HodlHabit
Start free

Privacy Policy

Last updated: 12 October 2026 (version 2026-10-12)

This policy explains what HodlHabit stores, why, who else sees it, and what you can ask us to do about it. It describes how the service actually behaves today, including in the places where that is less than you might expect.

1. Scope and who is responsible

This policy covers hodlhabit.com and the HodlHabit app at app.hodlhabit.com. The data controller is Wagyu Software Inc., reachable at hello@hodlhabit.com or 6-2160 Highway 7, Suite 442, Vaughan, Ontario, Canada L4K 1W6.

We handle personal information under Canada's PIPEDA. If you are in the EEA or the UK, we rely on these bases under the GDPR / UK GDPR: performing our contract with you (running your account, imports, strategies and any automated buys); our legitimate interests (keeping the service secure, preventing abuse, understanding aggregate usage); your consent (marketing email and non-essential analytics, where consent is required); and legal obligation (tax and accounting records).

2. What we collect

Account

  • Your email address and authentication details, held by our authentication provider. Your email is mirrored into your profile record.
  • Preferences: display currency, email settings.
  • The date and version of the Terms you accepted, and a periodically updated "last seen" timestamp.

Your portfolio

  • CSV files you upload, stored in a private bucket. The stored filename includes your account identifier and the original name of the file you chose, so avoid filenames containing information you would rather not store.
  • The transactions parsed from those files, plus any purchases or sales you enter by hand, and the portfolios and goals you create.
  • Import records: which exchange, how many rows were valid, and any parsing error.

Exchange connections

  • Your exchange API key and secret, encrypted — see section 7 for exactly how.
  • Non-secret details: the exchange, a label you choose, the quote currency, the permissions the key reported, and the last six characters of the key's public identifier so you can tell keys apart.
  • Your execution settings and limits, and sync state such as when we last read your trades.

Activity

  • An execution audit log: each evaluation, proposed, validated, placed, filled, blocked or failed order, with amounts, the exchange, timestamps, and up to 500 characters of any error the exchange returned. It contains no key material.
  • Subscription records if you buy Pro: our payment provider's customer, subscription and price identifiers, and the status. We never see or store your card number.
  • Emails we sent you, and bug reports you submit — which may include a screenshot you choose to attach.
  • Server logs from our backend functions, which can include your account identifier alongside an action.

Website analytics

This marketing site offers optional Google Analytics 4 and Ahrefs Analytics. They are not loaded until you choose Accept in the consent banner. You can change that choice at any time through Cookie settings in the footer; declining stops optional analytics on the next page load. The app itself does not load these marketing analytics.

3. How we use it

  • To run your account, import and chart your purchases, and calculate your statistics.
  • To evaluate the strategies you configure and, where you have enabled it, place the buys you instructed and read back your trades.
  • To send service email, your weekly summary, and notices about automated buys.
  • To answer support requests and investigate problems you report.
  • To troubleshoot imports and improve how we read exchange export files, including by reviewing files that did not import correctly. That review happens on our own systems, and any sample files we keep for testing are made up, never copies of your data.
  • To keep the service secure, enforce limits, and prevent abuse.
  • To take payment and manage subscriptions.

4. What we do not do

  • We do not sell your personal information, and we do not share it with advertisers.
  • We never hold or move your funds. Our exchange connectors can place market buys and read trade history — they have no sell, transfer or withdrawal capability, and keys that can withdraw are rejected outright.
  • We do not use your portfolio to trade for our own account.

5. Who else processes your data

We may share personal information with service providers and business partners that help us host, secure, support and operate the service, process payments, deliver communications, provide market data, facilitate exchange connectivity, or provide optional analytics and assisted import features. We limit each disclosure to what is reasonably needed for that purpose and require appropriate confidentiality and security commitments.

We may also disclose information where the law requires it, or to protect our rights or someone's safety. If the business is ever transferred, records may transfer with it, and we will say so before that takes effect.

6. How long we keep it

We retain personal information only as reasonably needed to operate the service, meet legal obligations, protect security, or resolve disputes. You can request account deletion on an ad hoc basis by emailing us; we will assess the request and retain information where required for those purposes.

When you delete an upload in the app, the transactions it created are removed from your portfolio straight away. The uploaded file stays in our private storage for 60 days so we can troubleshoot imports and improve how we read exchange exports, and is then permanently deleted automatically. To have your uploaded files erased sooner, email us at hello@hodlhabit.com and we will delete them.

7. Security, and how exchange keys are protected

Data is held in a managed Postgres database with row-level security, so one account cannot read another's rows. Traffic is encrypted in transit.

Exchange API keys get additional protection:

  • We reject keys that can withdraw. Keys are checked before storage, and a key is refused if withdrawal access is detected or cannot be ruled out.
  • Exchange credentials are protected with access controls and encryption. Access is limited to the service operations that need it, and credentials are not included in logs or returned to users.
  • Disconnecting removes the stored credential from active use. You should also revoke the key at your exchange.

No system is perfectly secure. You should use a trade-only key, keep it scoped as tightly as your exchange allows, and delete it at the exchange when you are done.

8. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or withdraw consent. To exercise any of these, email hello@hodlhabit.com.

How this works in practice today: account deletion requests are handled on an ad hoc basis. Tell us what you want and we will respond to the request.

You can revoke an exchange connection yourself at any time, which destroys the stored key on our side; you should also delete the key at your exchange. You can unsubscribe from non-essential email using the link in any message.

If you are in the EEA or the UK you may complain to your data protection authority; in Canada, to the Office of the Privacy Commissioner.

9. Cookies and analytics

The app uses storage in your browser that is necessary to keep you signed in and to remember interface preferences.

This marketing site does not load Google Analytics 4 or Ahrefs Analytics until you choose Accept. Cookie settings in the footer lets you change your choice; essential storage remains in place because the site needs it to work. The app uses necessary browser storage for sign-in and interface preferences.

10. International transfers

Our providers may process information outside your country, including in the United States. We review the transfer mechanism and contractual safeguards used for each provider and will identify material changes in a revised policy. Where required for EEA or UK transfers, we use an applicable lawful safeguard such as an adequacy decision or standard contractual clauses.

11. Children

HodlHabit is not for anyone under 18 and we do not knowingly collect their information. We do not record dates of birth, so we rely on the confirmation you give when you sign up. If you believe a child has an account, tell us and we will remove it.

12. Changes to this policy

We will update this page when our practices change, and the "Last updated" date and version at the top will tell you when. For significant changes we will also notify you in the app or by email and ask for any consent or Terms acceptance the change requires.

13. Contact

Privacy questions or requests: hello@hodlhabit.com.