Privacy policy

If you don’t have an account

Your progress, scores and settings are saved only in your browser (its local storage) on that device. They aren’t sent to us. Clearing your browser’s site data removes them.

If you create an account

We store:

• Your email address and a scrambled (hashed) form of your password, so you can sign in and reset your password. If you sign in with Google, we receive your email address and a Google account id from Google. We don’t receive your Google password.
• Your username, and earlier usernames for 30 days after you change them (so nobody can grab a name you just left).
• Your profile picture, if you add one. We redraw it as a small new image, which removes hidden data such as location and camera details. It can be viewed by anyone who has its link, because it’s meant to be shown next to your username.
• Your progress: lessons and checkpoints, drill and practice results, simulator accounts and trades, settings, and the dates you practised (for streaks). This is what lets your progress follow you to other devices.
• Security records: short-lived counters of attempts (for example, username changes and picture uploads) that stop abuse, and the usual sign-in records kept by our database provider, such as when you last signed in and the network address used.

Why we use it

• to run your account and sync your progress between devices;
• to send emails you need, such as confirming your address or resetting your password;
• to keep the service secure and stop spam, bots and abuse.

We don’t sell your data, don’t share it for advertising, and don’t use advertising or tracking cookies. We don’t run analytics that track you across other sites.

Who helps us run CandleLab

These companies process data on our behalf, only to provide their service to us:

• Supabase: our database and sign-in provider. Your account, username, picture and synced progress are stored with them, in the United States.
• Our website host, which serves the pages and briefly keeps standard request logs (such as network addresses) for security and reliability.
• Cloudflare Turnstile, when the bot check is shown on the sign-in form. It looks at signals from your browser to tell people from bots.
• Google, only if you choose “Continue with Google”.
• An email delivery service, to send account emails.

We may also share information if the law requires it, or to protect people from harm.

In your browser

CandleLab saves your progress, settings and (if you’re signed in) your sign-in session in your browser’s local storage. These are needed for the site to work, not for tracking.

Deleting your data

You can delete your account at any time on the account page. That removes your sign-in, email address, username, picture, synced progress and the security counters linked to you, straight away. Copies may remain in our provider’s routine backups for a short time until those backups are replaced.

Deleting your account doesn’t touch what’s saved in your browser. You can tick “also clear this device” when you delete, or clear your browser’s site data yourself.

Your choices and rights

You can change your username and picture yourself. You can ask us for a copy of your data, to correct it, or to delete it, by emailing LUCAS_TODO@example.com. Depending on where you live, you may have other rights too, such as complaining to your local data protection authority.

Children

CandleLab accounts are not for children under 13. If you believe a child under 13 has made an account, email us and we’ll delete it.

Changes

If we change what we collect or how we use it, we’ll update this page and its date, and tell account holders about important changes.