Privacy policy

Holdista app and the holdista.com website. Last updated 29 October 2026.

Holdista is a personal tracker for your investment portfolio. It is built so that your data stays on your phone.

Holdista is run by Michal Damborský, a private individual in the Czech Republic, who is responsible for the processing described here. Contact: hello@holdista.com.

What stays on your phone

Your portfolio data: imported broker statements, transactions, positions, manual entries, settings.
Your API keys for market data (Tiingo, EODHD) and broker links (Trading 212, Interactive Brokers). Keys are kept in the phone's secure keychain.
There is no user account and no server of ours that stores your data. The app does not use analytics, advertising or tracking.

What the app sends, and to whom

To show prices and sync your accounts, the app connects directly from your phone to these services. Each request contains only what the service needs:

Tiingo and EODHD (market prices): ticker symbols and your own API key.
Czech National Bank (exchange rates) and Prague Stock Exchange (Czech prices): no personal data.
SEC EDGAR and OpenFIGI (company details, matching ISINs to tickers): ticker symbols or ISINs.
Trading 212 and Interactive Brokers, only if you link an account: your own key or token, to read your account history.
Expo (app updates): the app checks for a new version; Expo receives technical data such as the app and platform version.

These services handle the requests under their own privacy policies.

Anonymised samples

If an import does not match your broker, the app can prepare an anonymised sample. Account numbers, names and keys are removed, amounts and dates are changed. You see the sample first, and it is sent only if you share it yourself through your phone's share sheet.

Deleting your data

Unlinking a broker deletes its key. Uninstalling the app deletes all data from your phone.

The holdista.com website

The website uses no cookies, no analytics and no advertising. It is hosted on Cloudflare, which processes technical data such as your IP address to deliver the page and protect it from attacks.

Beta sign-up

What we collect: the e-mail address you enter, the page language and the time of sign-up.
Why: to send you an invitation to the beta and one short survey about what you miss. The legal basis is your consent, which you give by ticking the box.
How: the form sends the sign-up to our mailbox by e-mail through Cloudflare. We do not keep it in any database. Before sending, Cloudflare Turnstile checks that the form was filled in by a person; it does not use cookies for advertising.
Optional survey: after you sign up, you can fill in a short survey. It runs on Tally (Tally BV, Belgium, data stored in the EU). The survey link carries a random id of your sign-up, not your e-mail, so the answers can be matched to the sign-up. If you open the survey without that link, it asks for your e-mail at the end.
Who sees it: only us. We do not sell or share your e-mail. The mailbox is hosted by Google (Gmail).
How long: until the beta ends, or until you ask us to delete it.
Your rights: you can withdraw your consent, ask for access to or deletion of your e-mail at any time by writing to hello@holdista.com. You can also complain to the Czech data protection authority (ÚOOÚ, uoou.gov.cz).

Contact

Questions about privacy: hello@holdista.com.