What a Portfolio Tracker Can Actually See

The question behind the question is usually simpler than the way people ask it. Nobody really wants a taxonomy of API scopes. They want to know whether handing an app access to their exchange means a stranger can now watch them, and whether that stranger could take anything.

The answers are yes to the first part, in a specific and limited way, and no to the second. Here is the full accounting.

What does a connected account hand over?

For an exchange connection, a tracker sees whatever the API key's read permission covers. In practice that means balances broken down by asset, open positions, order history, executed trades with prices and timestamps, deposit and withdrawal records, and the shape of your account where the exchange exposes sub-accounts.

That is a genuinely detailed picture. Trade history is not just what you hold; it is when you bought, at what price, how often you trade, and how you behaved during the last drawdown. Someone reading it carefully could describe your strategy back to you.

It is also bounded by scope. A key issued for the spot wallet alone shows spot balances and nothing more, which is why so many people's tracked total comes in low and why a wrong portfolio balance is usually a permissions story rather than a bug. The tracker is not choosing what to withhold. It is receiving exactly what the exchange decided to answer.

For a watched wallet address, the tracker sees what the blockchain publishes, which is everything. Balance, every token held, every transaction in and out since the address was created, and every counterparty address involved. It sees this because you do not need permission to read a public ledger, a point that turns out to matter more than people expect.

What can it never see?

Your private keys. Your seed phrase. Your exchange password. The secret behind your two-factor authenticator. Any credential that would let it act as you rather than merely read about you.

This is not a matter of restraint. Those secrets are never transmitted. A read-only exchange connection uses a key and secret that you generate inside your own already-authenticated session on the exchange's website, which is why a legitimate tracker never asks you to log in to your exchange through its interface. A watched wallet address is derived from a public key; the private key that controls it never leaves your wallet software or your hardware device, and a block explorer query does not touch it.

The consequence is the one that matters. A tracker cannot move funds. Not with a leaked key, not with a compromised server, not with a malicious employee. Moving funds requires either a withdrawal-permissioned API key or a signature from a private key, and a portfolio tracker holds neither. Read-only API keys covers why the exchange, not the app, is the thing enforcing that.

Any app that asks for a seed phrase during setup is not a portfolio tracker. It is a theft mechanism wearing the interface of one, and the request itself is the whole of the evidence you need. Never share your seed phrase covers the scripts these attacks use.

What can the company itself see?

Separate question, and the one people skip.

Assume the operator can see your holdings. Your total, your allocation across assets, your trade history within the scope of the keys you granted, and the email address you signed up with. Assume it also sees the ordinary telemetry any mobile app collects: device model, operating system version, approximate location from IP, when you open the app, what you look at.

Assume, further, that it sees your watchlist and your alerts, and understand that this is often the more revealing dataset. Your portfolio says what you own. Your watchlist says what you are thinking about buying, and your alert thresholds say at what price. Aggregated across millions of users, that is a genuinely valuable signal about market sentiment, which is worth knowing about whether or not any particular company acts on it.

What a good operator does with all this is limited by its privacy policy, its jurisdiction and its internal access controls. What you can verify from the outside is close to nothing. So the useful posture is not to look for a company you can prove is trustworthy. It is to decide what you are comfortable being known, connect that, and keep the rest out. A cold-storage holding entered as a manual position contributes to your total without exposing an address or a credential to anyone, and tracking a hardware wallet covers the same trade for a device you deliberately keep offline.

What does a public address reveal to anyone at all?

This is where the honest answer gets uncomfortable, and it has nothing to do with trackers.

A blockchain address is public by construction. Its balance and its complete history are readable by anyone on earth with a browser, using a free explorer like Etherscan or mempool.space. No account, no permission, no notification to you. The data is permanent, and it is retroactive: an address you used in 2019 still publishes what it did in 2019.

The risk is not the address in isolation. It is linkage. The moment one address is tied to your identity, whether through a KYC exchange deposit, an ENS name, a donation you posted, an NFT you display, or a screenshot with a truncated address in it, everything that address ever touched becomes attributable to you. Chain analysis firms do this professionally, and the clustering heuristics are good.

So tracking a wallet in an app does not create this exposure. It already existed the moment the address received its first transaction. What the tracker adds is a link between that public address and your email account inside one company's database. The wallet privacy trade-off makes the full case, including the mitigations that actually work and the ones that only feel like they do.

How much of this can I reduce?

More than people assume, at a cost in convenience that is worth weighing rather than dismissing.

Connect the exchange accounts holding the bulk of your position, because that is where a tracker earns its keep and where the balances change fastest. Keep long-term cold storage as a manual entry. Use a separate API key per service so revoking one does not break another, and so a leak identifies its own source. Turn on IP allowlisting at the exchange wherever it is offered. Review your connections quarterly and remove the ones you stopped using, since a dormant connection carries the same exposure as an active one with none of the benefit. Auditing your tracker folds that review into a check you were going to do anyway.

The version of this that actually holds is not maximum secrecy. It is knowing precisely which facts about you exist in which places, and having chosen each one on purpose.