Privacy Policy
What Candlr collects, why, who helps us run the service, and the choices you have. We collect as little as we can and never sell your data.
01 The short version
- We use your Google sign-in to create your account and save your progress.
- We store your learning progress, settings and (if you subscribe) your subscription status.
- We use a few trusted services to host the app, take payments, send emails, power the AI coach and understand how the app is used.
- We do not sell your personal data and we do not use it for advertising.
- You can ask us to see, correct or delete your data at any time: tesfayemusie48@gmail.com.
02 What we collect
Account details. When you continue with Google, we receive your name, email address and Google account ID. We do not receive your Google password.
Progress and settings. Lessons completed, XP, streaks, badges, quiz answers, daily goal, learning path (forex or crypto), your display name and your cartoon character. This lets your progress follow you between devices.
Subscription details. If you buy Pro, we store your plan, its status and renewal date, and the customer ID from our payment provider. We never see or store your card number; the payment provider handles it.
Leaderboard scores. Your daily challenge score, display name, and a random device ID used to allow one entry per day. Scores and display names are public.
Email reminders. If you turn them on, your email address, time zone, current and best streak and next lesson, so we can remind you at a sensible time.
AI coach. When you use an AI feature, we send the question, the chart's candle data and your answer to our AI provider to generate an explanation. We do not include your name or email in these requests.
Usage and device data. Pages visited, buttons used, approximate location from your IP address, browser and device type, and session recordings with all typed text hidden. We use this to fix bugs and improve lessons.
03 How we use it
- to run your account, save your progress and sync it between devices;
- to provide Pro features and manage billing;
- to show leaderboards and challenge links;
- to send streak reminders and check-ins you asked for, and important messages about your account or billing;
- to answer AI coach questions;
- to keep Candlr secure, prevent abuse and cheating, and enforce fair-use limits;
- to understand what works and improve lessons and features.
Legal bases (EU/UK): performance of our contract with you (account, progress, Pro), your consent (reminder emails, which you can switch off), and our legitimate interests in running, securing and improving Candlr (analytics, abuse prevention).
04 Services we use
We share data only with providers that help us run Candlr, and only what they need:
- Google: sign-in.
- Supabase: database and accounts (progress, profile, subscriptions, leaderboard).
- Vercel: website hosting.
- Dodo Payments: checkout, billing, tax and receipts for Pro, as our merchant of record.
- Resend: sending reminder and account emails.
- OpenRouter and the AI model providers it routes to: generating AI coach answers.
- PostHog: product analytics and session recordings.
- Google Fonts: loading the fonts the site uses (your browser contacts Google to fetch them).
Some of these providers process data in the United States and other countries. Where required, transfers are protected by standard contractual clauses or equivalent safeguards. We may also share information if the law requires it, or to protect the rights and safety of our users.
06 Emails
Streak reminders and check-ins are only sent if you turn them on. Every email has a one-click unsubscribe link, and you can also turn them off in your profile.
We may still email you about your account or billing (for example a receipt from our payment provider, or an important change to these policies).
07 How long we keep it
We keep your account data while your account is active. If you ask us to delete your account, we delete your profile, progress and reminder settings within 30 days.
Billing records are kept by our payment provider for as long as tax and accounting laws require. Leaderboard entries are kept as part of each day's public results unless you ask us to remove yours. Analytics data is kept according to our analytics provider's retention settings.
08 Your rights
Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California), you can ask us to:
- access the personal data we hold about you, or get a copy of it;
- correct it;
- delete it;
- restrict or object to certain uses, including analytics;
- withdraw consent at any time (for example by unsubscribing from emails).
Email tesfayemusie48@gmail.com from the address on your account and we will reply within 30 days. You can also complain to your local data protection authority. We do not sell or "share" personal information for cross-context advertising as those terms are defined in California law.
09 Security
Data is encrypted in transit (HTTPS), access to our database is restricted with per-user security rules, and secret keys stay on our servers. No system is perfectly secure, but we work to protect your data and will tell you promptly if a breach affects you.
10 Children
Candlr is not meant for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
11 Changes to this policy
If we change this policy in an important way, we will tell you on the site or by email before the change applies. The date at the top shows the latest version.
12 Contact
Privacy questions or requests: tesfayemusie48@gmail.com. Data controller: Candlr.
Questions? Email tesfayemusie48@gmail.com.