Candleling← Back home

Privacy Policy

Last updated: 20 October 2026 · Applies to https://tradequest-app.netlify.app

Abobaker Mohammadi (“we”, “us”) operates Candleling, an educational platform for learning about markets through short lessons and simulated exercises. We designed the product to collect as little personal data as possible. This policy explains what we collect, why, and the controls you have.

1. What we collect

  • Account data: email address, password (stored only as a salted hash), display name, avatar choice.
  • Learning data: lesson progress, answers, mistakes, XP events, streaks and mastery statistics — used to run the product you see.
  • Simulated trading data: orders, positions and journal entries in the paper-trading simulator. These are fictional; they involve no real funds and no brokerage connection of any kind.
  • Preferences: timezone, daily goal, experience level, email preferences.
  • Product analytics: coarse first-party events (e.g. “lesson_completed”) so we can improve onboarding. We do not sell this data and do not run third-party advertising trackers.
  • Technical logs: session cookies (strictly necessary) and minimal server logs for security and abuse prevention.

2. What we deliberately don’t collect

  • No payment card details — subscriptions are bought through Apple’s App Store, which never shares card numbers with us. We receive only transaction identifiers and subscription status.
  • No brokerage account credentials or real-money trading data.
  • No contacts, no precise location, no microphone/camera access.

3. Why we process data (legal bases)

  • Contract: to provide your account, save progress, run streaks/leagues and the simulator.
  • Legitimate interests: security, fraud/abuse prevention, aggregate product improvement.
  • Consent: optional marketing email (off by default; withdraw anytime in Settings).

4. Sharing

We share data only with the service providers needed to run the service: web hosting (Netlify), a managed PostgreSQL database, transactional email delivery, Apple (Sign in with Apple, App Store purchases, push notifications), Google (only if you choose Google sign-in) and, only if you allow it, OpenAI. Leaderboards show only your chosen display name and weekly learning XP — never your email or portfolio.

AI answers (OpenAI): off until you say yes

The first time you open Pal, the app asks whether to allow AI answers. If you choose “Keep it offline”, nothing is sent to OpenAI. If you choose “Allow AI answers”, our server sends OpenAI the question you typed (up to 280 characters) and up to the last 6 messages of that chat, after removing emails and other sensitive patterns. The Trading Pal coach, when AI is allowed, also sends a minimized summary of your practice trade or lesson (coaching intent, scenario title, decision and outcome, risk percentage, discipline score, related concepts) and an optional question of up to 200 characters. We never send your name, email, account ID or balance. OpenAI states that API inputs and outputs are not used to train its models unless the API customer opts in, and that default abuse-monitoring controls may keep request content for up to 30 days. You can change your choice any time in Pal or in Trading Pal → Pal Privacy & Controls.

5. Retention & deletion

Learning data is kept while your account is active because the product depends on it. You can export all of your data as JSON from Settings → Your data, or permanently delete your account there too. Deletion removes your profile, progress, streaks, simulator history and notifications, and anonymizes remaining referral records.

6. Security

Passwords are hashed with modern key-derivation functions; sessions use HttpOnly, SameSite cookies over HTTPS in production. Access to production data is limited and logged. No system is perfectly secure — we encourage unique passwords and will notify affected users of any reportable breach as required by applicable law.

7. Children

Candleling is not directed at children under 13 (or the minimum age in your jurisdiction), and we do not knowingly create accounts for them.

8. Your rights

Depending on where you live (e.g. GDPR, UK GDPR, CCPA/CPRA), you may have rights to access, correct, export and delete your data, and to object to or restrict certain processing. Exercise them from Settings or by emailing tradequest@abobakerbuilds.com.

9. Changes

If we make material changes we’ll notify you in-product or by email before they take effect.

10. Contact

Abobaker Mohammadi · tradequest@abobakerbuilds.com