The short answer
- An account exists mainly to enable sync across devices and server-side price refresh. Everything else it is used for is optional.
- The cost is a permanent, identifiable record of your net worth on someone else's server — breachable, sellable in an acquisition, and outside your control.
- A local-only tracker removes that record entirely. The genuine trade-offs are multi-device sync, backup responsibility, and web access.
- Those trade-offs are solvable with device-level cloud backup and file export. They are not solvable by trusting a privacy policy.
What the signup step is actually for
It is easy to assume every account requirement is a data grab. It usually is not, at least not initially. There are three legitimate engineering reasons a tracker asks you to register:
- Cross-device sync. If your holdings live on a server, your phone and your laptop see the same portfolio without you doing anything. This is the genuine, honest reason, and it is the one users actually feel.
- Server-side price refresh. A backend can poll market data once for ten thousand users instead of ten thousand devices each polling for themselves. That is cheaper for the operator and gentler on the data provider's rate limits.
- Subscription state. Somebody has to know whether you are on the paid tier. Though note: the app stores already solve this, which is why an account is not strictly required for it.
Notice what is missing from that list. None of those reasons require the server to store what you own in a form the operator can read. Sync could be end-to-end encrypted. Price refresh only needs ticker symbols, not who holds them. Yet the overwhelmingly common architecture stores your holdings in plaintext against your email address, because that is simply the path of least resistance when you are building quickly.
What that record actually is
A portfolio is unusually sensitive data, and it is worth being precise about why. Held together in one place, it discloses:
- Your approximate net worth, and its trajectory over time
- Your income pattern, inferable from the timing and size of contributions
- Your risk appetite, employer (via vested stock), and country of tax residence
- Your retirement timing, if you have entered a FIRE target
That combination is worth considerably more to a data broker than a browsing history, and it is close to the top of what an attacker would choose to steal. It is also permanent in a way that a password is not: you can rotate a credential after a breach, but you cannot un-disclose that you held €400,000 in 2026.
The privacy policy you agreed to binds the company that exists today. Privacy policies are routinely rewritten after an acquisition, and the data transfers with the company as an asset. Several well-known finance apps have changed their data practices materially after being bought — not through bad faith, but because the new owner had a different business model. A promise is not an architecture.
What a local-only tracker changes
The alternative is straightforward: keep the holdings on the device, and never transmit them anywhere. The app still fetches prices — it has to, prices live on the internet — but a price request only needs to say "what is AAPL worth?" It never needs to say who is asking or how many shares they hold.
This is the architecture Portfolio On Fire uses, and the security property it produces is categorical rather than incremental: there is no server of mine holding your holdings, so there is no server of mine that can be breached, subpoenaed, or sold. The absence is the feature.
The honest trade-offs
Local-only is not free. Anyone telling you it has no downsides is selling something. Three real ones:
| Trade-off | What it means | How it is handled |
|---|---|---|
| Multi-device sync | No server means no automatic sync between your phone and tablet | Device-level cloud backup (your iCloud / your Google account), plus JSON export you can move manually |
| Backup responsibility | Lose the device without a backup and the data is genuinely gone | Automatic backup to your own cloud on Pro; manual JSON export on every tier including free |
| No web dashboard | You cannot open your portfolio in a browser on a work laptop | Not solved. If a browser dashboard is essential to you, local-only is the wrong choice |
That last row is the one people underestimate. A local-only tracker is a genuinely worse fit if you need to check holdings from a machine you do not own. It is worth being clear about that rather than pretending the trade does not exist.
When an account-based tracker is the better choice
Straightforwardly: pick a server-backed tracker if you need real-time sync across several devices and several people, if you want a browser dashboard, if you need automated broker connections that pull transactions without you exporting anything, or if you would rather someone else be responsible for backups than hold that responsibility yourself.
Those are legitimate requirements. If they describe you, the honest recommendation is to choose a well-run service with a clear privacy policy, turn on two-factor authentication, and accept the trade knowingly. That is a reasonable decision. The unreasonable version is making that trade without noticing you made it.
What to check before trusting any tracker
Whichever direction you go, these five questions separate the trustworthy from the merely confident:
- Can you get your data out? Look for a full export in an open format, available on the free tier. Export locked behind the paid plan is a lock-in mechanism wearing a feature's clothes.
- What does the app store privacy label say? It is a declaration the platform audits, which makes it worth more than the marketing copy.
- Does the app work in flight mode? If everything except live prices keeps working offline, the data is genuinely local.
- How does it make money? Subscription, ads, broker referrals, or data. Only one of those four aligns the operator's incentives with yours.
- Does the marketing site track you? Open the network tab and count third-party domains. A privacy product with analytics on its landing page has already told you where the line sits.
Portfolio On Fire: full JSON export on every tier including free; no account to create; works offline apart from price refresh; funded solely by a €1.99 subscription; and this website loads zero third-party scripts. The last one you can confirm right now with your browser's network tab, without taking my word for it. The reasoning is set out on the about page.
Getting your existing portfolio in
The usual objection to a local-only tracker is the migration: without a broker connection, does that mean typing everything by hand? No. A CSV export from your broker imports directly — DeGiro exports are parsed natively, including the Dutch and English column variants, and the import process is documented step by step. Holdings from an earlier JSON export restore as well, and manual entry detects countries, currencies and tickers for you.
Once holdings are in, the same data drives dividend forecasting and the FIRE projection — both computed on the device, from numbers that never left it.