Privacy notice

01About this notice

This notice explains how Investbloom collects, uses, stores and discloses personal information when you use its website, iPhone app and related account services. The data controller is the individual operator identified in “Operator and contact details” within this notice. That section provides the full name, postal address and email for privacy enquiries.

02Information and purposes

For cloud accounts, we use your email address, verification status and authentication records to sign you in and protect access. We also record the version and content fingerprint of notices you acknowledge and the time you agree. A profile name, preferred title and profile email are optional. Holdings, transactions, costs, fee lines, watchlists, prices, preferences, goals, custom alert rules and contributions you supply are used to maintain your portfolio and calculate the views you request.

Tax planning is optional. Its records can include your tax year, residence information, marital status, income categories, withholding and remittance details. Enter only information needed for your own planning. Do not supply identity documents, broker passwords, bank credentials, health information or information about other people.

We process information needed to provide your requested account and features to perform our agreement with you or take requested steps before it. Limited technical and security records support our legitimate interests in preventing misuse, diagnosing failures and protecting the service, subject to your rights. Legal obligations and legal claims may also require processing. Where a feature requires consent, we ask separately and explain how to withdraw it.

A cloud account requires an email address; without it sign-in cannot work. You choose whether to add portfolio or tax records. Calculations require their relevant inputs. Support receives the email, message and attachments you choose to send. We do not obtain trades from Dime automatically or request broker credentials.

03Cloud and device storage

The website stores signed-in account records with Supabase in Singapore. Our Hostinger server in Malaysia handles website requests and account operations. Authorized administration may access records for support, an expressly requested migration, a security investigation or a legal obligation. Account access controls restrict ordinary accounts to their own ledger.

The signed-in website and iPhone app access the same cloud account. The iPhone app stores session information so you can remain signed in. New accounts start empty. An import or migration of separate records happens only when you request it. Exports can contain financial and tax records, so keep them private.

Investbloom does not separately encrypt device ledgers or exports. Device protections, cloud access controls and encrypted connections reduce risk, but no system guarantees absolute security. Protect your device and email account; never share sign-in codes.

04Providers and international processing

Supabase provides authentication and account storage, Hostinger provides hosting, and Namecheap Private Email delivers account and support email. These providers process information needed for those services and may use service providers in other countries. Information can therefore be processed outside Thailand, where protections may differ. Contact us for details of safeguards applicable to your information.

Where market access is enabled, requests include symbols or search terms and ordinary network information. The iPhone app sends account and market requests to Investbloom; our server requests supported information from the sources identified in the service, which can include Twelve Data, Yahoo Finance and Nasdaq for access that is enabled. Twelve Data is a paid provider being configured for supported data; purchasing a plan does not automatically authorize every market or unlimited redistribution. Market-provider requests do not intentionally include trade costs, account email or tax records. Available sources and coverage depend on your account and the permissions applicable to the service. This notice does not grant a licence to market data.

Google Fonts may receive your IP address and browser request information when fonts load. News and source links lead to independent websites with their own notices. Bundled logos do not need a separate provider request.

We do not sell your portfolio information, add advertising trackers or target advertisements with it. Other disclosure is limited to your instructions, a valid legal requirement or reasonably necessary protection against fraud, security incidents or legal claims.

05Cookies and notifications

Necessary sign-in cookies maintain and secure your website session. Hosting and authentication services process information such as IP address, browser details and timestamps. Investbloom has not added advertising or audience analytics cookies. Blocking necessary cookies can prevent sign-in.

Market reminders and custom alerts are optional. Your custom rules are saved with the ledger. Alert delivery history stays in this browser or device, separately for each signed-in account. Price and portfolio thresholds are checked only while the app is open; scheduled iPhone reminders can work while it is closed. Turn them off in the app or phone settings. Notification permissions and phone schedules remain on the device. Reminders may appear on your lock screen depending on your operating-system settings.

06Operator and contact details

Data controller: Atthachai Tonkhao, trading as CodeByChai. Investbloom is operated by this individual. CodeByChai is a trading name, not a separate incorporated company.

Postal address: 30 Ban Rawipha Village, Soi 39/1, Bang Chak, Udomsuk, Bangkok 10260, Thailand.

Email: support@investbloom.app. Use these details for privacy questions, rights requests, complaints or security concerns.

07Retention and deletion

We retain your active cloud ledger while you keep your account, unless you remove records sooner. Account settings provide export and deletion. Deletion removes your ledger and sign-in account from the active service. It does not erase downloads, separate device records or shared files.

Supabase makes daily database backups with seven days of available history under our current plan. Deleted information can remain in those restricted backups until expiry. Restricted encrypted operator recovery copies may also be held while needed for a recovery operation; these are reviewed and removed when no longer necessary. Restoring a backup requires reapplying subsequent deletion requests before reopening account access. Website access logs rotate daily with 14 archived rotations. Application logs have a size limit of three 10 MB files. Support correspondence and records needed for legal obligations or disputes may be retained for the period necessary for those purposes. We do not promise instant erasure from every backup.

Device records remain until removed. Losing the device or uninstalling the app can remove access. Keep independent broker statements and secure backups.

08Your rights and choices

Depending on applicable law, you may request access, a copy, correction, deletion, restriction or portability, object to certain processing, or withdraw consent. Rights can have legal exceptions. Withdrawal does not undo earlier lawful processing. Contact support@investbloom.app; proportionate verification may be needed before releasing or changing account information.

You may complain to Thailand’s Personal Data Protection Committee or another competent regulator. Contacting us first is optional. We respond within applicable legal deadlines and explain a lawful reason for refusing a request.

Investbloom is intended for people with legal capacity to use the service and is not designed for children. Contact us if a child has supplied information without necessary authorization so we can investigate.

09Purchases, service administration and communications

Where you use an available purchase feature, Investbloom processes the transaction and product identifiers, purchase environment, relevant dates and verification results needed to link the purchase to your signed-in account, verify access and handle support. Payment platforms process their own account and payment information under their notices. Investbloom does not receive an Apple password, Face ID image, face scan or full payment-card details. A clearly identified sandbox or test purchase is kept separate from a real subscription and revenue.

The operator can view service administration information, including account counts, sign-up dates and available subscription verification status, to operate the service. Administrative access is separate from ordinary account access. Operational statistics are not a public list of your holdings. We do not use your portfolio to select advertisements.

We send sign-in codes and necessary service, security and account messages to your email. These are distinct from optional promotional email. Contacting support supplies us with the information you choose to send. Please remove unnecessary personal details from screenshots and attachments.

10How to exercise your rights

Use the export and deletion controls in Settings for supported self-service requests, or email the contact shown in this notice with the account email, the right you wish to exercise and enough detail to locate the information. We do not ask you to disclose a sign-in code or broker password. Where identification is necessary, we seek proportionate evidence through an appropriate channel.

Access requests covered by section 30 of Thailand’s PDPA are handled without delay and within the applicable 30-day period. Other requests are handled within their applicable legal periods. A request may be limited where a lawful exception applies, for example to protect another person or comply with a legal obligation; we explain the relevant reason and available complaint options.

The service calculates portfolio and planning figures automatically from inputs and available data. It does not decide credit eligibility, place trades or determine tax liability on your behalf. You can correct inputs and contact support about an apparent calculation error.

11Changes and security concerns

We display the revision date and bring material changes to your attention through the service or email as appropriate. A new purpose requiring consent will have a separate choice. Acknowledging this notice is not blanket consent to optional marketing, sensitive-data processing or an unrelated use. Report suspected unauthorized access to support@investbloom.app. We investigate and make notifications required by applicable law.

12Community rankings and reviews

Leaderboard participation is optional and off by default. When you join, we calculate rankings from your investment records and share your generated alias, gain amount in USD, return percentage and rank with signed-in members. Your account identifier, email, holdings and portfolio balance are not included in the leaderboard response. Gain amounts and percentages can still allow others to infer approximate invested capital. Only share if you are comfortable with that disclosure. You can leave in Leaderboard settings; subsequent requests will exclude your account, although other people may retain screenshots or copies they already made.

A custom nickname is optional and appears only after moderation. Use a real name only if you want members to see it. Moderators can review nickname requests and remove inappropriate names. Report a name or suspected ranking error through the support link on the leaderboard. We process these choices to provide the community feature you request. All accounts may request participation; ranking eligibility depends on supported instruments and sufficient history.

We save the first-use and review-request timestamps with your account preferences to limit automatic review requests to one after at least 24 hours from first iPhone use. Automatic requests start only after App Store release. Apple decides whether its review sheet appears; Investbloom cannot see whether you submitted a rating. A Settings review action suppresses the later automatic request.