Privacy Policy

iOS app “HoldingsMap” and website holdingsmap.app · Last updated: October 15, 2026 · Deutsche Fassung · Version française · Versión en español

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Data processing in the app

2.1 Data stored on your device

The app stores the portfolios you create (name, the ETFs and securities they contain and their weights or amounts), ETFs you add yourself, your settings and your acknowledgement of the notice shown at first launch. This data is kept only in the app’s storage on your device and is not transmitted to me or to anyone else.

Storing this data is technically necessary for the app to provide the features you request (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), Art. 6(1)(b) GDPR). You can delete individual portfolios in the app. Deleting the app removes all stored data.

If you turn on “Remember Matches” in the app’s settings (off by default), the app also stores which ETF or company you assigned to a position when importing, together with that position’s ISIN or name from your file or screenshot. The app suggests this match again on your next import. This data also stays on your device; you can remove it at any time with “Forget Confirmed Matches”.

If you use device backups (iCloud Backup or a backup on a computer), they may include the app’s data. You or Apple manage these backups according to your settings; I have no access to them.

2.2 Importing files and screenshots, pasting from the clipboard

When you import a file (for example a CSV export from your broker or an ETF template), the app only gets access to the file you select yourself. The app reads the clipboard only when you explicitly tap “Paste”. The contents are processed only on your device; only the positions you choose to keep are stored.

To import from screenshots, you select up to ten images in the iOS photo picker. The app only receives these images and needs no permission to access your photo library. The app recognizes the text in the images using the iOS text recognition, only on your device. It keeps the images in memory only temporarily for this purpose; they are neither stored nor transmitted. The app then shows you the names and amounts it recognized for review, and only what you confirm is stored.

2.3 Sharing, exporting and saving images

Using the iOS share sheet, you can pass on an image of your portfolio or a CSV template. You choose the recipient and the target app yourself; the respective provider is responsible for any further processing.

For “Save Image”, iOS asks once for permission to add photos. This permission only allows adding images, not reading your photo library. You can revoke it at any time in the iOS Settings under HoldingsMap.

2.4 No internet connection, no tracking

The app contains no third-party analytics, tracking or advertising services, sets no cookies and does not connect to any servers on its own. The fund data, taken from public filings (Form N-PORT) with the U.S. Securities and Exchange Commission, and the sector classification (based on SEC industry codes and Wikidata) are part of the app and are updated through app updates.

2.5 Age range (only in certain US states)

Where a law requires it (currently certain US states such as Texas), the app asks iOS for the age range of your Apple Account, for example “18 or older”. The app does not learn your date of birth. This information is only processed on your device, is neither stored nor transmitted, and the app works the same for all age groups. iOS determines from your Apple Account whether such a law applies; elsewhere, no request takes place. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is being able to offer the app there in compliance with applicable law.

3. Contacting me by email, phone or post

When you write to me, for example via “Contact”, “Send feedback”, “Request this ETF” or “Contact support” in the app, your email app opens and you send the message yourself. For some of these emails, the app fills in the subject or text in advance: “Send feedback” with the app’s version number, “Request this ETF” with your search term and the version number, and “Contact support” in the screenshot import with the version numbers of the app and iOS and the number of positions and cash accounts recognized. The app does not attach any screenshots. You see this information before sending and can change or delete it. I then process your email address, your name if provided, the content of your message and the technical information in the email header in order to answer your request. If you call me, I process your phone number (if transmitted), your name if provided and your request; I do not record calls.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is handling your request. I delete the correspondence once it is settled, at the latest twelve months afterwards, unless statutory retention obligations apply or I need it to defend legal claims.

Emails to support@holdingsmap.app are forwarded on my behalf (Art. 28 GDPR) by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) to my iCloud Mail mailbox. The transfer to Cloudflare in the USA is based on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified.

The mailbox is provided to me by Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) as the provider of iCloud. Apple stores and processes the messages in order to provide this service; Apple’s terms of use and Privacy Policy apply. The legal basis for using this mailbox is Art. 6(1)(f) GDPR; my legitimate interest is receiving and answering requests through a reliable email service.

Letters to the address above are received on my behalf by the service provider flexdienst (Kaiserslautern, Germany) (Art. 28 GDPR). flexdienst opens and scans the letters and sends them to me as a PDF by email. This involves processing the sender and recipient details and the content of the letter. flexdienst stores the data on servers in the EU, keeps the originals for 180 days and destroys them afterwards unless I request them to be forwarded by post. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is receiving and handling mail addressed to me. I delete the scanned letters in the same way as emails (see above).

4. Apple App Store, crash reports and beta tests

HoldingsMap is distributed exclusively through Apple’s App Store. When you download the app, Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) processes data such as your Apple Account, device information and the time of download under its own responsibility. I receive no data that would allow me to identify you. For details, see Apple’s Privacy Policy.

If you have turned on “Share With App Developers” in the iOS Settings under “Privacy & Security” › “Analytics & Improvements”, Apple provides me with crash reports and aggregated usage statistics (for example number of installations and crash rates). This data does not allow me to identify you; I use it to fix bugs. The legal basis is the consent you gave to Apple (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time in the same place.

If you take part in a beta test via Apple TestFlight, Apple provides me with your name and email address (if I invited you by email), information about your device, operating system and installation date, crash reports and any feedback you choose to send. I use this data only to run the beta test (Art. 6(1)(b) GDPR) and delete it no later than three months after the test ends.

5. Links to other websites

The app and this website contain links to external sites, for example the SEC website (sec.gov). Only when you tap a link does your browser open and send data to the respective provider. From then on, that provider’s privacy policy applies.

6. This website

This website is hosted by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) (Cloudflare Workers). When you visit it, Cloudflare automatically processes technical data sent by your browser: IP address, date and time, page requested, referring page, browser and operating system. This is necessary to deliver the website and protect it against attacks (Art. 6(1)(f) GDPR). I do not analyze this data myself and have not set up any additional logging. How long the data is stored depends on how long Cloudflare needs it to deliver the website, defend against attacks and troubleshoot errors; it is deleted afterwards. Cloudflare processes the data on my behalf (Art. 28 GDPR); the transfer to the USA is based on the EU-U.S. Data Privacy Framework. For details, see Cloudflare’s Privacy Policy.

The website uses no cookies and no analytics tools and does not load content such as fonts from third-party servers.

Do Not Track: Because neither the app nor this website tracks you across websites or apps, there is nothing to switch off. Do Not Track signals and similar browser settings therefore do not change how the website works.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). An informal email to the address above is sufficient. I will answer such requests wherever you live.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country of your habitual residence, your place of work or the place of the alleged infringement.

I cannot view, disclose or delete data that is stored only on your device. You manage and delete it directly in the app.

8. Obligation to provide data, automated decisions, children

You are not obliged to provide me with any personal data. The app works fully without any information about you; without an email address or phone number, however, I cannot reply to you. No automated decision-making, including profiling, takes place.

HoldingsMap is not directed at children under 13, and I do not knowingly collect personal data from children.

9. Changes

I update this privacy policy when the app, this website or the legal situation changes. The version published here applies, and the date at the top shows when it was last updated. This English version is a translation of the German privacy policy; both have the same content.