Crypto portfolio trackers compared: accounts, privacy and what each can see
A portfolio tracker knows what a person holds, what they paid for it and, through exchange keys or wallet addresses, often where it sits. Most trackers keep that on their own servers behind an email login. A few keep it on the user's device, and one or two encrypt it so that not even the company running the service can read it. Which design a tracker uses matters more than any feature it lists.
Which crypto portfolio tracker is the most private?
The ones that need no account and keep holdings on the device: Rotki (local and open source, with encrypted sync), CoinSpectrum (in the browser, with optional end-to-end encrypted sync and no email), and a self-hosted Ghostfolio. Trackers that require an account — CoinStats, CoinMarketCap, CoinGecko, CoinTracker, Koinly, Kubera — store holdings on servers they can read.
Three designs, three kinds of exposure
On the device. Holdings live in the app or the browser, and nothing about them leaves unless the user turns sync on. Rotki and CoinSpectrum work this way. The risk is the device itself, and losing it without a backup.
On the company's servers, behind an account. Holdings, the email address and usually the exchange keys sit in one database the company can read. That is what makes syncing across devices and tax reports easy, and it is also what a breach exposes: most of the incidents in the table below are leaks of exactly these customer lists, usually through an email or analytics vendor, and a list of people known to hold crypto is a phishing list.
Watching public addresses. Zerion and similar dashboards need no account at all: they read a wallet's public balance from the chain. Nothing secret is handed over, but the tracker still sees which addresses one visitor looks at together, and can link them.
Portfolio trackers compared
| Tracker | Account | Where holdings live | How holdings get in | Free tier and price |
|---|---|---|---|---|
| CoinSpectrum | Not needed; optional account with no email | In the browser; optional sync is end-to-end encrypted | Manual entry | Free |
| Rotki | Local only; a rotki.com account only to pay | On the device, encrypted; paid sync uploads it already encrypted | Addresses, exchange API keys, CSV | Free with a 1,000-event limit; €9–45 a month |
| Ghostfolio | Self-hosted, or a no-email token login | Your own server, or the hosted service | Manual entry, JSON import | Free and open source; hosted premium |
| Zerion | None: watch an address or connect a wallet | Public chain data, read on its servers | Wallet addresses | Free; Premium $99 a year for one wallet |
| Delta | Optional (eToro sign-in); a legacy no-account mode | Synced through eToro when signed in | Exchanges, brokers and wallets | Free for 10 assets; paid PRO tiers |
| CoinStats | Required: email, Google, Apple or Facebook | Company servers; encrypted, not end to end | Manual, exchange read access, addresses | Free tier; Premium $13.99 a month |
| CoinMarketCap | Required for the portfolio | Company servers | Addresses, exchange sign-in, manual, Binance sync | Free |
| CoinGecko | An account to save it | Company servers | Manual entry, wallets | Free for 2 wallets and 500 manual transactions; Premium $10 a month |
| CoinTracker | Required: email, Google, Coinbase or Apple | Company servers | Wallets, exchange APIs, CSV | Free tracking; paid tax plans |
| Koinly | Required: email, Google or Coinbase | Company servers; encrypted at rest, not end to end | Exchange APIs, addresses, CSV | Paid tax plans per tax year |
| Kubera | Required | Company servers; "NOT end-to-end encrypted", in its own words | Exchange OAuth and API keys, addresses, manual | No free plan; $2,499 a year |
As of 16 October 2026, from each tracker's own site, privacy policy, pricing page or app-store listing, and reporting on incidents; see the sources at the end. "None found" is a search result, not a guarantee. Prices change; the tracker's own page is the authority.
What the record shows
- CoinStats, June 2024: the private keys of 1,590 wallets hosted inside CoinStats were stolen, about $2.2 million; connected exchanges and outside wallets were not affected.
- CoinGecko, June 2024: a breach at its email provider exported 1.9 million contacts, later used for phishing; no passwords were exposed.
- CoinTracker, December 2022: user email addresses exposed through its email vendor, SendGrid.
- Koinly, December 2025: email addresses possibly exposed through the analytics vendor Mixpanel; Koinly says wallet and tax data were never shared with it.
- CoinMarketCap, October 2021: 3.1 million email addresses tied to accounts were offered for sale; CoinMarketCap denied a breach of its servers.
No incident was found for Rotki, Ghostfolio, Zerion, Delta or Kubera. Four of the five above were leaks of customer lists through a vendor, which is the risk any account-based tracker carries; a tracker that never holds an email address has none to leak.
How the CoinSpectrum tracker works
Holdings are recorded on the ranking with ＋ on any row: a quantity and what it cost, from which the tracker shows value and profit or loss at live prices. There can be several portfolios and a favourites list. All of it is kept in the browser, and none of it needs an account.
An account only adds a second, synced copy, and it does not need an email address. It signs in with a 12-word Bitcoin Cash seed phrase, a WIF key or WizardConnect from a wallet such as Paytaca, Cashonize or Electron Cash; an email can be added for recovery codes, but nothing requires it. The synced copy is encrypted in the browser before it leaves: the server stores ciphertext it cannot read, and the seed phrase never leaves the device. A signed-in user can also lock the copy on the device behind a PIN.
What it does not do, plainly: holdings are entered by hand, with no exchange API sync, no wallet address watching and no tax reports. It suits someone who wants an accurate picture of what they hold without telling anyone; anyone who needs automatic imports or tax forms is better served by Rotki, which also keeps data local, or by an account-based service with that trade-off accepted.
Trackers that closed, and what happened to the data
Blockfolio was bought by FTX in 2020 and stopped working after FTX's bankruptcy in November 2022. Accointing was sold by Glassnode to Blockpit in 2023 and closed, with users offered a migration. Zapper shut its website, apps and API on 3 August 2026. When a server-side tracker closes, the history kept there goes with it unless it was exported in time; a tracker that keeps data on the device, or one that can be self-hosted, has no such cliff.
Which to use
- Privacy first, manual entry is fine: CoinSpectrum, or a self-hosted Ghostfolio.
- Privacy first, with imports and tax reports: Rotki.
- DeFi positions across EVM wallets: Zerion, by watching public addresses.
- Automatic sync with exchanges, accepting an account: CoinStats or Delta.
- Tax reports, accepting an account: Koinly or CoinTracker.
Whatever the choice, read-only exchange API keys are the only kind to give a tracker, and a portfolio app is not a wallet: CoinStats' 2024 theft hit only wallets the app itself hosted.
Questions
Which crypto portfolio tracker does not need an account?
CoinSpectrum, Rotki and Zerion all work without one. CoinSpectrum and Rotki keep holdings on the device; Zerion reads public wallet addresses. Delta also has a legacy mode without an account.
Can I track a crypto portfolio without giving an email address?
Yes. CoinSpectrum's tracker works without any account, and its optional synced account signs in with a 12-word seed phrase or WizardConnect instead of an email. Rotki keeps a local account only, and Ghostfolio offers a token login with no email.
Are crypto portfolio trackers safe?
A tracker that only reads balances cannot move funds, so the main risk is the data: an account-based tracker holds a list of people who own crypto and what they own, and several such lists have leaked through email and analytics vendors. Give only read-only exchange keys, and prefer a tracker that keeps data on the device or encrypts it end to end.
What do users weigh when choosing a crypto portfolio tracker?
Mainly three things: how holdings get in (manual entry, exchange sync or wallet addresses), whether an account and email are required, and the price of the tier they need. Tax reports and DeFi coverage decide it for some; privacy decides it for others.
Does CoinSpectrum's portfolio tracker sync with exchanges?
No. Holdings are entered by hand and kept in the browser. That is the trade-off for needing no account and sending nothing to a server; an optional account adds end-to-end encrypted sync between devices.
Sources
- Rotki — plans and encrypted sync; source code
- Ghostfolio — source code and login options
- Zerion — watch an address; privacy policy; Premium
- Delta — syncing and the legacy mode; App Store listing
- CoinStats — privacy policy; pricing; The Block: the 2024 theft
- CoinMarketCap — how the portfolio works; Have I Been Pwned: the 2021 email list
- CoinGecko — pricing; Cointelegraph: the 2024 email provider breach
- CoinTracker — CoinTracker: the SendGrid breach
- Koinly — security page; Cryptonews: the Mixpanel exposure
- Kubera — security page; pricing
- Closed trackers — The Block: Zapper shuts down; Blockpit: Accointing