Privacy Policy

Last updated: August 2026 · Applies to https://tradequest-app.netlify.app

Abobaker Mohammadi (“we”, “us”) operates Candleling, an educational platform for learning about markets through short lessons and simulated exercises. We designed the product to collect as little personal data as possible. This policy explains what we collect, why, and the controls you have.

1. What we collect

Account data: email address, password (stored only as a salted hash), display name, avatar choice.
Learning data: lesson progress, answers, mistakes, XP events, streaks and mastery statistics — used to run the product you see.
Simulated trading data: orders, positions and journal entries in the paper-trading simulator. These are fictional; they involve no real funds and no brokerage connection of any kind.
Preferences: timezone, daily goal, experience level, email preferences.
Product analytics: coarse first-party events (e.g. “lesson_completed”) so we can improve onboarding. We do not sell this data and do not run third-party advertising trackers.
Technical logs: session cookies (strictly necessary) and minimal server logs for security and abuse prevention.

2. What we deliberately don’t collect

No payment card details — payments are handled by our payment provider, which never shares card numbers with us.
No brokerage account credentials or real-money trading data.
No contacts, no precise location, no microphone/camera access.

3. Why we process data (legal bases)

Contract: to provide your account, save progress, run streaks/leagues and the simulator.
Legitimate interests: security, fraud/abuse prevention, aggregate product improvement.
Consent: optional marketing email (off by default; withdraw anytime in Settings).

4. Sharing

We share data only with processors needed to run the service: hosting/database infrastructure, transactional email delivery and payment processing. Leaderboards show only your chosen display name and weekly learning XP — never your email or portfolio.

5. Retention & deletion

Learning data is kept while your account is active because the product depends on it. You can export all of your data as JSON from Settings → Your data, or permanently delete your account there too. Deletion removes your profile, progress, streaks, simulator history and notifications, and anonymizes remaining referral records.

6. Security

Passwords are hashed with modern key-derivation functions; sessions use HttpOnly, SameSite cookies over HTTPS in production. Access to production data is limited and logged. No system is perfectly secure — we encourage unique passwords and will notify affected users of any reportable breach as required by applicable law.

7. Children

Candleling is not directed at children under 13 (or the minimum age in your jurisdiction), and we do not knowingly create accounts for them.

8. Your rights

Depending on where you live (e.g. GDPR, UK GDPR, CCPA/CPRA), you may have rights to access, correct, export and delete your data, and to object to or restrict certain processing. Exercise them from Settings or by emailing tradequest@abobakerbuilds.com.

9. Changes

If we make material changes we’ll notify you in-product or by email before they take effect.

10. Contact

Abobaker Mohammadi · tradequest@abobakerbuilds.com