Privacy Policy

Last updated: 20 October 2026 · Applies to the Candleling iOS app and website

Abobaker Mohammadi, trading as abobakerbuilds (“we”, “us”), operates Candleling, an educational app for learning about markets through short lessons and simulated exercises. We try to collect as little personal data as possible. This policy explains what we collect, why, who receives it, and the controls you have.

1. What we collect

• Account data: email address, a salted password hash (if you sign up with email), display name and avatar choice. If you use Sign in with Apple or Google we receive the identifier and, if you share it, the email address that Apple or Google provides.
• Learning data: lesson progress, answers, mistakes, XP, streaks, margin points and mastery statistics, used to run the product you see.
• Simulated trading data: orders, positions, grades and journal entries in the practice simulator. These are fictional; they involve no real funds and no brokerage connection of any kind.
• Questions you type to Pal: only if you allow AI answers (see section 4). Without that choice, your questions are answered on our server from our own lesson library and are not sent to any AI provider.
• Preferences: time zone, daily goal, experience level, notification and email preferences.
• Subscription status: if you subscribe, Apple handles the purchase. We receive transaction identifiers and subscription status from Apple so we can unlock Premium. We never see your card or Apple ID payment details.
• Push notification token: only if you allow notifications, so we can send streak and daily reminders. You can turn them off in iOS Settings.
• Product analytics: a short list of first-party events (for example “lesson_completed” or “paywall_viewed”) so we can improve onboarding and lessons. We use no third-party analytics or advertising SDK, we do not track you across other companies’ apps or websites, and we do not sell data.
• Technical logs: minimal server logs and rate-limit keys for security and abuse prevention, kept for up to 30 days.

2. What we do not collect

• No payment card numbers, brokerage credentials or real-money trading data.
• No contacts, photos, precise location, microphone or camera data.
• No advertising identifier. The app contains no ads.

3. Why we process data

• Contract: to provide your account, save progress, run streaks, leagues and the simulator, and unlock Premium.
• Legitimate interests: security, fraud and abuse prevention, and improving the lessons.
• Consent: AI answers (off until you allow them), push notifications, and optional marketing email (off by default). You can withdraw consent at any time.

4. Sharing, and optional AI answers

We share data only with the service providers needed to run Candleling: web hosting (Netlify), a managed PostgreSQL database, transactional email delivery, Apple (Sign in with Apple, App Store purchases, push notifications), Google (only if you choose Google sign-in) and, only if you allow it, OpenAI. Leaderboards show only your chosen display name and weekly learning XP, never your email or practice portfolio.

AI answers (OpenAI): off until you say yes

The first time you open Pal, Candleling asks whether to allow AI answers. If you choose “Keep it offline”, nothing is sent to OpenAI. If you choose “Allow AI answers”, our server sends OpenAI the question you typed (up to 280 characters) and up to the last 6 messages of that chat, after we remove emails and other sensitive patterns. The Trading Pal coach, when AI is allowed, also sends a minimized summary of your practice trade or lesson: the coaching intent, lesson or scenario title, your decision and its outcome, the risk percentage, a discipline score, related concepts and sample size, plus an optional question of up to 200 characters. We never send your name, email, account ID or balance. OpenAI processes this to write a reply. OpenAI states that API inputs and outputs are not used to train its models unless the API customer opts in, and that its default abuse-monitoring controls may keep request content for up to 30 days. See OpenAI API data controls.

You can change the choice at any time: from the hand icon in Pal, or in Trading Pal → Pal Privacy & Controls, where you can also clear your coaching history. When AI answers are off, Pal and the coach still work from our own lessons and rules.

5. Retention & deletion

Learning data is kept while your account is active because the product depends on it. You can export your data as JSON, or permanently delete your account, from Settings in the app (Settings → Danger zone → Delete account). Deletion removes your profile, progress, streaks, simulator history, notifications and sign-in links. See the Data Deletion Policy.

6. Security

Passwords are hashed with modern key-derivation functions. The app talks to our server over HTTPS and keeps its sign-in token in the iOS Keychain. Access to production data is limited. No system is perfectly secure; use a unique password. We will notify affected users of any reportable breach as required by law.

7. Children

Candleling is not directed at children under 13 (or the minimum age in your country), and we do not knowingly create accounts for them. If you believe a child has an account, email us and we will delete it.

8. Your rights

Depending on where you live (for example GDPR, UK GDPR, CCPA/CPRA), you may have rights to access, correct, export and delete your data, and to object to or restrict certain processing. Use Settings in the app or email tradequest@abobakerbuilds.com.

9. Changes

If we make material changes we will tell you in the app or by email before they take effect, and update the date above.

10. Contact

Abobaker Mohammadi, trading as abobakerbuilds · tradequest@abobakerbuilds.com