A secure portfolio tracker that can look, never touch
Allown sees your accounts, but it can never trade or move your money. Here is everything it does to keep it that way.
Connections that can only read
Read-only keys, checked when you connect
When you connect an exchange, Allown asks it what the key is allowed to do. A key that could trade or withdraw is refused, and you’re asked for a read-only one instead.
Nothing to trade with
Brokers connect with read-only tokens and wallets with their public address. Allown never holds anything that could place an order or move money.
Keys encrypted, never shown again
Keys and tokens are encrypted with AES-256-GCM and decrypted only in memory while a sync runs. They are never sent back to your browser: you see only a masked reference like U•••4821.
Files read once
Statements and CSV files you upload are read once to bring in your history. The files themselves aren’t kept.
Your account, protected
Two-factor sign-in
Add an authenticator app (1Password, Google Authenticator, Authy…) so a password alone can’t open your account. Backup codes get you in if you lose your phone.
See where you’re signed in
Settings lists every device signed in to your account, with its browser and when it was last used. Sign one out, or all the others at once.
Guessing gets nowhere
Passwords are stored only as a one-way hash that nobody can read back, and sign-in attempts are limited to slow down anyone trying to guess.
Hide your amounts
One click hides every amount on screen, for when someone is looking over your shoulder.
Your data, under your control
Only what Allown needs
An email and a password to sign in, and the name you’d like to be called. Allown never asks for documents or bank details.
Only you see your portfolio
Every request is checked to be yours before anything is read or changed. Friends you add see only percentages, never amounts, and only what you choose to share.
No ads, no selling
Your data runs Allown for you and nothing else. We don’t sell it, rent it or show you ads.
Stored in the EU
Allown runs on servers in Germany, with HTTPS everywhere and a strict content security policy on every page. Only the operator can reach the servers, with a key, never a password.
Analytics only if you say yes
Visits are counted only with your consent, and analytics never sees your amounts, holdings or account names.
Delete everything in one step
Deleting your account in Settings removes your accounts, history, keys and notes at once. Nightly backups are overwritten within 14 days.
Questions people ask
Is it safe to connect Allown to my broker or exchange?
Yes. Allown accepts only read-only access: a key that could trade or withdraw is refused when you connect it, so even in someone else’s hands it couldn’t move a cent.
What does Allown ask for when I sign up?
An email and a password to sign in, and the name you’d like to be called. Allown never asks for documents or bank details.
Can Allown trade or withdraw from my accounts?
No. Allown has no way to place an order or move money anywhere; it only reads balances and history.
How are my API keys stored?
Encrypted with AES-256-GCM on servers in the EU, decrypted only in memory for the moment a sync runs, and never sent back to your browser.
Does Allown have two-factor authentication?
Yes. Turn it on in Settings with any authenticator app; backup codes let you in if you lose your phone. If you sign in with Google, Google’s own 2-Step Verification protects it.
What happens to my data if I delete my account?
Everything is removed at once: accounts, history, keys, notes and price alerts. Nightly backups are overwritten within 14 days.
Every detail of what Allown keeps, why and who else sees any of it is in the privacy policy. Read the privacy policy
See all of it in one place
Add an account by hand, from a CSV or with a read-only connection. It takes a couple of minutes.
Get started