Privacy

Who is responsible

Candle Arena is run by Yaniv Bitton, a licensed dealer (osek murshe) in Holon, Israel. We decide what happens to your data: in European and UK law we are its “controller”, and in Israeli law the owner of the database it is kept in. Write to privacy@candlearena.app about anything on this page.

What we store

• Your account: your email address and name, the country you signed up from, and a profile photo if you add one. The country comes from your network address when you sign up, and we store only the country on your account. Like any website, our hosting and sign-in providers see your network address and keep it for a short time in their security logs. Your password is stored scrambled, so nobody can read it, us included.
• A creator's promo code: if you came to us through a creator's link, the code in it, on your account and on any Pro you buy with it, including a code you type on the payment page.
• Your practice: every round you play, with your plan, your trade, its result and your practice balance.
• Your settings: your time zone (read from your browser the first time you visit), your display and sound choices, and whether AI written reads are on.
• Your reading: the reads about your trading on Reading and Focus, and the figures they were written from.
• Your Gladiator chats: what you ask Gladiator and its answers, what each chat is about, how many questions you ask each day, and Gladiator's read of each Backtesting session you finish while AI written reads are on. You can delete a chat on the Gladiator page.
• Your lessons: which Learn topics you have finished, and when.
• Your plan: whether you are on Free, the trial or Pro, Annually, Monthly or Prepaid, its dates (for Prepaid, each purchase and when its months run), whether we have sent the reminder before Prepaid ends, and the numbers Freemius uses for your customer record and purchase. Never your card.

Why we ask, and whether you have to

No law makes you give us any of it. Without an email address we cannot make you an account, so you cannot play; everything else is up to you: a photo, Google sign-in, AI written reads and Pro.

• To run the app you signed up for: your account, your practice, your settings, your reading, your Gladiator chats and your plan. In European and UK law, this is needed for our agreement with you.
• To keep it working and fair: counting visits and page speed, knowing which countries players sign up from, limiting sign-in attempts, and reports when something breaks. In European and UK law, this is our legitimate interest in a safe app that works, and none of it is used to tell who you are.
• A creator's promo code: to give you the discount the creator offered, and to count how many players each creator brought, so we can pay them. In European and UK law, this is our legitimate interest in working with creators. We never tell a creator who you are.
• AI written reads: our legitimate interest in coaching you on your own practice. They are on unless you turn them off.
• Totals across all players: to make the coaching better, we add up results across every player for each habit Gladiator looks for, such as the average result of trades bought just after a big candle. We keep and show a total only once at least 500 trades are in it, and never anything about one player. In European and UK law, this is our legitimate interest in better coaching.

We never use your data to make decisions about you that have legal or similar effects, and we never use it for advertising.

What we never do

• We never sell your data or share it for advertising.
• There are no ads, and nothing follows you to other websites. We count page visits, a few steps and page speed without cookies; see Vercel below.
• We never see your card or bank details. Paying for Pro happens on Freemius's page, and every balance in the game is practice money.

Who helps us run the app

These companies handle some of your data for us, and only to do the job listed.

Supabase

Stores your account and everything in it, and handles signing in. Its servers are in Frankfurt, Germany.

Vercel

Hosts the website and runs the app's server code. It also counts page visits for us, without cookies: which page, the site you came from, your country, browser and type of device. It counts a few steps the same way (signing up, a first round, and opening or finishing the payment page, with the plan chosen) and measures how fast each page loads. It cannot tell who you are, and it forgets it has seen your device within a day.

Freemius

Only if you pay for Pro. Freemius sells Pro for us: it takes your name, email address, card and billing country on its own payment page, charges you, sends your receipt and handles tax. We never see your card. We send Freemius your email address, to fill in its form; it tells us when your plan starts or ends, and we match it to your account by that email address. Freemius's payment page is Freemius's, with its own privacy policy and cookies. Its data is stored in the United States.

Resend

Sends our emails: confirming your account, resetting your password, changing your email, and, if you buy Prepaid, the reminder a week before it ends. It sees your email address and the message. Its data is stored in the United States.

Google

Only if you use Sign in with Google. Google learns you signed in to Candle Arena, and sends us your name, email address and profile picture.

DeepInfra

Runs the open AI model behind the written reads and Gladiator, the AI coach. For the reads on Reading and Focus, only while they are on and you are on the trial or Pro, it receives figures about your practice rounds (counts, results and chart shapes). For Gladiator, when a Backtesting session ends and AI written reads are on, it receives that session's figures, to write its read of the session. Otherwise only when you open Gladiator, ask it something or press one of its buttons, it receives your question, the chat so far, and what the chat is about: a trade's or session's figures, including its prices, or a strategy's rules, checks and session names. For Create with Gladiator, it receives what you write in Describe how you trade. For the Journal, when you press Draft or Tidy with Gladiator, it receives the trade's or session's figures and, for Tidy, your note; and when you ask Gladiator about your notes, or about a trade or session you wrote one on, it receives those notes. Never your name or email. It keeps what it receives only while the answer is being written, and does not store it or train on it.

Discord

Receives reports when something breaks, on our server or in your browser, in a private channel only we can see. A report says what broke and on which page. Email addresses, sign-in tokens and keys are removed before it is sent, and it never includes what you typed.

Zoho

Our mailbox. If you write to privacy@candlearena.app, hello@candlearena.app or accessibility@candlearena.app, your email is kept there.

Data sent abroad

Your account and practice are stored in Frankfurt, Germany. Vercel, Freemius, Resend, Google, DeepInfra and Discord are United States companies, so what they handle for us can be processed there, and Zoho, our mailbox, may also keep your emails outside Israel and the European Union. Each receives only what its job needs.

Cookies and browser storage

We use a few cookies to keep you signed in, to remember your settings on this device, and, if you came through a creator's link, to remember its promo code for 30 days so the discount reaches the payment page. Your browser also keeps some things for you, like an order you have not placed yet, how you last set up the chart, and your drawings. None of it tracks you across other websites, which is why there is no cookie banner.

How long we keep it

As long as you have an account. When you delete it, we delete your trades, balance, reading, Gladiator chats, photo, settings and sign-in straight away. Copies can stay in routine database backups for a short time before those backups are replaced. If you bought Pro, Freemius keeps its own record of your purchases, as tax law requires. A purchase made with a promo code stays in our count for that code, without your name.

To stop anyone flooding the sign-up, sign-in and password forms, we count attempts for a day. We store a scrambled code made from your network address and the email address you typed, never the addresses themselves, and the code cannot be turned back into either.

Age

Candle Arena is for people aged 18 and over. We do not knowingly keep data about anyone younger; if we learn that an account belongs to someone under 18, we delete it.

Your choices

• See and download: every round is on the History page, and Export there gives you a file you can open anywhere.
• Correct: change your name and photo in Profile, and your email address in Settings (if you sign in with Google, write to us to change it).
• Turn off AI: Settings, Data and privacy, AI written reads. That stops the reads on Reading and Focus and Gladiator's reads of finished sessions; Gladiator still answers when you ask it something or press one of its buttons.
• Delete: Settings, Danger zone, Delete account. It removes everything and cannot be undone.
• Anything else: write to privacy@candlearena.app to see what we hold about you, to have it corrected or deleted, to get a copy, or to object to or limit how we use it. We answer within 30 days.

If you want to complain

Please write to us first, and we will try to put it right. You can also complain to a regulator: in Israel, the Privacy Protection Authority; in the European Union, the data protection authority where you live; in the United Kingdom, the Information Commissioner's Office.

Changes

If this page changes, the date at the top changes with it. The rules for using the app are in the terms. Back to Candle Arena.