Privacy policy

Last updated 8 October 2026.

This page explains what personal data TopHolders stores, why, for how long, who else receives it, and what rights you have. It covers this website and the TopHolders application. It applies to you if you have an account with us, and also if you hold a token that one of our customers tracks.

1. What we store and why

Your account

  • Your email address, and your password, which we store only as a one-way hash.
  • If you sign in with Google: the account identifier Google gives us and the email address on that Google account.
  • Whether you have verified your email address, and when we last sent a link.
  • The workspaces you belong to, your role in each, and the company name you give a workspace.
  • Your sign-in sessions: a random token (we store only its hash), and when the session was created, last used and will expire.
  • Invitations: the email address a workspace owner invites, and who invited it.

We need these to create your account, sign you in and keep it secure.

Payments

Plans are paid in USDC on the Base blockchain. For each payment we store the wallet address it came from, the transaction hash, the amount and the block it was recorded in. For a refund we store the address it was sent to. All of this is also public on the blockchain.

Notification settings

If you connect Telegram, Discord or Slack, we store the bot token or webhook address you enter (encrypted) and the Telegram chat id, so alerts can be delivered there. A workspace may also store an email address for notifications.

Wallets our customers track

Our customers are token projects. For each token a workspace tracks, we store data about the wallets that hold it:

  • Wallet addresses, token balances and their value, and token transfers, read from public blockchains.
  • Labels from data providers saying that a wallet belongs to a known entity, such as an exchange or a fund.
  • Names a wallet has published for itself through ENS or Basenames, and public Farcaster profiles linked to a wallet (username, display name, profile picture, bio) together with X accounts verified on Farcaster.
  • Anything a customer types in about a holder: a name, an email address, notes, and the history of changes a customer makes to that record.

We use this to show a token project who its largest holders are, where their holdings move, and how to reach them. Labels and profiles are looked up only for a workspace's largest holders, not for every wallet.

Technical data

Our servers see your IP address with every request. We use it to limit how often one address can call sign-in and similar endpoints, and our application server writes it to its request log.

2. Where data comes from

Account, payment and notification data comes from you. Data about tracked wallets does not: it comes from public blockchains, from the wallet-data providers listed in section 4, from the public ENS, Basenames and Farcaster networks, and from what our customers enter themselves.

4. Who else receives data

These providers process data for us:

  • netcuphosts the servers this service runs on, in its data centres.Receives: everything described on this page, because it is stored on those servers
  • Googleprovides "Continue with Google" sign-in.Receives: only when you click Continue with Google: your browser then loads Google’s sign-in script and sends the sign-in request to Google. We receive your Google account identifier and email address back.
  • Resenddelivers the account emails this service sends: address verification, password reset, workspace invitations, and a warning when someone tries to register your address again.Receives: the recipient email address and the content of that email
  • Sentryrecords server errors so we can fix them.Receives: technical error reports: the error message, the program location, the requested URL without its query string, and a numeric workspace id. Request bodies, cookies, headers, IP addresses and wallet addresses are removed before a report is sent.

These providers receive wallet addresses tracked by a workspace:

  • Ankrreads token holder lists, balances and transfers from public blockchains.Receives: token contract addresses and the wallet addresses whose transfers we read
  • Alchemynotifies us of new transfers by watched wallets, supplies token prices, and reads the names wallets declare for themselves (ENS, Basenames).Receives: the wallet addresses being watched or looked up
  • Mobulalabels wallets that belong to known entities.Receives: the addresses of a workspace’s largest holders
  • Neynarfinds public Farcaster profiles, and X accounts verified on Farcaster, linked to a wallet.Receives: the addresses of a workspace’s largest holders

Looking up a Basename may also send a request to the off-chain service that name's resolver contract points to. Providers of token prices and trading-pool data receive only token contract addresses, never a wallet address or account data.

Alerts go to the Telegram, Discord or Slack destinations a workspace sets up, on that workspace's instruction. If you connect a wallet to pay through WalletConnect, WalletConnect relays the connection between your wallet and this site.

Some of these providers are based outside the European Union and the European Economic Area. Transfers to them are safeguarded as follows:

  • Google: Google LLC (USA) is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing adequate protection (Art. 45 GDPR). For users in the EU, Google Ireland Limited is responsible for your Google account.
  • Sentry: Functional Software, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Our data processing agreement with Sentry also includes the EU Standard Contractual Clauses as a fallback (Art. 46(2)(c) GDPR).
  • Resend: Plus Five Five, Inc. (USA) is listed under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and its data processing agreement with us also includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
  • Alchemy: Alchemy Insights, Inc. (USA) is not certified under the Data Privacy Framework. Its data protection addendum, which applies to our account, includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
  • Mobula: Mobula Labs SAS is based in Paris, France, so sending data to it is not a transfer outside the EU.
  • Ankr Inc. and Neynar, Inc. (both USA) are not certified under the Data Privacy Framework and offer no Standard Contractual Clauses. They receive only public blockchain addresses. For these transfers there is currently no safeguard under Art. 45 or 46 GDPR.
  • WalletConnect: reown inc. (USA), which provides our access to the WalletConnect network, is not certified under the Data Privacy Framework and offers no data processing agreement. Its privacy policy states that it may rely on the EU Standard Contractual Clauses for transfers from the EU.

5. How long we keep data

  • Your account stays until you delete it. You can delete it yourself under Settings; that deletes your account and signs out every browser it was signed into. A workspace you own is deleted, with all its data including the wallet data described above, when you ask us by email; we do that within 30 days.
  • Payment records (subscriptions, payments, refunds) are kept when a workspace is deleted, because they are our accounting record. German tax law requires us to keep accounting records for 8 years (§ 147 AO, § 14b UStG); after that we delete them.
  • If you delete your account but a workspace you belonged to continues, your user record in that workspace, including your email address, stays, so its record of who did what stays accurate.
  • A sign-in session ends after 12 hours without use, and after 7 days at most.
  • IP addresses held for rate limiting expire with the limit's time window, at most one hour.
  • Server logs are kept to a fixed size and the oldest entries are overwritten; how many days that covers depends on traffic.
  • We keep a nightly backup of the database. The newest 7 are kept on the server, and copies are pulled to a separate computer, where the newest 14 are kept. Deleted data therefore remains in backups until those are replaced.
  • Data about tracked wallets stays while the workspace that tracks it exists.

6. Who is responsible for your data

The controller responsible for your data under the GDPR is:

Daniil KirillovEmail: kirillov@topholders.xyzPostal address: see our Imprint

Write to that email address with any question or request about your data.

One exception: names, email addresses and notes that a customer types in about a holder are that customer's own records. For those, the customer is the controller and we process the data on their behalf (Art. 28 GDPR). Our data processing agreement is Part B of our Terms of Service.

7. Your rights

You have the right to:

  • access the data we hold about you (Art. 15 GDPR);
  • have incorrect data corrected (Art. 16);
  • have your data erased (Art. 17);
  • have its processing restricted (Art. 18);
  • receive your data in a portable format (Art. 20);
  • object to processing based on legitimate interest, on grounds relating to your situation (Art. 21);
  • lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or where you think the infringement took place (Art. 77).

These rights also apply if you hold a token that a customer tracks. Write to the email address in section 6 and name the wallet address concerned.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).

8. Cookies and storage in your browser

We set one cookie, and only when you sign in: a session cookie that keeps you signed in. It holds a random token, cannot be read by scripts on the page, and expires after 7 days at most. It is strictly necessary for the service you asked for, so it needs no consent. We set no analytics or advertising cookies.

The application also keeps a few entries in your browser's local storage:

  • whether you collapsed the sidebar;
  • during a payment, a key and the transaction hash that let an interrupted payment be resumed instead of paid twice;
  • the wallet connection you chose for paying, kept by the wallet library.

If Google sign-in is offered, our pages load nothing from Google until you click Continue with Google. That click loads Google's sign-in script from Google's servers, and from then on Google may read and set its own cookies under its own privacy policy.

9. Changes

We will update this page when what we store or who receives it changes. The date at the top says which version you are reading. See also our imprint.