Privacy Policy

Data is currently stored on servers in us-west2 (Oregon, USA) via Railway (backend) and Vercel (frontend). We are evaluating migration to India-based hosting in line with anticipated data-localisation requirements. We will notify users via email before any material change in data residency.

We use session cookies only — a single JWT-backed session identifier stored in sessionStorage (not localStorage or a cookie) to maintain your login state. We do not set analytics cookies, advertising cookies, or any third-party tracking cookies without your explicit consent.

If we add analytics in the future, we will prompt you for consent before setting any non-essential cookies in compliance with applicable privacy law.

• Authenticate you and maintain your session
• Deliver subscription-gated features based on your tier
• Process payments via Razorpay (email shared with Razorpay for invoicing)
• Send transactional emails (sign-in links, subscription receipts)
• Improve the physics model and catalog accuracy using anonymised run data
• Debug errors and maintain service reliability

We do not sell, rent, or broker your personal data to third parties.

We share data only with:

• Razorpay — payment processor. Your email and billing information are shared to process subscriptions and issue GST invoices. Governed by Razorpay's privacy policy.
• Railway / Vercel — infrastructure providers hosting our servers. Data is subject to their data-processing terms.

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request full account and data deletion. We will soft-delete within 7 business days and permanently purge within 30 days. Anonymised, aggregated sim data may be retained for model improvement.
• Portability: Request your sim runs and build history in JSON format.

To exercise any right, email motoquant@gmail.com. We respond within 14 business days.

Active accounts and their data are retained for the lifetime of the account. Inactive free-tier accounts with no activity for 24 months may be soft-deleted after 60 days' notice. Paid-account data is retained for 2 years after subscription cancellation for billing record purposes.

We use industry-standard practices: HTTPS everywhere, JWT tokens with short (15-minute) access lifetimes, rotating refresh tokens, license keys stored as SHA-256 hashes (never in plaintext), and database access restricted to server-side code. No passwords are stored.

We will notify registered users by email at least 14 days before making material changes to this policy. Continued use of the service after that period constitutes acceptance of the updated policy.