Privacy Policy

Account information. If you sign in with a magic link, we (via Supabase) store your email address. If you sign in with Google, we receive your name, email address, and profile picture as provided by Google. We also store the username you choose, which is shown publicly on the leaderboard.

Progress data. Your points, streaks, completed lessons, and exercise/path progress, tied to your account so they can be saved and shown back to you.

Usage and analytics data. We use PostHog to understand how the app is used: pages visited, features used (exercises played, lessons completed, buttons clicked), approximate device/browser information, and errors that occur while you use the app. If you're logged in, these events are linked to your account so we can understand your journey through the app; logged-out visitors are tracked with an anonymous identifier.

Cookies. We use cookies to keep you signed in (via Supabase). These are essential and always on. Analytics cookies (PostHog, used to recognize repeat visits) are only set if you accept them in the cookie banner — you can decline, and nothing analytics-related is stored or tracked. See Section 6.

Payments. Candly Premium is paid through Stripe, our payment processor. Candly does not receive or store your card number — Stripe handles the card form and payment processing under their own privacy policy. We store the Stripe customer and subscription identifiers on your profile so we can tell whether your subscription is active and open Stripe's billing portal for you. Historical chart data used in exercises comes from public market data providers and is not linked to you in any way; it's the same data every user of that exercise round sees.

• To create and maintain your account and save your progress;
• To operate core features, like showing your username and score on the leaderboard;
• To understand how people use Candly and improve the product and lesson content;
• To detect, prevent, and address technical issues or abuse;
• To communicate with you about your account or material changes to the Service (e.g. the magic-link email, or a notice about these policies changing).

We do not sell your personal information.

Where the GDPR applies, we process your information under the following bases: performance of a contract (providing the Service you sign up for), our legitimate interest in understanding and improving the Service (analytics), and consent where required (such as for optional cookies, if introduced). You can withdraw consent at any time where we rely on it.

We share information with the service providers ("processors") that run Candly's infrastructure, strictly to provide the Service:

• Stripe — payment processing for Premium subscriptions;
• Supabase — database, authentication, and session storage;
• Google — only if you choose "Continue with Google", to authenticate you;
• PostHog — product analytics, hosted in the EU;
• Vercel — application hosting.

These providers only receive the information needed to perform their function and are contractually restricted from using it for their own purposes. We do not share your personal information with advertisers, and we do not send any personal information to the market-data providers our exercises pull historical charts from — those requests carry no user-identifying data.

We may also disclose information if required by law, or to protect the rights, safety, or property of Candly, our users, or others.

We keep your account information and progress for as long as your account is active. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where we need to retain it to comply with a legal obligation or resolve disputes. Aggregated analytics that no longer identifies you may be retained longer.

We use a small number of cookies and similar technologies:

• Essential: a session cookie that keeps you signed in, and, during our private pre-launch period, a cookie confirming you've entered the shared access password. The Service won't work correctly without these.
• Analytics: PostHog cookies/local storage used to recognize your browser across visits and measure feature usage.

You can block or delete cookies in your browser settings, but essential cookies are required to log in and use the Service.

Depending on where you live, you may have the right to: access the personal information we hold about you; correct inaccurate information; request deletion of your account and associated data; object to or restrict certain processing; request a portable copy of your data; and withdraw consent where processing relies on it. To exercise any of these, contact us at emilwarvidsson@gmail.com. If you're in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Candly is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

Our service providers may process information in countries other than your own, including outside the European Economic Area. Where that happens, we rely on the safeguards those providers offer (such as standard contractual clauses) to protect your information.

We rely on our infrastructure providers' security practices (encryption in transit, access controls) to protect your information. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

We may update this Privacy Policy from time to time. If we make material changes, we'll make reasonable efforts to notify you (for example, in-app or by email) before they take effect.

Questions about this Privacy Policy or your data? Reach us at emilwarvidsson@gmail.com.