SimCockpitSimCockpit

Privacy Policy

Effective: October 2026 · English version

1. Who We Are

SimCockpit (“we”, “us”) is operated by Batooldev.com, Bashrat Ali Iqbal, c/o flexdienst — #21516, Kurt-Schumacher-Straße 76, 67663 Kaiserslautern, Germany. Contact: support@simcockpit.net. This Privacy Policy explains what personal data we collect, why, and your rights over it. A German-language version is available at Datenschutzerklärung.

2. Data We Collect

  • Account data — email address, display name (if provided), and authentication tokens when you register or sign in with Google.
  • Subscription data — your current plan, billing status, and Stripe customer reference. We never store full card details.
  • Device data — device identifiers and platform info for paired Android devices.
  • App settings and dashboard layouts — settings you choose in the app or on the website (units, theme, language and, if provided, trucker name and country; when you completed the setup guide) and the arrangement of the gauges on your dashboard. We store that arrangement per device, together with a device name (by default the device model; you can change it in the app) and a random identifier — not a hardware identifier. The app creates it only when you first save or copy an arrangement while signed in, and keeps it on your device; this is strictly necessary for the synchronisation you use and needs no consent (Art. 5(3) ePrivacy Directive, § 25(2) no. 2 TDDDG). This keeps your settings available on your devices and lets you copy one device's arrangement to another. You can remove individual devices' layouts in the app under Settings → Dashboard layouts; deleting your account deletes all of them (Art. 6(1)(b) GDPR).
  • Usage data — server-side logs (IP address, timestamp, request path) retained for up to 30 days for security and debugging purposes.
  • Contact form — if you write to us via the contact form: name (optional), email address, subject and message. We receive it as an email in our support mailbox (sent via Resend, mailbox at Hostinger) and keep it as long as we need it to handle your request (Art. 6(1)(b) GDPR for questions about your account, otherwise Art. 6(1)(f)).
  • Service updates by email — news about the service, such as new versions, sent to account holders. Every email contains an unsubscribe link; after unsubscribing you receive no further updates (Art. 6(1)(f) GDPR; you may object at any time, Art. 21(2)).
  • Suggestions and votes — suggestions you submit in the dashboard (title, description) and your votes, linked to your account. Suggestions we take up appear with title and description on the public roadmap, without your name. Deleting your account deletes your suggestions and votes (Art. 6(1)(b) GDPR).
  • Abuse protection — to protect forms and interfaces against mass requests, we count requests per IP address. We store a shortened hash of the IP address, not the address itself, and delete it after two days at the latest (Art. 6(1)(f) GDPR).
  • Cookies — session cookies necessary for authentication, and, only if you consent, Google Analytics cookies (see our Cookie Policy).
  • Web analytics — with your consent: pages visited, referring page, device and browser type, and the approximate location derived from the IP address. Google Analytics does not store the IP address itself.

3. Legal Basis (GDPR)

  • Contract performance (Art. 6(1)(b)) — account, subscription and device data, app settings and dashboard layouts.
  • Legitimate interest (Art. 6(1)(f)) — server logs, security monitoring.
  • Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) — web analytics with Google Analytics. You can withdraw it at any time via “Cookie settings” at the bottom of every page.

4. Third-Party Service Providers

  • Supabase — database and authentication; servers in Ireland (EU), provider based in the US (SCCs applied).
  • Stripe — payment processing (US/IE, EU-US DPF certified). For customers in the EEA, UK and Switzerland, Stripe Payments Europe, Ltd. acts as a data processor on our behalf. For customers in other jurisdictions, Stripe Payments Company also acts as Merchant of Record (see Terms § 4.1) and is an independent controller for the data needed to fulfil that role (tax calculation, fraud screening, regulatory reporting).
  • Vercel — web hosting; server functions run in Dublin, Ireland (EU), content is delivered via a global network, provider based in the US (SCCs applied).
  • Resend — transactional email (US, EU-US DPF certified; SCCs applied).
  • Hostinger (Hostinger International Ltd., Cyprus) — mailbox for support@simcockpit.net and mail server for account e-mails such as confirmation and password-reset links (data processing agreement with EU Standard Contractual Clauses).
  • Google — web analytics with Google Analytics 4, only after your consent (Google Ireland Limited, Ireland; processing by Google LLC in the US, EU-US DPF certified). Google Signals and advertising features are switched off; analytics data is deleted after 2 months.

With the exception noted above, the providers listed above act as data processors under a Data Processing Agreement (DPA) and may not use your data for their own purposes.

In addition, the following receive data as independent controllers, under their own privacy policies:

  • GitHub (GitHub, Inc., USA) — hosts the Windows installer and its updates. When you download the installer, and whenever the desktop app checks for updates, your device connects directly to GitHub, which receives your IP address and technical request data. GitHub states that it is certified under the EU-US DPF.
  • Google — if you sign in with Google, Google confirms your identity and passes us your e-mail address, name and profile picture.

5. International Transfers

Some providers are located in the United States. Transfers are protected by Standard Contractual Clauses (SCCs) under Art. 46 GDPR, and/or the EU-US Data Privacy Framework where applicable.

6. Retention

We retain account and subscription data as long as your account is active. You may request deletion at any time via Dashboard → Settings → Delete Account; app settings and dashboard layouts are deleted with it. Logs are purged after 30 days. Legal retention obligations (tax records, etc.) may apply for up to 10 years.

7. Your Rights

Under GDPR you have the right to:

  • Access your personal data (Art. 15)
  • Correct inaccurate data (Art. 16)
  • Delete your data — “right to be forgotten” (Art. 17)
  • Restrict processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing (Art. 21)
  • Withdraw consent at any time (Art. 7(3))
  • Lodge a complaint with your national supervisory authority

To exercise any right, email support@simcockpit.net. We respond within 30 days.

8. California Residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by CPRA:

  • Right to know what personal information is collected and how it is used.
  • Right to delete personal information (subject to exceptions).
  • Right to correct inaccurate personal information.
  • Right to opt out of the sale or sharing of personal information. We do not sell or share personal information with third parties for cross-context behavioral advertising.
  • Right to non-discrimination for exercising your privacy rights.

To submit a verifiable consumer request, contact support@simcockpit.net.

9. Children's Privacy

SimCockpit is not directed to children under 16. We do not knowingly collect data from anyone under 16. If you believe we have, please contact us immediately.

10. Changes to This Policy

Material changes will be communicated to registered users by email at least 14 days before taking effect. The “Effective” date at the top reflects the latest revision.

11. Contact

support@simcockpit.net