Privacy policy

What we hold, why, and what we deliberately do not hold.

StrataSim Designs, LLC runs StrataSim Shop and is the data controller for the personal data described here.

What we store

• Your email address. It is your identity here and where receipts, licence keys and update notices go.
• Your purchases, including what you bought, when, and the billing country and postal code needed to compute tax.
• Gifts you send or receive, including the names and message supplied by the sender, a recipient email when email delivery is chosen, and delivery and claim status. The recipient's gift receipt does not contain the buyer's billing details or the price.
• Your download history, so your library can tell you when something you own has been updated.
• A display name, only if you set one.
• How you sign in. If you use a password, we keep only a salted, slow one-way hash of it, never the password itself. If you turn on an authenticator app, we keep its secret encrypted, and your recovery codes only as keyed hashes. If you sign in with Google or Apple, we keep the account ID they give us and the email address it shares, and nothing else from them.
• Your signed-in devices: the browser and device type, and when each was last used, so you can see them and sign any of them out.
• Support requests you open from your account: what you write, any files you attach, and our replies. They are kept in the same support system as StrataWx support, run by the same company, so our staff can answer you.

If you bought StrataWx on stratawxfs.com

If you bought StrataWx on stratawxfs.com, we created your account from the email and licence key you already hold with us. It has no password until you set one, and you can ask us to delete it.

What we do not store

• Card details. These go straight to Stripe and never reach our servers.
• Your IP address. For abuse counting we store a salted hash that changes every day, so it cannot be reversed to an address and cannot be linked across days. It supports rate limiting and nothing else. Cloudflare also tells us which country a connection comes from, so prices can be shown in your currency; that is used for the page and not stored.
• Your password, readable. Only the hash above. When you choose a password we check it against known data breaches using Have I Been Pwned's range search: we send the first five characters of a one-way hash of it, and the check happens on our side, so neither the password nor its full hash ever leaves our server.

Who else sees it

• Stripe processes payments and computes tax. Their privacy policy applies to that.
• Resend delivers our email.
• Neon hosts the database, and Cloudflare serves the site and stores product files.
• Google and Apple, only if you choose "Continue with Google" or "Continue with Apple": signing in happens on their pages, under their privacy policies, and they tell us your account ID and email address (Apple can give us a private relay address instead).
• Address lookup. When a developer types an address into their seller agreement, what they type is sent from our server to an address search service to suggest matches: OpenStreetMap's search, run by komoot, and for US addresses the US Census Bureau. The service sees the words typed, never your IP address or your account.
• Developers see that a sale happened, which product, and the billing country. They never see your name, your email address or anything else about you.

Marketing

Only if you opt in, and you can turn it off in your account settings at any time. Receipts, licence keys and update notices are not marketing: they are part of what you bought, and they are sent regardless.

Your rights

Ask us for a copy of your data, a correction, or deletion. Deleting an account removes the identity but not the order records, which we have to keep for tax and accounting.

Cookies

A sign-in cookie and a cart cookie, and, if you choose a country at the top of the page, a cookie that remembers that choice and nothing else. Signing in adds a few short-lived ones that only carry a sign-in from one step to the next (the second step, a trip to Google or Apple and back, a "confirm it is you" before a security change), each lasting minutes, and, if you tick "Remember this device", one that lets that browser skip the second step for 30 days. One more records that you have seen the cookie notice, so it is not shown again for a year. All are first-party, and there is no advertising or cross-site tracking on this site.