Log in Start free
Legal · Privacy policy

Privacy policy.

We collect only what we need to run Backcandle. We don't sell your data, we don't run ads, and we don't share your information with third parties except as described below.

Data sold
Never
Advertising
None
Third-party tracking
None
Effective
Last updated

01 What We Collect

When you use Backcandle, we collect and store the following:

  • Account data — your email address and display name, obtained via Google OAuth at sign-in.
  • Session data — replay sessions you create: instrument, date range, timeframe, start/end time, status.
  • Trade data — orders placed, fills, positions opened and closed, PnL, fees.
  • Journal data — notes you write on trades and sessions.
  • Analytics snapshots — aggregated performance metrics computed from your trade history.
  • Subscription records — if you buy a plan: the plan, billing cycle, amount, currency, the payment reference our payment provider issues, and the dates the subscription started, ends or was cancelled.
  • Server logs — standard HTTP access logs (IP address, user agent, timestamp, route) retained for up to 30 days for debugging and abuse prevention.
  • Referral source — if you arrive from another website or through a link carrying campaign tags (utm_source, utm_medium, utm_campaign), we note the channel (for example "tiktok", "reddit" or "google") and the campaign name, and record them when you start a demo or create an account. We never store the full referring URL or search terms, and nothing is sent to third parties.

We do not collect or store card or bank details — payments are handled entirely by our payment provider (see below) — and we collect no precise geolocation or biometric data.

If you try Backcandle as a guest, without signing in, the guest account and its sessions are deleted automatically after 48 hours.

02 How We Use Your Data

  • To authenticate you and maintain your session across visits.
  • To store and display your replay sessions, trades, journal, and analytics.
  • To compute performance statistics shown on your dashboard.
  • To debug errors and investigate abuse reports.
  • To see, in aggregate, which channels bring people to Backcandle.

We do not use your data to train machine learning models, profile you for advertising, or sell insights to third parties.

03 Third-Party Services

  • Google OAuth — used for authentication. When you sign in with Google, Google shares your email and name with us under Google's own privacy policy. We do not receive your Google password or payment data.
  • Paddle — processes payments as merchant of record. When you buy a plan, the checkout runs on Paddle and Paddle collects your payment details and billing information under its own privacy policy; we receive the payment reference and status, never your card details. The checkout page loads Paddle's script from Paddle's servers, so Paddle sees your IP there.
  • Error monitoring — when the app hits an unexpected error, a report of it may be sent to our error-monitoring service. These reports are configured to exclude personal data such as your email address and IP address.
  • Front-end assets — fonts, stylesheets, icons and the charting library are served from our own servers. Apart from Paddle's checkout script on the checkout page, the site makes no third-party asset requests, so no external CDN sees your IP.
  • Hosting provider — your data is stored on servers operated by our hosting provider. We have a data processing agreement in place with them.

04 Data Retention

  • Your account and associated data are retained for as long as your account is active.
  • If you delete your account, all associated sessions, trades, journal entries, and analytics snapshots are deleted within 30 days.
  • Server logs are retained for up to 30 days then purged automatically.
  • Backups may retain data for up to 90 days after deletion before being overwritten.

05 Your Rights

You have the right to:

  • Access — request a copy of all data we hold about you.
  • Export — on the Premium plan, download a session's trades as a CSV file from the journal at any time.
  • Correction — request correction of inaccurate data.
  • Deletion — request deletion of your account and all associated data.
  • Portability — receive your data in a structured, machine-readable format.

To exercise any of these rights, email support@backcandle.com.

06 Cookies & Local Storage

Backcandle uses a server-side session cookie for authentication. If you arrive from another website or a tagged link, the same session cookie also holds the referral channel described above; no separate cookie is set for it. No third-party tracking cookies are set. We use localStorage in your browser to remember chart preferences (active indicators, speed setting) between visits. This data never leaves your device.

07 Changes to This Policy

If we make material changes to this policy, we will update the "Last updated" date above and, where appropriate, notify you via in-app message. Continued use of Backcandle after a change constitutes acceptance of the revised policy.