Privacy notice

1. Who is responsible

Atthachai Tonkhao, trading as CodeByChai operates Investbloom as an individual and is responsible for its handling of personal information. CodeByChai is a trading name, not a separate company.

Postal address: 30 Ban Rawipha Village, Soi 39/1, Bang Chak, Udomsuk, Bangkok 10260, Thailand. Email: support@investbloom.app. Use these details for privacy questions or requests about your information.

2. Information and purposes

For cloud accounts, we use your email address, verification status and authentication records to sign you in and protect access. We also record the version and content fingerprint of notices you acknowledge and the time you agree. A profile name and profile email are optional. Holdings, transactions, costs, fee lines, watchlists, prices, preferences, goals and contributions you supply are used to maintain your portfolio and calculate the views you request.

Tax planning is optional. Its records can include your tax year, residence information, marital status, income categories, withholding and remittance details. Enter only information needed for your own planning. Do not supply identity documents, broker passwords, bank credentials, health information or information about other people.

We process information needed to provide your requested account and features to perform our agreement with you or take requested steps before it. Limited technical and security records support our legitimate interests in preventing misuse, diagnosing failures and protecting the service, subject to your rights. Legal obligations and legal claims may also require processing. Where a feature requires consent, we ask separately and explain how to withdraw it.

A cloud account requires an email address; without it sign-in cannot work. You choose whether to add portfolio or tax records. Calculations require their relevant inputs. Support receives the email, message and attachments you choose to send. We do not obtain trades from Dime automatically or request broker credentials.

3. Cloud and device storage

The website stores signed-in account records with Supabase in Singapore. Our Hostinger server in Malaysia handles website requests and account operations. Authorized administration may access records for support, an expressly requested migration, a security investigation or a legal obligation. Other account holders cannot access your ledger through their accounts.

The separate device version keeps its ledger on your Mac or phone. These ledgers do not automatically synchronize with each other or the website. New cloud accounts start empty; migration requires an express request. Exports can contain financial and tax records, so keep them private.

Investbloom does not separately encrypt device ledgers or exports. Device protections, cloud access controls and encrypted connections reduce risk, but no system guarantees absolute security. Protect your device and email account; never share sign-in codes.

4. Providers and international processing

Supabase provides authentication and account storage, Hostinger provides hosting, and Namecheap Private Email delivers account and support email. These providers process information needed for those services and may use service providers in other countries. Information can therefore be processed outside Thailand, where protections may differ. Contact us for details of safeguards applicable to your information.

Where market access is enabled, requests include symbols or search terms and ordinary network information. The device app requests supported prices, search and exchange rates from Yahoo Finance and dividend information from Nasdaq. These requests do not include your trade costs or tax profile. Public cloud market access is currently disabled.

Google Fonts may receive your IP address and browser request information when fonts load. News and source links lead to independent websites with their own notices. Bundled logos do not need a separate provider request.

We do not sell your portfolio information, add advertising trackers or target advertisements with it. Other disclosure is limited to your instructions, a valid legal requirement or reasonably necessary protection against fraud, security incidents or legal claims.

5. Cookies and notifications

Necessary sign-in cookies maintain and secure your website session. Hosting and authentication services process information such as IP address, browser details and timestamps. Investbloom has not added advertising or audience analytics cookies. Blocking necessary cookies can prevent sign-in.

Market reminders are optional device notifications. Turn them off in the app or phone settings. Permissions and schedules remain on the device. Reminders may appear on your lock screen depending on your operating-system settings.

6. Retention and deletion

We retain your active cloud ledger while you keep your account, unless you remove records sooner. Account settings provide export and deletion. Deletion removes your ledger and sign-in account from the active service. It does not erase downloads, separate device records or shared files.

Supabase makes daily database backups with seven days of available history under our current plan. Deleted information can remain in those restricted backups until expiry. Restricted encrypted operator recovery copies may also be held while needed for a recovery operation; these are reviewed and removed when no longer necessary. Restoring a backup requires reapplying subsequent deletion requests before reopening account access. Website access logs rotate daily with 14 archived rotations. Application logs have a size limit of three 10 MB files. Support correspondence and records needed for legal obligations or disputes may be retained for the period necessary for those purposes. We do not promise instant erasure from every backup.

Device records remain until removed. Losing the device or uninstalling the app can remove access. Keep independent broker statements and secure backups.

7. Your rights and choices

Depending on applicable law, you may request access, a copy, correction, deletion, restriction or portability, object to certain processing, or withdraw consent. Rights can have legal exceptions. Withdrawal does not undo earlier lawful processing. Contact support@investbloom.app; proportionate verification may be needed before releasing or changing account information.

You may complain to Thailand’s Personal Data Protection Committee or another competent regulator. Contacting us first is optional. We respond within applicable legal deadlines and explain a lawful reason for refusing a request.

Investbloom is intended for people with legal capacity to use the service and is not designed for children. Contact us if a child has supplied information without necessary authorization so we can investigate.

8. Changes and security concerns

We display the revision date and bring material changes to your attention through the service or email as appropriate. A new purpose requiring consent will have a separate choice. Report suspected unauthorized access to support@investbloom.app. We investigate and make notifications required by applicable law.