Privacy Policy

We do not run third-party analytics SDKs or sell, rent, or share your personal data for advertising. The Candleread iOS app stores your learning progress, streaks, XP, settings, and subscription unlock state on your device using Apple app storage. On the web, we collect what you give us, basic server logs, and limited first-party journey events that help us understand whether pages, lessons, email capture, and checkout work. You can email support@candleread.com at any time and we will delete the records we can link to your email or account, subject to records we must keep by law.

Candleread (“Candleread,” “we,” “us,” or “our”) operates the website at candleread.com and publishes the Candleread iOS app on the Apple App Store. We are based in Texas, United States. For any privacy question or request, email support@candleread.com.

1. Information you give us directly

• Email address. If you subscribe to our newsletter, request a course details email, fill out a support form, or buy a subscription.
• Billing information. If you upgrade to Pro or purchase a course program, Stripe collects your payment details directly. We never see or store your full card number, CVV, or bank credentials. Stripe shares back only the minimum we need to manage your subscription (email, last 4 digits, country, subscription status).
• Messages you send us. If you email us or submit a support form, we keep that conversation so we can help you and reference it later.

2. Information collected automatically

• Server logs. Like every website on the internet, our hosting provider (Vercel) records the IP address, user agent, and request path for each page load. We use this to debug errors and detect abuse. Logs are retained per Vercel's default and are not used to build advertising profiles.
• First-party journey events. We record the page or product step, a random browser and session identifier, referral and campaign parameters, browser user agent, and event time. If you provide an email, the journey store receives a keyed digest rather than the raw address. We do not store an IP address in this journey store. These events help us measure whether the education and purchase paths work.
• No third-party analytics SDKs. We do not embed Google Analytics, Meta Pixel, TikTok Pixel, Mixpanel, Amplitude, or any similar tracker on our website or in our iOS app. We do not build cross-site advertising profiles.
• Cookies. We use cookies for theme preference, Stripe checkout, session security, and a 30-day first-party attribution record. The attribution cookie may contain referral and campaign identifiers such as UTM, Google click, Meta click, or TikTok click IDs when they are present in the URL. We do not use those IDs to build a cross-site profile or send them to an advertising pixel.

3. Information stored in the iOS app

• Learning progress. Your XP, streak, completed lessons, quiz answers, hearts, onboarding state, theme, sound, and haptic preferences are stored locally on your device using Apple app storage. In v1.0, no Candleread account is required and this learning progress is not synced to a Candleread server.
• Apple subscription status. If you subscribe to the iOS app through Apple billing, StoreKit shares transaction status with the app so we can unlock paid features. The app also creates a random app account token for subscription event matching. We do not receive your card number, CVV, bank credentials, or full Apple ID payment details from Apple.

• To deliver the product you signed up for or paid for.
• To send transactional emails (receipts, password-style links, account changes, support replies).
• If you opted in: to send the newsletter, course launch updates, or program-interest follow-ups you specifically requested.
• To detect fraud, abuse, and security incidents.
• To measure where the learning and purchase journeys break and test one bounded product or marketing improvement at a time.
• To meet legal and tax obligations (e.g., sales tax records).

We do not use your data to train machine-learning models, profile you for advertisers, or sell mailing lists.

We keep this list intentionally short. The vendors below are the only third parties that touch your data, and only for the narrow purpose listed.

• Stripe: payment processing for web subscriptions and course programs. Stripe is the data controller for the card details you enter. See Stripe's privacy policy.
• Resend: transactional and newsletter email delivery. Stores the email address you provide and basic delivery metadata. See Resend's privacy policy.
• Vercel: website hosting and request logs. See Vercel's privacy policy.
• Supabase: database hosting for product, entitlement, and first-party journey records. See Supabase's privacy policy.
• Apple App Store / StoreKit: iOS subscription purchase processing, renewal status, refunds, and restore-purchase support. Apple is the data controller for App Store payment details. See Apple's privacy policy.

Wherever you live, you can email support@candleread.com and ask us to:

• Show you what we have on file for you.
• Correct anything that is wrong.
• Delete your account and the records we can link to your account or email (we honor this request even when not legally required).
• Export your data in a portable format.
• Unsubscribe from newsletter or marketing email. Every email also has a one-click unsubscribe link.

If you are in California, you have additional rights under the CCPA and CPRA, including the right to opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing for you to opt out of, but you still have the delete, access, and correction rights above.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR / UK GDPR including access, rectification, erasure, restriction, portability, and the right to lodge a complaint with your local data-protection authority. Our legal bases are: contract (to deliver what you paid for), consent (for marketing email), and legitimate interest (for security and abuse detection).

• Active accounts: for as long as you have an account or subscription with us.
• Newsletter subscribers: until you unsubscribe.
• Billing records: seven years, to meet U.S. tax obligations.
• Server logs: Vercel default retention (typically under 30 days for raw logs).
• First-party journey events: up to 13 months, then automatically deleted. Events linked to a keyed email digest are deleted sooner after an approved request. Fully anonymous events may not be linkable back to one person.
• Support emails: up to two years after the last contact, then deleted unless tied to an active dispute.

A deletion request via support@candleread.com overrides the schedule above, except where law requires us to keep records (e.g., tax filings).

Candleread is not directed to children under 13, and we do not knowingly collect data from children under 13. The iOS app is rated 17+ because trading is an adult financial topic. If you believe a child has provided us with information, email support@candleread.com and we will delete it.

Our servers and vendors are based in the United States. If you access Candleread from outside the U.S., your data will be transferred to the U.S. Where applicable, we rely on Standard Contractual Clauses or equivalent transfer mechanisms with our vendors.

We use industry-standard practices: TLS in transit, encrypted storage at rest, scoped vendor API keys, and least-privilege access. No internet service can promise perfect security, but we treat your data like our own and we do not collect more than we need.

We will update this page when we change vendors, add features, or when the law requires a clearer disclosure. Material changes will be announced by email to subscribers and posted at the top of this page for at least 30 days before they take effect.

Questions, requests, or complaints: email support@candleread.com. We reply within one to two business days.