Privacy Policy
Last updated: 17 July 2026
1. What we collect
- Account — your email address, and the country signal used to determine which disclosures apply to you.
- Exchange API keys — the trade-only keys you choose to connect.
- Trading data — strategy selection, settings, positions, orders, and performance produced by your use of Holdra.
- Device & usage — device identifiers, app version, crash reports, and basic analytics used to operate and improve the app.
We do not collect your exchange password, and we never ask for it.
2. How API keys are protected
API keys are encrypted before storage using envelope encryption: each connection gets its own data key (AES-256-GCM), which is itself encrypted under a master key held separately from the database. Keys are decrypted only in memory at the moment a trade is placed. We ask only for trade permission — we cannot withdraw your funds, and that restriction is enforced by your exchange, not merely by our policy.
3. How we use your data
To operate the service (execute your chosen strategy, show your performance), to authenticate you, to send transactional email such as login codes, to provide support, to detect abuse and secure the service, and to comply with legal obligations. We do not sell your personal data and do not use it for third-party advertising.
4. Who we share it with
Only with service providers necessary to run Holdra, each acting on our instructions:
- Hosting and database infrastructure (Hetzner; Cloudflare for our website and DNS)
- Transactional email delivery (Resend)
- App distribution, push notifications, and crash reporting (Google Firebase)
- Payment processing (Stripe) — card details go to Stripe, never to us
- The cryptocurrency exchange you connect, to place your trades
We may also disclose data where legally required.
5. Where data is stored
Our primary infrastructure is located in Singapore. Some providers listed above may process data in other countries. Where required, transfers rely on appropriate safeguards.
6. Retention
We keep account and trading records for as long as your account is active, and after closure only as long as needed for legal, accounting, or dispute-resolution purposes. Disconnected API keys are deleted from our systems.
7. Your rights
Depending on where you live, you may request access to, correction of, export of, or deletion of your personal data, and object to or restrict certain processing. You can disconnect exchange keys and delete your account in the app at any time. To exercise a right, contact privacy@holdra.ai.
8. Children
Holdra is not directed at anyone under 18, and we do not knowingly collect their data.
9. Changes
We may update this policy; material changes will be notified in the app or by email.