Last Updated: March 3, 2026
Version: 1.0.0

Candle Patterns is a local-first, single-user application designed for personal use on a developer's workstation. It does not collect, transmit, or store personal data beyond what the user explicitly provides through the dashboard interface.

• No personal information (names, addresses, phone numbers, etc.)
• No authentication tokens or API keys (Yahoo Finance uses the public API)
• No SMTP credentials on disk — email configuration is held in process memory only
• No telemetry or analytics — the application does not phone home
• No cookies or tracking — the Dash UI runs locally without external tracking

• The system is single-user and does not implement authentication
• The dashboard binds to localhost:8050 by default — not exposed to the network
• No API keys or secrets are required for operation
• There are no user accounts, passwords, or session tokens

• The Dash dashboard listens on localhost:8050 (configurable)
• No inbound connections from external sources in default configuration

• Stored in SQLite (data/alerts.db) as part of alert rules
• User-provided; the system does not validate or sanitise URLs beyond basic format checks
• Recommendation: use HTTPS webhook endpoints

• Email SMTP settings (host, port, username, password) are configured via configure_email() at runtime
• SMTP credentials are stored in process memory only — they are never written to disk or database
• Credentials are lost on application restart and must be re-configured

• Uses the public yfinance API — no API key required
• No authentication tokens stored

• Bandit security scanner runs in CI — blocks MEDIUM/HIGH findings
• Ruff and Black enforce code quality standards
• All SQL queries use parameterised statements — no string interpolation in SQL
• nosec annotations are documented with rationale where Bandit false positives occur

• CSV uploads are validated for OHLCV schema compliance before processing
• Sequence pattern syntax is parsed with strict regex validation
• Dashboard inputs are sanitised through Dash's built-in callback system

• All dependencies are pinned in requirements-frozen.txt
• requirements.txt specifies minimum versions for compatibility
• No known vulnerabilities in current dependency set (as of v1.0.0)

This application is designed for personal/research use on a single workstation. In its default configuration:

• It does not process personal data of third parties
• It does not collect data from end users
• No data is transmitted to external services beyond Yahoo Finance (public market data) and user-configured webhook/email endpoints

If this application were adapted for multi-user deployment, the following GDPR considerations would apply:

1. Data Processing Basis: Market data analysis for research purposes (legitimate interest)
2. Data Minimisation: Only OHLCV market data is processed — no personal data fields
3. Right to Erasure: Users can clear all data via the CLI cleanup command or by deleting data/ directory
4. Data Portability: Watchlist and preferences export to standard JSON format
5. Breach Notification: Not applicable in single-user mode — no personal data at risk

To fully remove all stored data:

# Remove all persistent data
rm -rf data/

# Or use the CLI cleanup command
python -m candle_patterns.cli cleanup

If you discover a security vulnerability, please report it by opening a GitHub issue at:
https://github.com/Zed-777/Sequential-Candle-Patterns/issues

This software is provided for educational and research purposes. It is not financial advice. Use at your own risk. The authors assume no liability for trading decisions made based on this system's output.