What a crypto tracker app sends off your phone
What crypto tracker apps collect falls into 3 categories: your holdings, ordinary device telemetry, and advertising data. Google states that each AdMob ad request shares data from the device, the IP address and mobile ad identifiers among it, so a free tracker transmits something. The question is whether your coins and amounts are part of it.
Key takeaways
- Holdings are the sensitive category. Device model, Android version and crash traces are not, and advertising data is a third thing again.
- Google requires Data safety declarations to be "complete and accurate" and says it may block updates or remove an app when its behavior contradicts what it declared.
- Android labels runtime permissions "dangerous". A manual tracker needs network access and little else; SMS, call log and accessibility requests are disqualifying.
- An ad-supported app cannot truthfully claim it collects nothing, because the ad SDK receives device and advertising data by design — on a path separate from the app's own database.
- Holdtotal's amounts are typed in and stored on the phone, and no Holdtotal server receives them. Android Auto Backup can still copy app data to a Google account unless device backup is off.
Most privacy arguments online collapse the three into one word, "data", and then nobody can tell whether a specific app is sending the list of coins you own or an anonymous crash report. Those are very different disclosures.
An app that is free and shows ads is transmitting something — the ads themselves require a network request and a set of identifiers. The question worth answering is narrower and checkable: does the list of coins and amounts leave the handset? This page gives four checks you can run on any Android tracker before installing it, then states plainly what Holdtotal sends. It is information about app behavior, not financial advice.
The three categories, and why only one of them is sensitive
Your holdings are a statement about your net worth. A device model and an Android version are not. The distinction is the whole subject:
- Holdings — coins and amounts. The sensitive record. It is the only category a tracker could send that would tell someone what you are worth.
- Device and diagnostic data — model, Android version, crash traces, IP address. Ordinary mobile telemetry, transmitted by most apps on the phone.
- Advertising data — the advertising identifier, ad interactions, and whatever the ad network needs to serve and count an impression.
An app can honestly send the second and third while never sending the first. When a listing or a policy talks about "data" without saying which category, treat the silence as the answer to your question.
Check 1: read the Data safety section on Google Play
Every Play listing carries a Data safety section, and Google requires developers to provide "complete and accurate" declarations there about the data their app collects and shares, adding that when it becomes aware of a discrepancy between an app's behavior and its declaration, it may take enforcement action including blocked updates or removal from Google Play (Provide information for the Data safety section). That is a self-declaration with a real penalty attached, which makes it the fastest useful signal on the page.
Read it for what it names, not for its tone. A tracker that declares "Device or other IDs" and "App activity" while declaring no financial info is telling you the amounts stay put. One that declares financial info collection is not necessarily malicious — it may sync across devices — but you now know.
Check 2: look at the permissions
Android permissions are visible before installation and again in Settings afterwards. Android's documentation distinguishes install-time permissions, which cover limited access and are shown when you view the listing, from runtime permissions — "also known as dangerous permissions" — which give access to restricted data and must be requested with a system prompt while the app runs (Permissions on Android).
A manual portfolio tracker needs network access and effectively nothing else. Ask what the app would do with anything more:
| Permission requested | Reasonable for a tracker? |
|---|---|
| Internet / network state | Yes — prices and ads need it |
| Camera | Only if it scans QR codes, and only when you tap scan |
| Contacts | No |
| Location | No |
| SMS or call log | No, and treat it as disqualifying |
| Accessibility service | No, and treat it as disqualifying |
Check 3: work out what the ad SDK receives
A free app is paid for somehow. If the answer is ads, an advertising SDK is running inside it and that SDK talks to its own servers. Google says what its own network receives: "Each AdMob ad request on a publisher's app will share certain data from the user's device, for instance the user's IP address and mobile ad identifiers will be shared with Google", and the AdMob program policies forbid a publisher from passing Google anything it could recognize as personally identifiable information (How Google uses AdMob data). The practical consequence: an ad-supported app cannot truthfully claim it collects nothing, and any app that does make that claim while showing you ads has told you something about its accuracy in general.
What an ad SDK does not receive is the content of the app's own database, unless the developer deliberately passes it. Ads and holdings are separate paths, and the Data safety declaration is where the developer has to say so.
Check 4: read the policy for the specific sentence
A privacy policy that discusses cookies for four paragraphs and never says where holdings are stored is avoiding the only question you asked. Search the text for the words that matter — "stored", "device", "server", "third party" — and see whether the document commits to anything falsifiable. A good policy says what is stored locally, what is transmitted, and who else receives it. The Holdtotal privacy policy is the one to hold to that standard here.
What Holdtotal sends, precisely
| Category | What happens |
|---|---|
| Your holdings | Entered by hand, stored on the phone. No Holdtotal server receives them. |
| Prices | Fetched from a market data provider, by ticker. The request carries no holdings. |
| Ads | Served by Google AdMob, which receives standard device and advertising data. |
| Accounts | None. There is no login, no wallet connection and no exchange API key. |
| Backup | Android Auto Backup may copy app data to your Google account unless you switch backup off (Auto Backup). |
The claim is deliberately narrow. Holdtotal is not a zero-transmission app; it is an app whose transmissions do not include your amounts. What an absent account does and does not protect is covered separately in what no sign-up actually means.
These four checks describe declarations and observable behavior. They cannot prove what a server does with a request after it arrives, and they do not cover the app's security engineering. This page also does not address market data accuracy, which is a different question about the price provider rather than about your privacy.
FAQ
Can I tell what an app sends without technical tools?
Mostly, yes. The Data safety section on the Play listing, the permission list and the privacy policy together cover the categories an app declares. Opening the app in airplane mode shows whether your entries render with no network, which proves they are stored locally. It proves nothing about what the app sends once the network comes back, which is what the declarations are for.
Does a crypto tracker with ads sell my portfolio data?
An ad-supported tracker is showing ads through a third-party SDK, which receives device and advertising data. That is not the same as sending your coins and amounts, and the two live on separate paths inside the app. The Data safety section is where a developer has to declare whether financial information is collected or shared, so check that line specifically rather than reasoning from the presence of ads.
Which permissions should make me uninstall a tracker?
SMS, call log and accessibility service are the three to treat as disqualifying for a manual portfolio tracker, since none of them have a plausible use in reading a list of coins you typed in yourself. Contacts and location have no role either. Network access is expected and unavoidable, because prices and ads both need it.