Privacy Policy

Last updated: October 26, 2026

HoldingsNest (“we”, “us”) is operated by HoldingsNest. This policy explains what data we collect when you use holdingsnest.app and app.holdingsnest.app (the “Service”), how we use it, and the rights you have.

1. Data we collect

Data you provide

Account details: email address and display name. If you sign up with email, your password is stored only as a one-way hash; we cannot see the original password.
Third-party sign-in: when you sign in with Google or Telegram, we receive the account identifier, email address (if any) and name provided by that service. We never receive your password for those services.
Financial data you enter: account names, institutions, balances, holdings, transactions, loan terms, notes and similar information.

Data generated automatically

Sign-in and activity records: IP address, browser information (User-Agent), sign-in times, and an audit log of important actions (such as creating, editing or deleting accounts).
Cookies: essential cookies keep you signed in and secure the sign-in process. With your consent, we also use Google Analytics and Meta cookies to measure our ads and understand how the site is used (see Section 6).

Data we do not collect

We do not connect to your bank or brokerage accounts, and we do not read your transaction history.
We do not store your login passwords for banks, brokers or other institutions. The upcoming vault feature will use end-to-end encryption: data is encrypted on your device and we cannot decrypt it.

2. How we use data

To provide the Service: calculating net worth, investment returns, loan amortization and charts.
To keep accounts secure: verifying identity, detecting unusual sign-ins and handling security incidents.
To contact you: email verification, password resets, workspace invitations and important service notices.
To improve the Service: fixing errors and understanding how features are used (never for personalized advertising).
To measure advertising: with your consent, understanding which ad brought you here and whether you signed up.

We do not sell your personal data, never use your financial data for advertising, and do not show ads in the Service.

Workspace members you invite, according to the roles and account permissions you set.
Infrastructure providers: hosting (Google Cloud, Taiwan region), encrypted backup storage and email delivery. These providers process data only to run the Service. Backups are encrypted before they leave our server, so the storage provider cannot read them.
Market data services: we send only ticker or coin symbols to look up prices — never your identity or position sizes.
Analytics and advertising services (Google, Meta): with your consent, they receive only the page paths you visit (without URL parameters) and which setup steps you completed — such as signing up, adding your first account, inviting family or turning on the Dead Man’s Switch. They never receive your financial data, email address or account contents.
Legal requirements: when required by a court or authority under applicable law.

4. Retention

Your account and financial data are kept for as long as your account exists.
Sign-in records are kept for up to 180 days after the session ends; audit logs are kept for up to 2 years for security investigations.
After you delete your account, online data is deleted within 30 days, and encrypted backups are rotated out within 30 days.

5. Security

HTTPS encryption across the entire Service.
Passwords stored as one-way hashes.
Every request checks that you have access to the workspace and account involved.
The database is accessible only to the Service; backups are encrypted before leaving the server, and the decryption key is not kept on the server.

No system can be guaranteed to be completely secure. If a breach affects your personal data, we will notify you as required by law.

6. Cookies and analytics

Essential cookies keep you signed in and secure the sign-in process. The Service cannot work without them, so they don’t require consent.
Analytics and advertising cookies (Google Analytics, Meta Pixel) are used only after you click “Accept” in the cookie banner. If you click “Decline”, Meta Pixel is not loaded and Google Analytics sends only cookieless, anonymous measurements that cannot identify you.
Your choice is remembered for 180 days and applies to both holdingsnest.app and app.holdingsnest.app.
You can change it at any time from “Cookie settings” in the website footer.

7. Your rights

Under Taiwan’s Personal Data Protection Act, you may request to access, obtain a copy of, supplement or correct, stop the collection or use of, or delete your personal data. Email support@holdingsnest.app and we will respond within the statutory period.

8. Children

The Service is not intended for use by anyone under 18 on their own.

9. Changes to this policy

If we make material changes, we will notify you in the Service or by email. Continuing to use the Service after the change means you accept the updated policy.

10. Contact

HoldingsNest · support@holdingsnest.app