uses, and protects information when you use TrackMyWallet (the "Service"), in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

Daniel Otto
Lohbrügger Landstr. 161
21031 Hamburg, Germany
Email: info@trackmywallet.app

2. What We Collect

  • Account data: the email address and password (hashed) you provide when you register.
  • Wallet sign-in (optional): if you sign in with an Ethereum wallet ("Sign-In with Ethereum") instead of email and password, we store your public wallet address as your account's login identifier.
  • Wallet data you provide: public addresses and extended public keys (xpub/ypub/zpub) you add to track. We never ask for or store private keys or seed phrases.
  • Exchange credentials (optional): if you connect an exchange (e.g. Kraken, Coinbase, Binance, Bitpanda), we store the API key you create and, where the exchange requires one, its secret. The secret is stored encrypted. Please create read-only keys only; trading or withdrawal permissions are not needed and not used.
  • Derived data: transaction history, balances, and price information fetched from public blockchain data and third-party price sources on your behalf, plus any history (e.g. CSV files) you import yourself.
  • Community forum: when you post in the forum, we store and publish your (auto-generated) username, your posts, and their timestamps. Forum posts are visible to signed-in users.
  • Public profile (optional, off by default): if you enable a public profile, a page showing your username, portfolio value, allocation, and a generated preview image becomes publicly accessible. You choose whether wallet addresses are shown or redacted; your email, individual transactions, and internal rate of return (IRR) are never shared. You can turn the profile off again at any time.
  • Technical data: IP address, browser type, and basic server/usage logs, collected automatically for security, abuse prevention, and reliability (Art. 6(1)(f) GDPR).

3. How We Use Your Data

  • To provide and maintain the Service (syncing your wallets, calculating your portfolio value).
  • To send you notifications about wallet activity, including email notifications for Premium accounts, if enabled.
  • To maintain the security and integrity of the Service.
  • To communicate with you about your account or changes to our terms and policies.

4. Legal Basis for Processing

Where the GDPR applies, we process your data based on: performance of a contract (providing the Service you signed up for), your consent (e.g. optional email notifications and analytics), and our legitimate interest in keeping the Service secure and reliable.

5. Third-Party Services

We rely on the following third-party services to operate TrackMyWallet:

  • Hosting/infrastructure: the Service runs on a virtual server at an infrastructure provider with servers located in the European Union.
  • Blockchain data providers (including mempool.space, Blockstream, Blockscout, Routescan, Etherscan, Helius, and chain-specific public explorers/indexers) to look up public addresses and transactions. What is transmitted is the public address being queried, not your identity.
  • Price data provider (CoinGecko) for current and historical price information.
  • Email delivery: lima-city GmbH, Germany (SMTP server mail.lima-city.de), for account and notification emails.
  • Analytics (Umami and Google Analytics) to measure usage. Both load only after you opt in to the "Analytics" category in the cookie banner, and never for visitors who decline. Umami is cookieless and does not profile you. Google Analytics (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) sets the _ga and _ga_* cookies and processes device information and your on-site behaviour. See Section 8 for details.

Where a third-party provider processes personal data on our behalf, we enter into a data processing agreement (Art. 28 GDPR) with that provider. Some providers may be located outside the EU/EEA; in such cases we rely on appropriate safeguards (e.g. EU Standard Contractual Clauses).

We do not sell your personal data to third parties.

6. Data Retention

  • Account, wallet, and derived data: for as long as your account exists. You can delete individual wallets yourself at any time (their derived data is deleted with them). To request full account deletion, contact info@trackmywallet.app; we then delete it within 30 days, unless statutory retention obligations require otherwise.
  • Exchange credentials: until you disconnect the exchange or delete your account.
  • Forum posts: remain after account deletion unless you remove them yourself first; on request we will remove or anonymise them.
  • Server/access logs: as rolling daily files for at most 30 days, then deleted automatically; longer in the event of a specific security incident.
  • Backups: rolling backups may still contain deleted data for up to 30 days before they are overwritten.

7. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data ("right to be forgotten").
  • Object to or restrict certain processing.
  • Request a copy of your data in a portable format.
  • Withdraw a consent you have given, with effect for the future.
  • Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at info@trackmywallet.app.

8. Cookies and Analytics

We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. These are required for the site to function and are set without consent (Art. 6(1)(f) GDPR, § 25(2)(2) TDDDG). We do not use advertising cookies.

For usage analytics we use two tools, both of which load only after your explicit consent in the cookie banner. The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can withdraw it at any time, with effect for the future, via the "Cookie preferences" link in the banner; the Google Analytics cookies are then automatically removed from your device.

  • Umami — a privacy-focused, cookieless analytics tool. It records aggregate page views and events without storing cookies on your device or building a profile of you.
  • Google Analytics 4, operated by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics sets the _ga and _ga_4V9V7Z8FB7 cookies (each lasting up to 2 years) and uses them to process device and browser information, an approximate location, and your behaviour on this site to produce pseudonymous usage statistics. Google Analytics 4 does not log full IP addresses; we do not enable advertising features or cross-device (Google Signals) tracking. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and EU Standard Contractual Clauses apply in addition. More information: policies.google.com/privacy. You can also object to collection by Google Analytics using the browser add-on at tools.google.com/dlpage/gaoptout.

9. Children's Privacy

The Service is not directed at individuals under the age of 16.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the "Last updated" date above.

11. Contact Us

Questions about this Privacy Policy? Contact us at info@trackmywallet.app.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Hamburg is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI)
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany