Privacy Policy

Red Candle is a desktop trading journal for macOS and Windows, provided by Sukma Wijaya Saputra, an individual developer based in Indonesia ("we", "us"). This policy explains what data we handle and why.

Contact for privacy questions and requests: support@redcandle.tech.

1. Data that stays on your computer

Red Candle is local-first. Your trades, journal notes, rules and checklists, chart screenshots, imported MT5 candle data, analyses and settings are stored only on your computer. We do not automatically receive or upload this local data. If you choose cloud AI, export files to another service or share material with support, the selected recipient receives that material.

AI provider API keys and your sign-in session are stored in your operating system's secure credential store (Keychain on macOS, Credential Manager on Windows). Backups and CSV exports are saved where you choose. Uninstalling the app does not delete your journal; you can remove it yourself in the app's data folder.

2. Data we collect for your account

To create your account and check your license we process:

• your email address and password (the password is handled by our authentication provider and stored only as a secure hash), or the name and email address shared by Google if you choose Google sign-in;
• your name, if you provide it, and the date you accepted our Terms;
• your subscription status (plan, status, renewal or end date), which we receive from our payment provider;
• a random identifier and the name of the computer where Red Candle is activated, its last check-in time, and a record of moves between computers — this enforces one active computer per subscription;
• a one-way hash of that computer's hardware identifier (never the identifier itself) — this applies the once-per-customer refund rule in our Terms;
• technical data that reaches our servers with every request, such as IP address and time, kept in service logs for security and troubleshooting.

We use this data only to provide your account, verify your license, prevent misuse of the one-computer limit and of refunds, send account emails (such as verification codes and password resets) and answer support requests. The legal basis is the performance of our contract with you and our legitimate interest in keeping the service secure and preventing refund misuse.

3. Payments

Subscriptions are sold and processed by Creem (creem.io, operated by Armitage Labs OÜ, Estonia), which acts as merchant of record. Your card and billing details are collected by Creem under its own privacy policy; we never receive full card details. Creem tells us your subscription status and email address and lets you manage invoices, payment methods and cancellation.

4. AI features (optional)

AI features are off until you connect a provider of your choice. When you use them, the chart images and trade facts needed for the request are sent directly from your computer to that provider — for example a local model on your computer (Ollama, LM Studio), OpenAI (ChatGPT), Google (Gemini), Anthropic, or another compatible service you configure — using your own API key and subject to that provider's terms and privacy policy. We do not receive these requests or responses. AI output is generated by the provider's model and may be inaccurate; it is not financial advice.

5. Website

The redcandle.tech website uses Cloudflare Web Analytics to understand traffic and page performance, such as pages viewed, referring sites, country, device type and loading speed. It does not use cookies or identify individual visitors, and we do not use advertising trackers. The Customer Portal uses essential, secure cookies only to keep you signed in while you manage your subscription.

When Red Candle opens, every few hours while it stays open and when you open Settings, the app asks redcandle.tech for a small file that lists the latest version, and it opens help articles and installer downloads from redcandle.tech in your browser. Like any web request, these reach our hosting provider with your IP address and time; they contain no account details or journal data.

6. What we do not do

We do not sell or rent your data, show ads, use advertising or analytics trackers in the app, or access your local journal remotely. Support can receive information you deliberately send.

7. Service providers

These providers handle data for different purposes. Some process data on our instructions; others, such as the merchant of record or your chosen AI provider, also determine their own purposes under their policies:

• Supabase — accounts database, authentication and server functions (servers in the European Union);
• Creem — payments and subscriptions (merchant of record);
• Resend — delivery of account emails;
• Google — only if you choose Google sign-in;
• Cloudflare — website hosting, web analytics, app downloads and DNS;
• Zoho Mail — our support mailbox: receives your email address, message and any attachments you send to support.

Because these providers operate internationally, your account data may be processed outside your country, including in the European Union and the United States.

8. Retention and deletion

Account data is kept while your account exists. You can delete your account at any time in the app: Settings → Account → Delete account. This cancels an active subscription, deletes your account and computer records from our servers, and erases this account's journal, settings, saved AI keys and backups on the computer where you delete it. We keep a record that you had a subscription — your account id, a one-way keyed hash of your email address, the plan, status, payment and period dates and the merchant-of-record subscription reference, but not your email address or journal — for accounting, tax, chargeback and dispute handling and to apply the refund rules in our Terms. Account deletion does not necessarily immediately erase provider logs, backup copies or support correspondence. Provider logs are kept for the limited periods set by those services, backup copies expire on the provider's schedule, and support emails are kept only as long as needed to handle your request and its follow-up. Creem keeps payment and invoice records as required by tax and accounting law. If you received a refund, we keep one-way keyed hashes of your email address and of the computers used with your account, with the refund date, also after your account is deleted, to apply the once-per-customer refund rule in our Terms; these hashes cannot be turned back into your address or hardware identifier.

9. Your rights

Depending on where you live — including under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and, where applicable, the EU/UK GDPR — you may ask to access, correct, delete or receive a copy of your personal data, object to or restrict its processing, and withdraw consent. Email support@redcandle.tech; we handle requests within the time limits applicable to the request and your jurisdiction, including shorter deadlines under Indonesian law where applicable. We may need proportionate identity verification to avoid disclosing another person’s data. The legal basis stated above does not make every processing activity consent-based; withdrawal of consent concerns activities relying on consent. You may also complain to your data protection authority.

10. Security

Connections use HTTPS. In the desktop app, refresh tokens are kept in the operating system's credential store and access tokens in backend memory, outside the app's web view. The website portal uses essential HttpOnly session cookies. Licenses are cryptographically signed and checked on your computer. Database access is limited per account. No system is perfectly secure; if a breach affects your personal data, we will inform you and the authorities as the law requires.

11. Children

Red Candle is intended for adults and is not directed to anyone under 18. We do not knowingly collect data from children.

12. Changes

We will post updates to this policy on this page and change the date above. Significant changes will be announced in the app or by email before they take effect.