Privacy Policy
Last updated
This policy explains what CandL stores about you, why, and what you can do about it. It covers the CandL website and charts.
Summary
- You can use the charts without an account. Then your charts, drawings, indicators and settings are saved only in your browser.
- When you’re signed in, your work is also saved to your account on our servers, so it’s the same on every device you sign in on.
- An account needs only an email address and a password.
- CandL shows no advertising and uses no third-party analytics or advertising trackers. We don’t sell personal information.
Data kept in your browser
CandL saves your work in your browser’s local storage: charts and layouts, drawings, indicators and your custom scripts, templates, watchlists, settings and theme. Each workspace keeps its own copy. Price alerts are shared by all workspaces.
Without an account, this data stays on your device and isn’t sent to us. It remains until you clear your browser’s data for CandL. When you’re signed in, it’s saved to your account too (see below), and signing out removes your account’s copy from that browser.
Your account
An account is optional. With one, your work is saved to your account (see below), and you can post in Discussions and comment on What’s new. When you create an account we store:
- your email address;
- your password as a salted hash (scrypt). We never store the password itself;
- when you created the account and agreed to the Terms of Service;
- how many times you have signed in, and the days on which you used CandL while signed in, for account security and to understand how CandL is used.
Signing in starts a session. We store only a hash of the session’s token, and the session lasts 30 days from when you last used it. Signing out ends it.
Your work, saved to your account
When you’re signed in, CandL saves your work to your account as well as in your browser, so it’s the same on every device you sign in on: your workspaces and chart layouts, the drawings and indicators on your charts, your custom scripts, templates, watchlists, price alerts and settings. The first time you sign in on a browser, what you made there before signing in is added to your account.
This data is stored on our servers, linked to your account. We use it only to give you your work on your devices, and we don’t sell or share it. When you delete something, we keep it marked as deleted, so that your other devices remove it too. Deleting your account removes all of it.
Comments and discussions
Comments on What’s new and posts in Discussions are public. Each shows its text, its date and your name, which is the part of your email address before the @. You can delete your own, and we may remove any that break the Terms of Service.
When you report a post in Discussions, we store your reason with your account so we can review the report.
Feedback
When you send feedback we store its topic and message, the CandL page you came from, and either your account (if you are signed in) or the email address you choose to give for a reply. We use it to answer you and to improve CandL.
Emails
We email you only about your account. At present that means password reset links, sent when you ask for one, which expire after 30 minutes. An email delivery provider sends these emails for us.
Cookies
CandL sets one cookie, candl_session, when you sign in. It keeps you signed in, can’t be read by scripts on the page, and is removed when you sign out or the session expires. CandL sets no tracking or advertising cookies.
Market data and other services
Your browser loads market data and market icons directly from third-party exchanges. When it does, those services receive your IP address and the information browsers normally send, and they handle it under their own privacy policies.
Some market data reaches you through our servers from data providers. Your IP address isn’t passed on to them.
If you share a chart snapshot to a social network, CandL opens that network and it handles what you post under its own terms.
Our hosting providers process IP addresses to deliver the site and protect it from abuse.
Security
Passwords and session tokens are stored only as hashes. Changing your password signs out your other devices. Our servers use IP addresses briefly, in memory, to limit repeated sign-in attempts and other abuse. Our request logs don’t record IP addresses, and secrets such as reset tokens are removed from them.
How long we keep data
| Data | Kept |
|---|---|
| Account | Until you delete it |
| Your work saved to your account, including things you deleted | Until you delete your account |
| Sessions | 30 days after last use, or until you sign out |
| Password reset links | Expire after 30 minutes and are removed within an hour |
| Days you used CandL while signed in | 90 days |
| Comments and discussion posts | Until you or we delete them |
| Reports of discussion posts | Until we delete them |
| Feedback | While it’s useful for improving CandL, or until you ask us to delete it |
| Data in your browser | Until you clear it |
Your choices and rights
- Delete your account on the Profile page. This removes your account, the work saved to it, your sessions, reset links and activity records. Your comments, discussion posts and reports stay, credited to “deleted”, and any feedback you sent is no longer linked to you.
- Change your password on the Profile page.
- Delete your comments on What’s new and your posts in Discussions.
- Clear the data in your browser through your browser’s settings.
Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to how it’s used. To ask, contact us through the Feedback page. You can also complain to your local data protection authority.
Children
CandL is not intended for children, and we don’t knowingly collect information about them.
Changes to this policy
When we change this policy we update the date at the top of this page. We announce significant changes on What’s new.
Contact
Questions about this policy or your information: use the Feedback page.