Privacy policy
Effective 13 August 2026.
CandleWatch comes in two shapes, and they are not the same for privacy, so this policy treats them separately throughout.
- Local use — the mobile app, or CandleWatch run on your own computer. No account; everything stays with you.
- The hosted service — signing in to a CandleWatch-run server in your browser or from the app. There is an account, and we hold your book.
Wherever they differ, both answers are given.
Who is responsible
Afrasiyab Afrasiyab, trading as One App Company, is the data controller for this app and for the book held with a CandleWatch account, if you have one.
Questions about this policy, or anything else about the app: hello@oneappcompany.com
1. The short version
Local use: there are no accounts, no login and no sign-up. Everything you enter — your watchlist, positions, trades, alerts and any API keys — is stored on your own device and is never sent to us.
Hosted service: you create an account, and the book you build is stored on our server so that it follows you between your devices. You can export it or delete it at any time.
Both: no analytics, tracking, advertising or crash-reporting software, and your data is never sold or shared for advertising. CandleWatch connects out only to fetch market data you ask for and, if you add an AI key, to explain a news story you opened.
2. What is handled, and where it is stored
2.1 Local use
All of the following is stored locally on your device and is not transmitted to the developer:
- Your book and settings: watchlist tickers, positions and holdings, imported trade history, price alerts, calendar reminders, the account and cash figures you enter, and app preferences such as theme, layout and feature configuration.
- Any API keys you choose to add (market-data or AI provider keys): stored locally and sent only to that provider when you use the feature.
Uninstalling the app, or clearing its storage, permanently deletes this local data. In local use there is no server-side copy to request or delete.
2.2 Hosted service
When you sign in to the hosted service, the following is stored on the server, held against your account:
- Account details: your username, an optional email address (used only to send a password-reset link), and your password stored as a salted cryptographic hash — never in a readable form.
- Your book and settings: the same items listed above — including your positions, trade history and the account figures you enter. This is financial information about you, and it is held so that your desk is the same on every device you sign in from.
- Session records for the devices you are signed in on, and a daily count of data requests used to apply usage limits. The request count is a running total only — not a history of what you looked at — and it is not retained beyond the day.
We do not store your card details; payments, if any, are handled by a payment processor under its own terms.
3. What leaves your device, and to whom
CandleWatch makes outbound requests only to fetch data or run analysis you initiate. All are over HTTPS (encrypted in transit). No personal identifiers are attached.
| Destination | What is sent | Why |
|---|---|---|
| Market-data sources (SEC EDGAR, the European Central Bank via Frankfurter, FRED, news RSS) | the ticker or query you are viewing | fetch prices, filings, exchange rates, macro data and headlines |
| A market-data provider, only if you add your own key | ticker plus your key | chart and analyst data drawn from your own account |
| Your chosen AI provider, only if you add your own key | the text of the news story you opened (headline, summary and article body) and its ticker — never your portfolio, positions or account figures | write the plain-English explainer you asked for, using your key under that provider's terms |
| Your own optional computer, only if you configure it | the ticker or query | routes a few extra features through a machine you run |
| The CandleWatch server — hosted service only | your sign-in, the book you save, and the tickers you look at | hold your account and serve market data on your behalf |
In local use the developer receives none of this. On the hosted service the requests you make pass through our server, because that is what is serving them. Each third party processes its request under its own privacy policy. Please review your data and AI providers' terms. AI requests carry only the news article you opened, never your portfolio.
4. Permissions the app requests
- Notifications — to show the portfolio and watchlist alerts you configure. These are computed on your device.
- Background execution — to check your alerts while the app is closed. No location and no continuous tracking.
- Opening links in a browser — to open a source article or filing you tap.
CandleWatch does not request location, camera, microphone, contacts or device identifiers.
5. No advertising, no tracking, no children's data
- No advertising and no advertising software is present.
- No analytics and no tracking.
- CandleWatch is not directed to children and does not knowingly handle data from children.
5a. The launch-notification list
If you enter your email address in the "Notify me at launch" box on candlewatch.co.uk, we store that address, the exact wording you agreed to, and the date you agreed. We keep the wording so that what you consented to can be shown later, even if the page changes.
We do not record your IP address, your browser, where you came from, or anything else alongside it.
- What it is used for: one email, on the day CandleWatch opens. Nothing else. It is not a newsletter, it is not used for marketing, and it is never sold, shared or passed to anyone.
- Legal basis: your consent, given by ticking the box. You may withdraw it at any time.
- How to get off the list: email hello@oneappcompany.com and we delete your address. There is no link to click and no tracking pixel in anything we send.
- How long we keep it: until the launch email has been sent, or until you ask us to delete it — whichever comes first. The list is then deleted.
The list is held in a database run by our hosting provider. Adding yourself to it is entirely optional and is not needed to use CandleWatch.
6. Payments
If paid features are offered, payment is processed by the app store's billing system or another payment processor. The developer does not receive or store your card details — the processor handles them under its own terms.
7. Your rights
Local use: the developer holds no personal data about you, so there is nothing held by us to access, correct, export or erase. Data on your device is under your control and is removed by clearing the app's storage or uninstalling it.
Hosted service: we are the data controller for your account and the book held against it, and you have the rights the UK GDPR gives you — to access your data, have it corrected, export it in a portable form, and have it erased. Deleting your account deletes the book held with it. To exercise any of these, or if you are unhappy with how we have handled your data, contact hello@oneappcompany.com. You may also complain to the UK Information Commissioner's Office.
We keep your account data for as long as the account exists, and remove it when the account is deleted.
8. Changes and contact
Material changes will be reflected here with a new effective date. Questions: hello@oneappcompany.com.
CandleWatch is a learning and simulation tool — not financial advice, and not a broker. Trading and investing carry a real risk of loss.