This Privacy Policy explains how Connor D'Silva ("we", "us", "our") collects, uses, and protects your information when you use the CandleQuest mobile and web application (the "App"). CandleQuest is a finance-education app; it does not provide financial, investment, tax, or legal advice.
By using the App you agree to this Policy. If you do not agree, please do not use the App.
The data controller responsible for your information is:
Connor D'Silva
Contact: candlequest123@gmail.com
We practice data minimisation — we collect only what the App needs to work. We do not collect your home address, government/tax ID, income, precise GPS location, or payment card details.
| Category | Examples | Why |
|---|---|---|
| Account data | Email address (and a securely hashed password, managed by our auth provider) | To create your account, sign you in, and sync your progress across devices |
| Profile preferences | A preferred name you choose; your country of residence (country only, not address) | To personalise the App and localise tax/finance examples and currency |
| Learning data | Lesson/quiz/prediction progress, XP, streaks, in-app coins, cosmetic items, review schedule | To run the learning experience and save your progress |
| AI tutor content | The questions/messages you send to the in-app "Ask the Bull / Ask the Bear" tutor | To generate a reply. Messages are sent to our AI provider (see §4). We do not store your tutor conversations on our servers; they exist only in your app session. |
| Usage analytics | App events (e.g. "lesson completed"), a randomly-generated device identifier, timestamps, and your account ID when signed in | To understand how the App is used and improve it |
| Technical data | IP address and basic request metadata processed by our infrastructure providers | Security, abuse prevention, and operating the service |
| Subscription status | Whether your CandleQuest Premium subscription is active and when it expires (no payment details) | To unlock Premium features (e.g. unlimited AI tutor messages) |
CandleQuest Premium subscriptions are purchased through Apple and Google via their in-app purchase systems, using RevenueCat to manage the subscription. They act as the merchant and handle your payment details — we do not receive or store your card information. We only receive your subscription's active/expired status and expiry date, so the App can unlock Premium features for your account.
We do not sell your personal information, and we do not use it for third-party advertising.
We share data only with providers that help us run the App, under contracts that require them to protect it:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Authentication, database, and backend functions (hosting your account + synced progress) | Account data, profile, learning data, analytics |
| Anthropic (Claude API) | Generates AI tutor replies | The tutor messages you send, plus light context (e.g. preferred name, country, current topic) |
| Apple / Google | App distribution and subscription billing (merchant of record) | Purchase/payment data handled entirely by them — we never receive it |
| RevenueCat | Manages CandleQuest Premium subscription status across platforms | Subscription active/expired status and expiry date (no payment details) |
Per its API terms, our AI provider does not use the content you submit through the App to train its models. Please confirm current terms with the provider before publishing.
Where the GDPR applies, we rely on: performance of a contract (to provide the App and your account), legitimate interests (to secure and improve the App), consent (where required, e.g. certain analytics — which you can withdraw), and legal obligation.
Our providers may process data in countries other than yours (for example, the United States). Where required, such transfers are protected by appropriate safeguards such as Standard Contractual Clauses.
We keep your account and learning data for as long as your account is active. If you delete your account, we delete your personal data from our active systems promptly (backups, if any, expire on a rolling basis). Analytics events may be retained in aggregated or de-identified form.
Depending on where you live (e.g. GDPR/UK GDPR, or CCPA/CPRA in California), you may have the right to access, correct, delete, export (portability), restrict, or object to processing of your personal data, and to withdraw consent. We honour these regardless of location:
You will not be discriminated against for exercising these rights. EEA/UK users may also lodge a complaint with their local data protection authority.
The App is not directed to children under 13 (or the minimum age required in your country, e.g. 16 in parts of the EEA), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
We use measures including encryption in transit (HTTPS), hashed passwords, and per-user access controls so each user can only access their own data. No method of transmission or storage is 100% secure, but we work to protect your information.
We may update this Policy from time to time. We will update the "Last updated" date and, for material changes, provide a more prominent notice.
Questions or requests: candlequest123@gmail.com.