Privacy Policy

Dr. Farzaneh Samsami
Biebricher Allee 161 b, 65203 Wiesbaden, Germany

hello@candlewithin.com

Account: When you create an account, we store your email address and display name (via Supabase Auth) to provide your private space and enable paid services.

Newsletter: If you subscribe, we store your email address to send occasional reflections. You may unsubscribe at any time by contacting us.

AI conversations: If you are signed in, your conversations with the AI reflection tool are stored in our database (Supabase) so you can revisit them in your account. You can view, download, or delete them yourself at any time, and they are automatically deleted after 90 days. If you use the tool anonymously (without an account), your conversation is not stored on our servers at all — it lives only in your browser for the current session and disappears when you close it; we keep only a privacy-preserving counter (a salted hash of your IP address — never the raw IP, and never any message text) to enforce the free daily limit.

Who can read your conversations: Your conversations are private. Through the site, only you can read them — in your own account. No feature shows them to Dr. Farzaneh, and we never use them to train AI models, nor sell or share them. They are encrypted in transit and at rest.

Purchases: Payment processing is handled directly by Stripe. We do not store full payment card details.

Technical data: Your IP address and browser information are automatically processed by our hosting infrastructure (Vercel) for security and uptime purposes.

We group cookies into two categories. On your first visit you choose which to allow; your decision is stored in a cookie (cw_consent, valid 1 year) so you are not asked again. You can change it anytime below or via “Cookie settings” in the footer.

Strictly necessary (always active):

• Language preference (NEXT_LOCALE): stores your chosen language (en / fa / de). Duration: 1 year.
• Authentication session: keeps you signed in when you have an account. Duration: up to 7 days, or until you sign out.
• Payment (Stripe): set only during checkout to process your payment securely.

These are required for the site to function and cannot be switched off.

Analytics (optional, off by default): We currently use no analytics or tracking cookies. If we introduce anonymous usage statistics in the future, they will run only after you opt in here. We do not use advertising, marketing, or cross-site tracking cookies.

• Supabase: database and authentication
• OpenRouter: your conversation text is routed through OpenRouter to third-party AI model providers (which may include Google, OpenAI, Anthropic and others) solely to generate a reply; no additional personal data is shared
• Stripe: payment processing — their own privacy policies apply
• Vercel: website hosting

If you are located in the EU/EEA, you have the right to access, correct, erase, restrict processing of, and port your personal data.

To exercise any of these rights, contact us at hello@candlewithin.com.

Account data is retained until you close your account. Signed-in AI conversations are automatically deleted after 90 days, or sooner if you delete them yourself. Anonymous AI conversations are not stored on our servers. Newsletter subscriptions remain active until you unsubscribe.

We may update this policy from time to time. Significant changes will be published on this page.