Privacy Notice
Version 2026-10-27 · in force from 27 October 2026
This notice explains what personal data SoSIMply processes, why, on what legal basis, for how long, who receives it, and what rights you have. It follows Article 13 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003).
SoSIMply is a free web platform for simulating radiation detectors and their readout electronics. It is an independent, non-commercial project run by a private individual. It shows no advertising and uses no analytics and no trackers.
1. Who is responsible
The controller of your personal data is Yavuz Selim Karakaş, a private individual.
E-mail: privacy@sosimply.net
There is no data protection officer. The law does not require one for this service (GDPR Art. 37(1)). Write to the address above about this notice or your data.
2. What we process, why, and on what legal basis
| What | Why | Legal basis |
|---|---|---|
| Account: e-mail address; name (optional: if you leave it empty, the part of your e-mail address before the "@" is used); password, stored only as a salted scrypt hash; role; creation time; display preferences (theme, default electronics chain); whether and when your e-mail address was verified; the time and the version of the Terms of Use and this notice that you confirmed | to create and run your account, sign you in, keep your preferences, and record your acceptance of the Terms of Use | performance of the contract you enter by accepting the Terms of Use (GDPR Art. 6(1)(b)) |
| Codes we e-mail you: the e-mail verification code (valid 24 hours) and the password-reset code (valid 5 minutes), each stored only as a hash; the send times of the last 24 hours (verification) and the last send time (reset), to enforce resend limits | to confirm that the address is yours, and to let you reset a forgotten password | performance of the contract (Art. 6(1)(b)) |
| Your work: setups and assemblies you save; runs (their name, settings, status, results and result files, and the CPU time they used); share links you create; components you contribute and, once an administrator approves one for the community library, the datasheet link the administrator attaches | to run the simulations you ask for, keep your results for you, and show your contributions | performance of the contract (Art. 6(1)(b)) |
| Credits: your tier and a credit history: monthly and one-time allocations, the reservation and the charge or refund of each run, and any correction an administrator makes, each with its reason | to allocate the shared computing capacity fairly and show you what each run cost | performance of the contract (Art. 6(1)(b)) |
| Account security: the count of failed sign-ins and the lock time; a suspension and its reason; a security log of sign-in failures, account locks, password resets and changes, profile and e-mail changes, e-mail verification events, confirmations of the Terms of Use, "sign out everywhere", GDML exports (with the setup's name), researcher-tier applications and administrator actions, each with your account number and e-mail address | to protect your account and the service against misuse, and to investigate incidents | our legitimate interest in keeping the service and its accounts secure (Art. 6(1)(f)); see §6 |
| Server log: for each request to the server, the time, the network address it came from (normally your IP address), the request line (the method and the address requested, including any query string) and the status code | to operate the service, find faults and detect misuse | our legitimate interest in operating a secure service (Art. 6(1)(f)); see §6 |
| Short-lived request counters, held in memory only and never written to disk: per network address, per session, per account or per e-mail address, each counting requests over a window of 5 minutes (sign-in and other requests), 1 hour (password-reset requests) or 6 hours (the "notify me" address) | to limit sign-in and other requests and stop automated guessing | our legitimate interest (Art. 6(1)(f)) |
| Contact messages: your e-mail address, the subject and the message, and your account number if you are signed in | to answer you | our legitimate interest in answering the people who write to us (Art. 6(1)(f)); if you write about your account, performance of the contract (Art. 6(1)(b)) |
| "Notify me" address: an e-mail address you leave while the server is unavailable | to tell you once that the server is back | your request, as a step before a contract (Art. 6(1)(b)) |
| Researcher-tier application: institutional e-mail address, institution, department, position, field, motivation, ORCID iD (optional), and the decision with its note | to decide your application and tell you the result | performance of the contract (Art. 6(1)(b)) |
| E-mails we send: your address and the message: verification codes, password-reset codes, the notice that your password was changed, replies to your contact messages, researcher-tier decisions, and the "server is back" message | to deliver messages the service needs to send you | performance of the contract (Art. 6(1)(b)) |
| Datasheet upload: a PDF you upload to fill in a component form | read once, in memory, to suggest values; not stored | performance of the contract (Art. 6(1)(b)) |
You must give an e-mail address and a password, verify the address, and accept the Terms of Use to create an account. Without them we cannot create one. Everything else is optional. You can use the Designer without an account. Running simulations requires one.
If you use the server's programming interface directly and fill in its optional "results by e-mail" field, that address is stored with the run's settings, and a failed delivery writes it to the server's error output, a separate file that is not rotated. The web application never fills in this field.
When you send a contact message, submit a component for the community library, apply for the researcher tier, or start a run that needs an administrator's approval, the server can also e-mail a notice to the controller's mailbox. The notice carries your name or e-mail address and what you sent.
We do not use your data for marketing, profiling or advertising, and we do not sell it.
3. Who can see your data
- You see your own account, setups, runs, results and credit history.
- Administrators of the service (today: the controller named in §1) see accounts, saved setups and assemblies, runs, contributions, credit histories, the security log, contact messages and applications, to operate and moderate the service.
- Anyone with a share link you create sees that setup: its name, creation date and contents. The link does not show your name or e-mail address.
- Every visitor sees a component you contribute once an administrator approves it for the community library. The approved entry carries its data, the datasheet link attached at approval, and a technical record of its origin that includes your internal account number. It does not include your name or e-mail address.
- Service providers that process data on our behalf, only as their service requires:
- Cloudflare, Inc. carries the traffic between your browser and the server, through Cloudflare's network and an encrypted tunnel. It handles your IP address and the content of each request while it is in transit.
- Our web and e-mail hosting provider (Turkticaret, a company in Turkey; §4) serves the site's pages and runs the sosimply.net domain's mailbox, through which the service sends its e-mails and receives yours. It handles your IP address when you load the site, and the e-mails exchanged with you.
- Authorities, only where the law requires it.
The database and the simulation engine run on a computer the controller owns and operates, in the European Union. There is no off-site backup.
4. Transfers outside the European Economic Area
- Cloudflare may process data outside the European Economic Area. Such transfers rely on the safeguards set out in Cloudflare's data processing terms: the EU-US Data Privacy Framework and, where it applies, the European Commission's standard contractual clauses.
- Our web and e-mail hosting provider is a company in Turkey, subject to Turkish data protection law (KVKK). It stores the website's files, the e-mails the server sends, and our mailbox on servers in Turkey. The European Commission has not adopted an adequacy decision for Turkey. These transfers rely on GDPR Art. 49(1)(b): they are necessary for the performance of the contract between you and us, namely to send your verification code and the service's e-mails, to answer your messages, and to serve the website you asked for. Turkish law may not offer a level of protection equivalent to EU law.
You can ask us for more information about these transfers at privacy@sosimply.net.
5. How long we keep it
| Data | How long |
|---|---|
| Account | until the account is deleted; it is then anonymised (§7) |
| Setups and assemblies | until you delete them yourself or ask us to (§7); deleting a setup also ends its share link. Deleting your account does not remove them, and a share link you created keeps working, unless you delete them or ask us to delete them too |
| Runs and their result files | until you delete them. Runs cited as evidence in the platform's published validation record cannot be deleted. Runs you have not deleted stay after your account is deleted, linked only to the anonymised account number. Photon files of finished runs are compressed after 7 days. Result files are not deleted automatically; a purge of old result files exists as an administrator setting and is switched off. Result files are also copied every night to a backup disk kept with the server; when you delete a run, its copy is removed within about 7 days. These copies are readable only by the account that runs the service. |
| Credit history | kept as the record of what each run cost; it cannot be edited. After your account is deleted it is linked only to the anonymised account number |
| Security log | as long as it is needed to protect the service and to investigate incidents; deleted on request where no such need remains. There is no automatic deletion today |
| Contact messages and "notify me" addresses | as long as they are needed to answer you; deleted on request. There is no automatic deletion today |
| Copies of notices and messages in our mailbox | as long as they are needed for their purpose; deleted on request. There is no automatic deletion today |
| Researcher-tier applications | as long as they are needed to decide the application and to document the tier your account holds; deleted on request. There is no automatic deletion today |
| Server log | rotated by size: the current file and five older files of up to 10 MB each; the oldest file is deleted when a new one starts. The time this covers depends on traffic |
| Verification and password-reset codes | usable for 24 hours and 5 minutes, or until used. The hash of an expired code stays until the next code, a successful verification or a password change replaces it |
| Request counters | in memory only. They count requests over the last 5 minutes to 6 hours; older entries are discarded when the table is pruned or the server restarts |
| Backups | a copy of the database is made every day on the same computer. The 14 most recent daily copies and the 4 most recent weekly copies (one about every 7 days) are kept, so data deleted from the database remain in backups for at most about 35 days while the daily backup runs every day |
6. Legitimate interests and your right to object
Where we rely on legitimate interests (§2), the interest is keeping the service, its accounts and its computing capacity secure and working: detecting repeated failed sign-ins, automated guessing and misuse, finding faults, and investigating incidents. We use only what the service handles anyway: your account number and e-mail address for account events, and the network address and request line for requests. We keep it for the periods in §5 and use it for nothing else. You can ask for the balancing test we made.
Your right to object. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (GDPR Art. 21(1)). We will then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. Write to privacy@sosimply.net.
7. Your rights
You have the right to:
- access your data and receive a copy (Art. 15);
- rectify it (Art. 16). You can change your name and e-mail address yourself in your account;
- erase it (Art. 17), subject to the exceptions of Art. 17(3);
- restrict its processing (Art. 18);
- data portability for data you provided (Art. 20);
- object (Art. 21; §6);
- lodge a complaint with a supervisory authority (Art. 77; §10).
How: write to privacy@sosimply.net from the address of your account. We answer within one month. For complex requests we may extend this by two more months; we will tell you why within the first month (Art. 12(3)). We may ask you to confirm your identity.
What you can do yourself, and what goes through us. In your account you can change your name, e-mail address, password and preferences, sign out everywhere, see your credit history, delete your runs, and rename or delete your saved setups and assemblies (deleting a setup also ends its share link). The application does not yet have a button to delete your account, to withdraw a share link while keeping the setup, or to export your data. For each of these, write to us and we will do it.
Deleting your account. We anonymise the account: your e-mail address and name are replaced, your password can no longer be used, your preferences are cleared, every session is signed out, and the account can no longer sign in. Your runs and credit history stay in the database without your name or e-mail address, because some runs are cited as scientific evidence and the credit history is the record of what each run cost. Your saved setups and assemblies, and their share links, also stay unless you ask us to delete them. Anonymisation does not yet remove your e-mail address from the security log (including entries that administrators' actions wrote about you), from your contact messages, from your researcher-tier applications, or from the settings of a run where you entered it in the programming interface's results-by-e-mail field. Tell us if you want those deleted too. We delete them unless we still need a security record to investigate an incident or to establish, exercise or defend legal claims, and in that case we tell you why. Backup copies follow within about 35 days (§5).
8. Storage on your device
SoSIMply sets no cookies and loads no trackers, analytics or third-party content. Fonts and libraries are served from our own site. The application keeps these items in your browser's local storage so that it works:
| Item | Purpose | Sent to our server? |
|---|---|---|
sosim_token | keeps you signed in (expires after 30 days) | yes, with each request, to identify your session |
sosimple_scene | autosaves the setup you are editing | when you run, save or export it as GDML, and, while you are signed in, shortly after each change, to show the cost estimate beside Run (the estimate request is not stored) |
sosim_prefs | your display preferences, such as theme | the item itself is not sent; when you are signed in, a change of theme is also saved to your account |
sosim_notify | remembers that you turned on browser notifications for finished runs | no |
sosim_notify_email | holds the address you leave while the server is unavailable, until it is sent | once, then deleted |
sosim_plan_pan, sosim_plan_axes | remember the position and axes of the 2D plan view | no |
sosim_report_author, sosim_report_inst | remember the name and institution you typed on a printable report | no |
sosim_terms_asked (session storage) | remembers that the Terms prompt was shown in this tab | no |
These items serve only the service you asked for, so they need no consent (Italian Personal Data Protection Code, art. 122(1)). You can remove them at any time by clearing this site's data in your browser. The Reset button on the start-up screen also clears them.
Browser notifications appear only if you turn them on and give your browser's permission.
9. Automated decisions, age, security
- No automated decisions with legal or similarly significant effects are made about you (Art. 22). The server refuses a run that your credit balance cannot cover, by a published rule (Terms of Use §7); decisions on researcher-tier applications, suspensions and account closures are taken by a person.
- Age. SoSIMply is not directed at children. You must be at least 16 years old to create an account (Terms of Use §3).
- Security. Passwords, verification codes and reset codes are stored only as salted scrypt hashes. Sessions are signed tokens, and "sign out everywhere" revokes them all. Five failed sign-ins lock an account for 15 minutes. E-mail is sent over TLS with the mail server's certificate verified. Backup copies of the database are readable only by the account that runs the service.
10. Complaints
If you think we process your data unlawfully, you may lodge a complaint with a supervisory authority, in particular in the EU country where you live or work, or where the infringement took place (GDPR Art. 77). In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma: by certified e-mail (PEC) to protocollo@pec.gpdp.it, by registered letter with return receipt, or by hand; see www.garanteprivacy.it. We would appreciate the chance to address your concern first at privacy@sosimply.net.
11. Changes to this notice
We publish every change to this notice on this page with a new version date. Before a material change takes effect, we tell account holders by e-mail at least 30 days in advance. When the version changes, the application asks you to confirm it at your next sign-in.