Privacy Policy

We do not run third-party analytics SDKs. We do not sell, rent, or share your personal data. The Candleread iOS app stores your learning progress under an anonymous device-keyed identifier in your own iCloud (CloudKit). On the web, we only collect what you give us — your email if you subscribe, your billing info through Stripe if you pay, and basic server logs your browser sends with every request. You can email support@candleread.com at any time and we will delete every piece of data tied to you, no questions asked.

Candleread (“Candleread,” “we,” “us,” or “our”) operates the website at candleread.com and publishes the Candleread iOS app on the Apple App Store. We are based in Texas, United States. For any privacy question or request, email support@candleread.com.

1. Information you give us directly

• Email address. If you subscribe to our newsletter, request a course details email, fill out a support form, or buy a subscription.
• Billing information. If you upgrade to Premium or purchase a course program, Stripe collects your payment details directly. We never see or store your full card number, CVV, or bank credentials. Stripe shares back only the minimum we need to manage your subscription (email, last 4 digits, country, subscription status).
• Messages you send us. If you email us or submit a support form, we keep that conversation so we can help you and reference it later.

2. Information collected automatically

• Server logs. Like every website on the internet, our hosting provider (Vercel) records the IP address, user agent, and request path for each page load. We use this to debug errors and detect abuse. Logs are retained per Vercel's default and are not used to build advertising profiles.
• No third-party analytics SDKs. We do not embed Google Analytics, Meta Pixel, TikTok Pixel, Mixpanel, Amplitude, or any similar tracker on our website or in our iOS app. We do not build cross-site advertising profiles.
• Cookies. We use only the strictly necessary cookies required for theme preference, Stripe checkout, and session security. We do not set advertising or tracking cookies.

3. Information stored in the iOS app

• Learning progress. Your XP, streak, completed lessons, quiz answers, and preferences are stored in your own iCloud account using Apple CloudKit. We identify your record with an anonymous device-keyed identifier — not your Apple ID, name, or email. We never see the contents of that record on our servers; it lives in your iCloud.
• Apple subscription receipt. If you subscribe to the iOS app on Apple's billing, Apple shares an anonymous subscription token with the app so we can unlock paid features. We do not receive your name, address, or payment details from Apple.

• To deliver the product you signed up for or paid for.
• To send transactional emails (receipts, password-style links, account changes, support replies).
• If you opted in: to send the newsletter, course launch updates, or program-interest follow-ups you specifically requested.
• To detect fraud, abuse, and security incidents.
• To meet legal and tax obligations (e.g., sales tax records).

We do not use your data to train machine-learning models, profile you for advertisers, or sell mailing lists.

We keep this list intentionally short. The vendors below are the only third parties that touch your data, and only for the narrow purpose listed.

• Stripe — payment processing for web subscriptions and course programs. Stripe is the data controller for the card details you enter. See Stripe's privacy policy.
• Resend — transactional and newsletter email delivery. Stores the email address you provide and basic delivery metadata. See Resend's privacy policy.
• Vercel — website hosting and request logs. See Vercel's privacy policy.
• Apple iCloud / CloudKit — storage of your iOS app progress in your own iCloud account. Apple is the data controller. See Apple's privacy policy.

Wherever you live, you can email support@candleread.com and ask us to:

• Show you what we have on file for you.
• Correct anything that is wrong.
• Delete your account and every record tied to you (we honor this request even when not legally required).
• Export your data in a portable format.
• Unsubscribe from newsletter or marketing email — every email also has a one-click unsubscribe link.

If you are in California, you have additional rights under the CCPA and CPRA, including the right to opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing for you to opt out of — but you still have the delete, access, and correction rights above.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR / UK GDPR including access, rectification, erasure, restriction, portability, and the right to lodge a complaint with your local data-protection authority. Our legal bases are: contract (to deliver what you paid for), consent (for marketing email), and legitimate interest (for security and abuse detection).

• Active accounts: for as long as you have an account or subscription with us.
• Newsletter subscribers: until you unsubscribe.
• Billing records: seven years, to meet U.S. tax obligations.
• Server logs: Vercel default retention (typically under 30 days for raw logs).
• Support emails: up to two years after the last contact, then deleted unless tied to an active dispute.

A deletion request via support@candleread.com overrides the schedule above, except where law requires us to keep records (e.g., tax filings).

Candleread is not directed to children under 13, and we do not knowingly collect data from children under 13. The iOS app is rated 17+ because trading is an adult financial topic. If you believe a child has provided us with information, email support@candleread.com and we will delete it.

Our servers and vendors are based in the United States. If you access Candleread from outside the U.S., your data will be transferred to the U.S. Where applicable, we rely on Standard Contractual Clauses or equivalent transfer mechanisms with our vendors.

We use industry-standard practices: TLS in transit, encrypted storage at rest, scoped vendor API keys, and least-privilege access. No internet service can promise perfect security, but we treat your data like our own and we do not collect more than we need.

We will update this page when we change vendors, add features, or when the law requires a clearer disclosure. Material changes will be announced by email to subscribers and posted at the top of this page for at least 30 days before they take effect.

Questions, requests, or complaints — email support@candleread.com. We reply within one to two business days.