Privacy Policy
This policy explains what information Asset Flow Portfolio (“Asset Flow”, “we”, “our”) uses when you visit the website or use your portfolio dashboard.
01 Overview
The website identifies its operator as “ASP Group”. The exact registered legal-entity name, registered address and jurisdiction have not been supplied in the project information; they are therefore not represented here as verified facts.
02 Information you may provide
- Account details such as your name, email address and phone number when you register or submit a request.
- Portfolio records you enter, which may include holdings, quantities, purchase values, dates, watchlist items, goals, dividends, reminders and performance information.
- Subscription or trial request information used to administer access. Do not enter bank passwords, card PINs, OTPs or other login credentials for financial institutions.
- Telegram account/chat identifiers where Telegram portfolio reporting is configured for an account.
03 How information is used
We use this information to sign you in, save and show your portfolio records, calculate portfolio summaries, provide market data, manage trials and subscriptions, and send Telegram reports if you turn that feature on. We may also use it to fix problems and protect the service.
04 Storage and service providers
The application source code is configured to use Firebase Authentication and Cloud Firestore under the Firebase project asset-flow-portfolio-1828, with backend Cloud Functions deployed in the asia-south1 region. Portfolio records are organised under account-specific user records in Firestore. The exact data-centre location, backup period and data-retention period depend on the Google/Firebase settings and terms. The website code does not set a separate retention period.
Market information features call external data sources, including MFAPI and a Google Sheets-based mutual-fund data source. When Telegram reporting is enabled, report content is sent to the Telegram Bot API for delivery to the linked Telegram chat. Those providers process information under their own terms and privacy practices.
05 Who can access portfolio information
Firestore security rules in the supplied application configuration restrict a signed-in user’s direct reads to that user’s own users/{userId} records. Direct writes to those records are conditioned on the application’s Pro-access check. Sensitive collections such as subscription records, staff records, client profiles and administrative records deny direct client read/write access in the supplied rules.
Some server functions use Firebase Admin tools with special permissions. These functions are not limited by the same rules as normal website users. The supplied code includes verified-administrator checks on administrative workspace and Telegram-client management functions. This means authorised administrators may access some account or portfolio information when needed to run the service. We do not claim that client-side hiding alone provides security; server-side checks are also required.
06 Telegram reports
If you link Telegram reports, the information needed for your report is sent to Telegram and delivered to the chat you linked. Telegram is a separate service. Do not link a chat or enable reporting unless you understand that the report will be delivered to that chat. The project code includes scheduled reporting and administrator-triggered report delivery.
07 Retention and deletion
The supplied project does not set a full data-retention schedule or provide an automatic account and portfolio deletion button. If you want to request correction or deletion of account or portfolio information, contact the service operator using the support channel shown in the website/dashboard and identify the account email. We will need to verify the request before taking action. Some records may need to be retained where required for security, service administration or legal obligations. No fixed response time is promised by this policy.
08 Security
The application uses Firebase Authentication, account-scoped Firestore rules and server-side administrator checks in the supplied source. No online service can be guaranteed to be completely secure. Do not share your password or one-time codes, and sign out on shared devices. This policy does not make an unverified claim about encryption configuration, independent security certification or penetration-test results.
09 Children
The service is intended for adults managing their own investment records. It is not designed for children.
10 Changes to this policy
We may update this policy as the service and its data practices change. The effective date above will be updated when a revised policy is published. Please review this page periodically.
11 Contact
For privacy questions or data requests, use the support channel shown on the website or in your dashboard. The project files provided for this update do not contain a verified public support email, registered postal address or complete legal entity details, so none is invented here.