Your portfolio tracker shouldn't need your identity

Every mainstream portfolio tracker offers you the same trade: hand over your identity, your broker logins, and a live map of everything you own. In exchange, you get a net-worth chart. In June 2024, CoinStats users learned what that trade can cost when North Korean hackers breached 1,590 wallets and stole roughly $2.2M (BleepingComputer, 2024).

Key Takeaways

• A tracker needs public data (wallet addresses, CSV exports), never your identity or logins.
• Mainstream trackers collect identity because their real product is the regulated upsell, not the tracking.
• Stored credentials are priced liabilities: financial-services breaches averaged $5.56M in 2025 (CyberScoop, 2025).
• Read-only tracking sits outside MiCA's regulated-services perimeter by design.

On this page: What is identity-free tracking? · Why trackers want your identity · The credential problem · The sysadmin tax · How read-only tracking works · What it costs · Honest trade-offs · Getting started · FAQ

Here's the mental model this whole article rests on: a tracker's job is observation, and observation doesn't require identification. Public wallet addresses and CSV exports already contain everything a tracker needs to compute your performance. Your name, your bank password, and your exchange API keys add nothing to the math. They only add risk.

In this guide we'll unpack why mainstream trackers collect identity anyway, what happens when stored credentials leak, why the current privacy options push you into part-time sysadmin work, and how read-only tracking sidesteps all of it. Everything here is grounded in our own first-hand audit: we pulled the live pricing and policy pages of 12 portfolio trackers on July 3, 2026, and we cite every number.

What is identity-free portfolio tracking?

Identity-free portfolio tracking means monitoring your full net worth without giving any service your legal name, bank login, or an exchange API key. The demand is measurable: the self-hosted private trackers Ghostfolio and Wealthfolio hold 8,900 and 7,700 GitHub stars respectively as of July 2026 (GitHub, 2026).

The mental model: identification and observation are separate operations, and tracking only requires the second. A blockchain address is a public ledger entry anyone can read. A broker CSV is data you already possess. A tracker that works from those two inputs can compute positions, allocation, and performance without ever knowing who you are.

Concretely, an identity-free tracker accepts:

• Public wallet addresses, pasted in, watched read-only
• CSV exports from your broker or exchange
• Manual entries for anything else: metals, cash, property

And it never asks for:

• KYC (know-your-customer identity checks) documents or identity verification
• Bank or brokerage credentials
• API keys with trading or withdrawal permissions

One misconception is worth killing early. "No-KYC" doesn't mean evading anything. You already completed KYC at your broker and your exchange, where custody and execution happen. The tracker is a lens on top, and a lens has no business holding your passport. Why would a chart need to know your name?

Why do mainstream trackers want your identity?

Because tracking doesn't pay; selling regulated products does. getquin raised €12M in May 2026 from State Street Investment Management and Portage explicitly to pivot from portfolio tracking into AI-driven wealth management and advisory (Portage, 2026). In that model, your identity works as the onboarding asset for whatever gets sold next, not as administrative overhead.

Follow the incentives across the market and the pattern repeats. Finary's 2026 shareholder letter openly admits that "Sync issues have been our users' biggest frustration", and the same letter shows where the company is heading: it now sells life insurance through Generali and offers in-app crypto trading (Finary, 2026). The tracker became a storefront.

Delta, owned by the brokerage eToro, announced a re-tier in November 2025 that took effect in January 2026, capping its free plan at 10 tracked assets (Delta, 2025). A free tier that stops at 10 positions isn't a product. It's a demo with a funnel attached.

Across the 12 trackers whose live pricing and policy pages we fetched on July 3, 2026, we found no exception to the rule: every venture-funded tracker routes its free tier toward a regulated upsell, whether that's advisory, insurance, or brokerage. Identity collection, in other words, is the prerequisite for that business model rather than an accident of design.

The European context raises the stakes. EU households still hold 30-35% of their financial assets in deposits versus 10-15% in the US, and only 20-25% in equities against 35-45% for American households (ECB data via EY, 2025). Millions of Europeans will start investing over the next decade, and every funded tracker wants to be the door they walk through. That's exactly why the door checks ID.

What happens when a tracker holds your credentials?

Every credential a tracker stores becomes a liability with a market price. IBM's 2025 Cost of a Data Breach report puts the global average at $4.44M per breach, with financial services second-highest at $5.56M and the US average at a record $10.22M (CyberScoop, 2025). These are actuarial figures, computed from real incidents that keep happening year after year.

The mental model here is attack surface. A read-only tracker that stores public addresses holds nothing worth stealing. A tracker that stores exchange API keys, session tokens, or bank credentials is a vault, and vaults attract professionals. CoinStats proved the point in June 2024: attackers attributed to North Korean groups compromised 1,590 wallets and made off with about $2.2M (BleepingComputer, 2024).

What about the aggregators that sit between trackers and your bank? Even Plaid's own help center dedicates an article to the question "Does Plaid have access to my credentials?", and the honest answer has two branches: for banks with OAuth, credentials go to the bank directly; for the rest, they pass through Plaid's systems (Plaid, 2026). Aggregation is a standing power of attorney over your financial data. Sometimes it's well-engineered. It's still a power you didn't need to grant.

EU law already names the principle at work here. GDPR Article 5(1)(c) requires that personal data be "adequate, relevant and limited to what is necessary", the data-minimization principle (EUR-Lex, 2016). Read-only architecture is that principle taken literally: data you never collect is data you can't breach, leak, or be compelled to hand over.

Citation capsule: A portfolio tracker that stores bank or exchange credentials inherits the breach economics of the financial sector, where the average incident cost $5.56M in 2025 per IBM's Cost of a Data Breach report. A tracker that reads only public wallet addresses and user-owned CSVs holds no credentials to lose.

Why do today's privacy options turn you into a sysadmin?

Privacy-respecting trackers exist, but they charge you in cash or in ops work. rotki is genuinely local-first, yet it's desktop-bound, crypto-first, and its Basic tier runs €25/month in 2026 (rotki, 2026). Self-hosting Ghostfolio (8,900 GitHub stars) or Wealthfolio (7,700 stars) means running and maintaining your own server (GitHub, 2026).

Those star counts matter. Sixteen thousand six hundred stars across two projects whose entire pitch is "your financial data stays yours" is a loud market signal. People want this badly enough to install Docker for it.

But look at what "self-hosted" actually asks of you. You provision a VPS or keep a home machine running. You write a compose file, mount volumes, configure backups, apply updates, and debug the price API when it rate-limits you. Our readers can do all of that. The question is whether they should have to. Should watching your own money come with an on-call rotation?

Our observation, and we flag it as opinion rather than measured data: even terminal-comfortable users often abandon self-hosted trackers within months, not because the software fails but because the maintenance never ends. The uptime of your net-worth view becomes your problem, forever. That gap, private by architecture but maintained by someone else, is the one the current market leaves open.

Citation capsule: As of July 2026, the self-hosted trackers Ghostfolio and Wealthfolio hold 8,900 and 7,700 GitHub stars, evidence of strong demand for private portfolio tracking. Yet every existing option charges either money (rotki Basic, €25/month) or ongoing server-administration effort, leaving no low-maintenance identity-free choice.

How does read-only tracking work?

Read-only tracking watches public data instead of holding private access. Under MiCA (the EU's Markets in Crypto-Assets regulation), the regulated crypto-asset services are custody, exchange, execution, advice, and portfolio management (ESMA, 2025 framework). A tool that reads a public wallet address and renders charts performs none of those five activities.

Start with the crypto side. A blockchain is a public ledger, so your address's balance and history are already visible to anyone who knows the address. Pasting that address into a tracker grants nothing: no signing capability, no withdrawal path, no permission of any kind. The tracker observes exactly what a block explorer observes, then does the portfolio math on top.

The traditional side works through files you already own. Every EU broker lets you export transactions, and a CSV like this is all a tracker needs:

date,ticker,side,quantity,price,currency
2026-03-14,VWCE.DE,buy,10,131.42,EUR
2026-05-02,VWCE.DE,buy,10,127.85,EUR

Two columns of context and your cost basis, allocation, and time-weighted return all become computable. No login touched your broker. Nothing in that file identifies you, and nothing in it lets anyone move your money.

Here's the legal analysis almost nobody makes explicit. Most coverage assumes anything crypto-adjacent needs a MiCA license, but a read-only tracker is not a CASP (crypto-asset service provider) because it never custodies, exchanges, executes, advises, or manages. That's not a loophole to exploit. It's a structural guarantee to demand: a tracker that can't touch your assets is a tracker that can't lose them, and its regulatory position is the proof of its architecture. We document ours on the transparency page.

Citation capsule: Under the EU's MiCA regulation, per ESMA, regulated crypto-asset services are custody, exchange, execution, advice, and portfolio management. A read-only portfolio tracker that only observes public wallet addresses and user-supplied CSV files performs none of these services, so it operates outside the CASP licensing perimeter by design.

What does identity-free tracking cost?

Privacy currently carries a price premium. Checking vendor pricing pages on July 3, 2026, we found rotki Basic at roughly €300/year (€25/month), Kubera near €230 ($249), Finary Plus at €150, and getquin Premium at €90 (vendor pricing pages, verified 2026). The premium is specific rather than universal: rotki, the only privacy-first option in that paid set, is also the most expensive of the four.

We fetched the live pricing and policy pages of 12 portfolio trackers on July 3, 2026, and recorded tiers, caps, and data practices. The pattern was consistent. Identity-hungry trackers subsidize cheap tiers with upsells, while the one privacy-first commercial option prices itself at triple the mainstream premium. Here's the full audit at a glance:

Full teardowns with verbatim quotes available on request; prices from each vendor's live pricing page, July 3, 2026.

Our own model is built so the payment rail can't undo the privacy of the product. There's a free tier for getting started. Paid plans are settled with prepaid USDC, because a card payment attaches your legal identity to your account through the payment processor, and that would defeat the entire point. Every paid plan carries a 30-day refund window, spelled out in the terms.

Does paying in stablecoins feel unusual? For most fintech, yes. For a product whose single promise is that it never learns who you are, it's the only payment method that keeps the promise end to end.

The honest trade-offs

Identity-free tracking gives up two things on purpose, and we'd rather you know them now. There's no bank auto-sync, by design. Before you count that as a loss, read Finary's own 2026 shareholder letter: "Sync issues have been our users' biggest frustration" (Finary, 2026). Auto-sync trades your credentials for a convenience that routinely breaks anyway.

The practical cost is a cadence, not a wall. Crypto positions update themselves because the chain is public. Broker positions need a CSV re-export when you trade, which for most long-term EU investors means a few minutes per month. You're exchanging a permanent credential grant for a recurring two-minute chore. In our experience, that's the cheapest privacy you'll ever buy.

The second trade-off: a read-only tracker is not an advisor, on purpose. No robo-advice, no "personalized insights" nudging you toward products, no insurance cross-sell. Advice is a regulated service under both MiFID and MiCA frameworks, and the moment a tracker sells it, its incentives stop being yours. We publish what the product does and doesn't do, including this boundary, on the transparency page.

Citation capsule: Bank auto-sync is the feature identity-free trackers give up, and its value is overstated by its own vendors: Finary's 2026 shareholder letter concedes that sync issues have been users' biggest frustration. A CSV re-export cadence replaces a permanent credential grant with a short, user-controlled monthly task.

Getting started in three steps

The timing favors you. On December 18, 2025, the European Parliament and Council agreed the updated Retail Investment framework, a package explicitly aimed at getting more citizens invested in capital markets (European Parliament, 2025). More Europeans will track portfolios next year than this one. You get to choose what that tracking costs you in privacy.

1. Join the waitlist. It takes an email alias and nothing else: request access on the homepage. No KYC, no phone number, no card.
2. Prepare your inputs. Copy one public wallet address you want to watch, or export a transactions CSV from your broker. That's the complete onboarding package for a read-only tracker.
3. Judge us by the changelog. Don't take a blog post's word for any of this. We ship in public, and the transparency page records what changed and when. Verify, then trust.

The most common hesitation we hear is "I'll set up self-hosting someday instead." Someday is doing a lot of work in that sentence. A wallet address pasted today beats a Docker stack planned for next quarter.

FAQ

Is it safe to connect my brokerage account to a portfolio tracking app?

It's a real risk you can decline to take. Connecting means your credentials or tokens live in a third-party system with financial-sector breach economics: IBM puts the 2025 average cost of a financial-services breach at $5.56M (CyberScoop, 2025). A CSV export gives a tracker the same portfolio data with zero credential exposure.

Does Plaid store my bank password?

It depends on your bank. Plaid's own help center explains that with OAuth-enabled institutions you authenticate at the bank and Plaid never sees the password, but with non-OAuth banks your credentials pass through Plaid's systems (Plaid, 2026). Many EU banks fall on the better side, but the safest credential is the one that's never shared.

Do portfolio trackers sell your data?

Selling raw data is rarer than monetizing you through it. The documented pattern is the upsell: getquin raised €12M in May 2026 to pivot into AI wealth advisory (Portage, 2026), and Finary now sells Generali life insurance in-app. Your identity plus your holdings is the targeting profile those businesses run on.

Is there a portfolio tracker that doesn't require linking accounts?

Yes, three kinds. Self-hosted open source (Ghostfolio, 8,900 GitHub stars; Wealthfolio, 7,700 as of July 2026) if you'll run a server. Local desktop tools like rotki if you're crypto-first and will pay €25/month. And hosted read-only trackers like ours, built on wallet addresses and CSVs. More detail lives in our FAQ.

Is a no-KYC tracker legal in the EU?

Yes. Under MiCA, per ESMA, the regulated crypto-asset services are custody, exchange, execution, advice, and portfolio management (ESMA, 2025 framework). A read-only tracker performs none of them, so it isn't a CASP and has no KYC obligation to impose. KYC applies where custody and execution happen: at your broker and exchange.

Conclusion

The single idea to keep: observation doesn't require identification, so a portfolio tracker that demands your identity is collecting it for a reason that isn't tracking. The funded players are pivoting to advisory and insurance, credential-holding trackers carry breach economics measured in millions, and the self-hosted escape route bills you in maintenance hours.

Read-only tracking is the missing default. Public wallet addresses and broker CSVs deliver the full net-worth picture while leaving nothing behind to breach, subpoena, or upsell against. The EU's own retail-investment push means millions more people are about to make this choice without knowing it's a choice.

What you just learned:

• Trackers need public data, not identity; KYC belongs at your broker, not your chart.
• Business-model pivots (getquin's €12M advisory raise, 2026) explain why identity gets collected.
• Stored credentials inherit $5.56M financial-sector breach economics (IBM, 2025).
• Read-only tools sit outside MiCA's CASP perimeter, legally and structurally.

If that architecture sounds like the tracker you've been waiting for, join the waitlist and watch the changelog hold us to it.

The Lab builds and operates EPT Lab (Oblyx LLC, Delaware). We audit competitor pricing and policies quarterly and publish every change to our own product on the public changelog.

Related reads

• Browse everything we've published on the blog index.
• Coming later this month: "You'll never see our face" and "The hidden cost of 'free' portfolio trackers".

Sources

• Portage, "getquin raises €12M led by State Street Investment Management and Portage", retrieved 2026-07-03, https://portageinvest.com/blog/getquin-raises-e12m-led-by-state-street-investment-management-and-portage-to-build-the-next-generation-wealth-platform-for-private-investors/
• Finary, "Shareholder Letter 2026", retrieved 2026-07-03, https://finary.com/en/product-updates/shareholder-letter-2026
• BleepingComputer, "CoinStats says North Korean hackers breached 1,590 crypto wallets", retrieved 2026-07-03, https://www.bleepingcomputer.com/news/cryptocurrency/coinstats-says-north-korean-hackers-breached-1590-crypto-wallets/
• Delta, "Introducing Delta PRO & PRO+: More Power, More Choice", retrieved 2026-07-03, https://delta.app/academy/post/introducing-delta-pro-pro-more-power-more-choice
• rotki, pricing page, retrieved 2026-07-03, https://rotki.com/
• ESMA, "Markets in Crypto-Assets Regulation (MiCA)", retrieved 2026-07-03, https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica
• CyberScoop, "IBM Cost of a Data Breach Report 2025", retrieved 2026-07-03, https://cyberscoop.com/ibm-cost-data-breach-2025/
• GitHub, Ghostfolio repository, retrieved 2026-07-03, https://github.com/ghostfolio/ghostfolio
• GitHub, Wealthfolio repository, retrieved 2026-07-03, https://github.com/afadil/wealthfolio
• EY, "How the Retail Investment Strategy aims to empower EU retail investors" (ECB data), retrieved 2026-07-03, https://www.ey.com/en_es/insights/insurance/how-the-retail-investment-strategy-aims-to-empower-eu-retail-investors
• European Parliament, "Deal on new measures to boost citizens' investments in financial markets", retrieved 2026-07-03, https://www.europarl.europa.eu/news/en/press-room/20251215IPR32220/deal-on-new-measures-to-boost-citizens-investments-in-financial-markets
• Plaid, "Does Plaid have access to my credentials?", retrieved 2026-07-03, https://support-my.plaid.com/hc/en-us/articles/4410324401047-Does-Plaid-have-access-to-my-credentials
• EUR-Lex, "Regulation (EU) 2016/679 (GDPR), Article 5(1)(c)", retrieved 2026-07-03, https://eur-lex.europa.eu/eli/reg/2016/679/oj

Educational content, not investment advice. EPT Lab is a read-only tracker; we don't sell, broker or advise on any asset.

Competitor prices and features verified July 3, 2026 against their live pages.