Privacy Policy
This policy explains what Candlio collects, why, and what you can do about it. Candlio is an educational app for learning how crypto trading works. It uses virtual money only.
1. Who we are
Candlio is operated by Ly Min, a sole proprietorship registered in Cambodia and based in Phnom Penh ("we", "us"). We are the data controller for the information described here.
Contact for any privacy question or request: lymin007@gmail.com
2. What we collect
Information you give us
| Data | Why |
|---|---|
| Email address and password | To create and secure your account. Passwords are handled by Firebase Authentication and are never visible to us. |
| Display name | Shown on your profile and on leaderboards. |
| Acceptance of our disclaimer | To record that you were shown the educational-use terms. |
Information created as you use the app
| Data | Why |
|---|---|
| Learning progress — lessons completed, quiz scores, XP, bookmarks, the last lesson you opened | So your course progress persists across devices. |
| Simulated trades — symbol, direction, size, entry and exit prices, virtual profit and loss, timestamps | To run the practice terminal, your portfolio history, and the post-trade debrief. All amounts are virtual. |
| Virtual balance and challenge participation | To run challenges and leaderboards. |
| Daily count of AI tutor requests | To enforce the fair-use limit. We store a number and a date, not your questions. |
| Subscription status and expiry | To unlock paid features. See section 4. |
Information collected automatically
- Device and diagnostic data — app version, operating system, crash and error information, collected through Google Firebase.
- Advertising identifier and device data — collected by Google AdMob to serve ads to users on the free plan. See section 5.
- Notification token — if you allow notifications, so we can send new-signal alerts. You can revoke this in your device settings at any time.
3. What we do not do with your data
- We do not sell your personal information.
- We do not share your data with brokers, exchanges, or affiliate partners. Candlio has no referral arrangements with any exchange.
- We do not use your trades or learning activity to build advertising profiles.
4. Payments
Candlio Pro is billed by Apple or Google, not by us. We never see or receive your card details.
Purchases are validated through RevenueCat, Inc., which receives a pseudonymous account identifier and your store receipt so we can tell whether your subscription is active. We store only the resulting status: whether you are on the free or Pro plan, when it expires, and whether it is set to renew.
5. Advertising
Users on the free plan see banner ads served by Google AdMob. AdMob may collect your advertising identifier, IP address, approximate location, and device information to select and measure ads. This is governed by Google's privacy policy.
You can limit this in your device settings — "Delete advertising ID" or "Opt out of Ads Personalisation" on Android, "Allow Apps to Request to Track" on iOS. Where required by law, we ask for your consent before serving personalised ads and you may change that choice at any time.
Candlio Pro removes all ads.
6. The AI tutor
When you ask the in-app tutor to explain a lesson, we send the lesson's title, summary, and key takeaway — text we wrote, which already ships inside the app — along with which of the six fixed questions you chose, to our AI provider, DeepSeek, whose processing takes place in the People's Republic of China.
No personal data is sent. Not your name, email, account identifier, trades, balance, or progress. You cannot type a free-form message to the tutor, so nothing you write can reach the provider. Answers to the shared questions are cached on our servers and reused for all learners, so most taps send nothing at all.
7. Who else processes your data
| Processor | Purpose |
|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging) | Accounts, data storage, backend logic, notifications |
| Google AdMob | Advertising on the free plan |
| RevenueCat, Inc. | Subscription receipt validation |
| DeepSeek | AI lesson explanations (no personal data — see section 6) |
| Apple, Google | App distribution and payment processing |
8. Where your data is stored
Candlio's backend runs on Google Cloud infrastructure in the United States. If you use the app from outside the United States, your information is transferred there. Where the law requires a transfer mechanism — for example for users in the UK or European Economic Area — we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard with each processor.
9. Legal bases (UK and EEA users)
- Performance of a contract — running your account, saving progress, delivering Pro features.
- Legitimate interests — keeping the service secure, preventing abuse of paid features, and fixing crashes.
- Consent — personalised advertising and push notifications. You can withdraw either at any time without affecting the rest of the app.
10. How long we keep it
We keep your account data while your account exists. You can delete it at any time from Profile → Delete account in the app, or by following the steps at candlio-app.web.app/delete-account. When you do, we remove your profile, learning progress, simulated trades, and AI usage counters within 30 days, except where we must keep a record to meet a legal or tax obligation — for example proof of a subscription payment.
Backups are overwritten on a rolling basis and any residual copies are removed within 90 days.
11. Your rights
Wherever you live, you can ask us to:
- give you a copy of the data we hold about you;
- correct anything that is wrong;
- delete your account and its data;
- stop using your data for a particular purpose, or withdraw a consent.
Email coddy.solution.kh@gmail.com and we will respond within 30 days. We will not charge you or degrade your service for exercising any of these rights.
UK and EEA users may complain to their local data protection authority. California residents have the rights described above under the CCPA/CPRA; we do not sell or share personal information as those terms are defined there.
12. Age requirement
Candlio is intended for adults. You must be 18 or older to create an account. The app teaches leveraged trading concepts, and although it uses virtual money and cannot place real trades, the subject matter is not suitable for children.
We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email us and we will delete it and their data.
13. Security
Traffic is encrypted in transit. Access to your account requires your credentials, and our database rules prevent one user from reading another's data. Financially meaningful values — your virtual balance, trade outcomes, leaderboard rank, and subscription status — can only be written by our server, never by the app on your device.
No system is perfectly secure, but the worst case here is limited: there is no real money and no exchange access in your Candlio account.
14. Changes
If we change this policy we will update the date at the top, and tell you in the app before any material change takes effect.