Privacy Policy
Last updated
This policy explains what CandL stores about you, why, and what you can do about it. It covers the CandL website and charts.
Summary
- You can use the charts without an account. Your charts, drawings, indicators and settings are saved in your browser, not on our servers.
- An account needs only an email address and a password.
- CandL shows no advertising and uses no third-party analytics or advertising trackers. We don’t sell personal information.
Data kept in your browser
CandL saves your work in your browser’s local storage: charts and layouts, drawings, indicators and your custom scripts, templates, watchlists, settings and theme. Each workspace keeps its own copy. Price alerts are shared by all workspaces.
This data stays on your device. It isn’t sent to us, and signing in doesn’t copy it to your account. It remains until you clear your browser’s data for CandL.
Your account
An account is optional. You need one to comment on What’s new. When you create an account we store:
- your email address;
- your password as a salted hash (scrypt). We never store the password itself;
- when you created the account and agreed to the Terms of Service;
- how many times you have signed in, and the days on which you used CandL while signed in, for account security and to understand how CandL is used.
Signing in starts a session. We store only a hash of the session’s token, and the session lasts 30 days from when you last used it. Signing out ends it.
Comments
Comments on What’s new are public. Each shows its text, its date and your name, which is the part of your email address before the @. You can delete your own comments, and we may remove comments that break the Terms of Service.
Feedback
When you send feedback we store its topic and message, the CandL page you came from, and either your account (if you are signed in) or the email address you choose to give for a reply. We use it to answer you and to improve CandL.
Emails
We email you only about your account. At present that means password reset links, sent when you ask for one, which expire after 30 minutes. An email delivery provider sends these emails for us.
Cookies
CandL sets one cookie, candl_session, when you sign in. It keeps you signed in, can’t be read by scripts on the page, and is removed when you sign out or the session expires. CandL sets no tracking or advertising cookies.
Market data and other services
Your browser loads market data and market icons directly from third-party exchanges. When it does, those services receive your IP address and the information browsers normally send, and they handle it under their own privacy policies.
Some market data reaches you through our servers from data providers. Your IP address isn’t passed on to them.
If you share a chart snapshot to a social network, CandL opens that network and it handles what you post under its own terms.
Our hosting providers process IP addresses to deliver the site and protect it from abuse.
Security
Passwords and session tokens are stored only as hashes. Changing your password signs out your other devices. Our servers use IP addresses briefly, in memory, to limit repeated sign-in attempts and other abuse. Our request logs don’t record IP addresses, and secrets such as reset tokens are removed from them.
How long we keep data
| Data | Kept |
|---|---|
| Account | Until you delete it |
| Sessions | 30 days after last use, or until you sign out |
| Password reset links | Expire after 30 minutes and are removed within an hour |
| Days you used CandL while signed in | 90 days |
| Comments | Until you or we delete them |
| Feedback | While it’s useful for improving CandL, or until you ask us to delete it |
| Data in your browser | Until you clear it |
Your choices and rights
- Delete your account on the Profile page. This removes your account, sessions, reset links and activity records. Your comments stay, credited to “deleted”, and any feedback you sent is no longer linked to you.
- Change your password on the Profile page.
- Delete your comments on What’s new.
- Clear the data in your browser through your browser’s settings.
Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to how it’s used. To ask, contact us through the Feedback page. You can also complain to your local data protection authority.
Children
CandL is not intended for children, and we don’t knowingly collect information about them.
Changes to this policy
When we change this policy we update the date at the top of this page. We announce significant changes on What’s new.
Contact
Questions about this policy or your information: use the Feedback page.