Know what the app can—and cannot—access.
Clear boundaries are the foundation of safer portfolio tracking.
Implementation reviewed July 29, 2026
Tracking, not custody
The app cannot hold or transfer your crypto and never asks for a wallet private key or seed phrase.
Connections are optional
You can track holdings manually. Binance credentials are needed only if you choose automatic balance syncing.
Use read-only permissions
Create a dedicated Binance API key and leave trading, margin, futures, and withdrawal permissions disabled.
How account and exchange data currently flow
- Convex provides authentication and database storage. Account-data operations used by the signed-in app check the authenticated user ID before returning or changing records. Maintenance migrations are internal rather than public client mutations.
- On iOS and Android, the authentication session uses the operating system's secure storage. Selected account query results are also persisted in the app's local cache for faster startup.
- If you connect Binance, the API key and secret are stored in the account database and returned to your signed-in app. The app uses them on the device to sign balance requests sent directly to Binance.
- Removing the connection deletes its app database record. You should also revoke the key in Binance, because deleting the app record cannot invalidate a credential held by Binance.
Safer Binance setup
- Create a separate API key specifically for portfolio tracking.
- Enable read access only; do not enable trading or withdrawals.
- Remove the connection and revoke the key if you stop using sync.
- Revoke the key immediately if you suspect your account is compromised.
Claims this page does not make
The current implementation reviewed for this page does not establish field-level or end-to-end encryption for Binance credentials, independent penetration testing, a formal external audit, a bug-bounty program, or a security certification. The AI gateway also uses a shared app token rather than per-account authentication or an explicit rate limiter. Do not infer stronger protections from the use of a read-only exchange key. Read-only permissions reduce impact, but a leaked key can still expose account and balance information.
Report a security issue
Please report suspected vulnerabilities privately to support@crypto-portfolio-tracker.app. Include reproduction steps and avoid accessing data that is not yours.