Effective 25 September 2026 — version 1.0

This policy explains what personal information BurnSim LLC collects through the BurnSim software, the www.burnsim.com website, the BurnSim wiki at wiki.burnsim.com, and the licensing service at licensing.burnsim.com; why we collect it; how long we keep it; and what you can ask us to do with it.

1. Who we are

BurnSim LLC is a Washington State limited liability company and is the data controller for the information described here.

Contact for any privacy question, request, or complaint: burnsim@burnsim.com. Please put "Privacy" in the subject line. We answer privacy requests within 30 days, and within 45 days where United States state law allows longer.

2. What we collect, and why

2.1 When you activate or use a license

BurnSim contacts licensing.burnsim.com when you activate the software and when it checks that an existing license is still valid. That exchange records:

• the email address and, if you have one, the license key you activate with;
• a machine fingerprint derived from your computer's hardware, used to tell one installation from another;
• your computer name, as your operating system reports it, so that you can recognise your own installations when you need to release one;
• an installation ID, a random value the software generates once and keeps for the life of that installation;
• the BurnSim version, your operating system version, and whether the activation was done online or by the offline request-and-response method;
• the IP address the request came from, and the date and time.

Why: to deliver the license you are entitled to, to enforce the installation limit that comes with it, to renew Educational licenses annually, and to detect abuse of the activation service. Legal basis (UK/EU GDPR): performance of the license contract (Art. 6(1)(b)), and our legitimate interest in preventing license abuse (Art. 6(1)(f)).

The first activation from a new installation sends a validation link to the email address given, which is how we confirm the address belongs to you.

2.2 When you accept the license agreement

BurnSim shows the End User License Agreement on first run and again when the agreement text or the application version changes. When you accept it, we record that you did: the version and a cryptographic hash of the exact text you were shown, the installation ID, the machine fingerprint and computer name, the application and operating system version, whether a license was active at the time, your IP address, your browser's user agent if you accepted on the web, the date and time, and your email address and license reference where we already know them.

Why: so that both sides have a record of which terms you agreed to. This log is append-only and is never edited — an acceptance record that can be quietly rewritten is worthless to you as well as to us. See Your rights for how deletion interacts with it. Legal basis: our legitimate interest in being able to establish the terms of the license (Art. 6(1)(f)), and compliance with legal obligations (Art. 6(1)(c)).

2.3 When you buy a license

Payments are processed by PayPal. Your card, bank, or PayPal account credentials are entered on PayPal's systems and are never seen, transmitted, or stored by us. PayPal's handling of your information is governed by PayPal's privacy statement. The purchase page loads a script from paypal.com to render the payment button, which lets PayPal see that you visited that page and may set its own cookies.

From a completed payment we receive, and keep, the payer's name and email address, the transaction ID, the amount, the currency, and which product was bought. We use it to issue your license, to contact you about it, and to meet tax and accounting obligations. Legal basis: performance of contract, and legal obligation for the financial records.

2.4 When BurnSim checks for a new version

BurnSim asks our web server for a small file listing the current version — at most once a week in the background, and whenever you choose Help > Check for Updates. The request carries no identifiers; it is an ordinary file download. Our web server's log records the requesting IP address, the time, and the user agent, as it does for any visitor.

2.5 Educational (EDU) usage reporting

This section applies only to licenses issued as Educational (EDU) licenses. If you hold a personal or commercial license, or you are using BurnSim on an evaluation basis without a license, no usage data is collected from you at all.

Educational licenses are issued free of charge. In exchange, an installation running under an EDU license reports how the software is being used, so that development effort goes where it is actually needed. This reporting is being introduced with a future release; when it is active, an EDU installation sends periodic aggregate counts:

• how many simulations were run, how long they took, and how many were cancelled or failed;
• which grain types were used, and how many grains a motor had, as a range rather than an exact design;
• which features were invoked — for example characterization, the nozzle optimizer, the 3-D view, thermochemistry, DXF, SVG or .ric import, ENG export;
• whether the propellant used came from the supplied database or was one of your own — never which propellant, and never its formulation or coefficients;
• your units preference;
• categories of error encountered, without the underlying data;
• the BurnSim version, operating system, and .NET runtime version;
• the installation ID and machine fingerprint already held for your license, so that reports can be counted per installation.

What EDU reporting deliberately does not contain: no free text of any kind, no motor or propellant names, no notes, no file names or paths, no grain dimensions or other numbers from which a design could be reconstructed, no keystrokes or mouse activity, no student names, no coursework, and no grades.

BurnSim can also keep a detailed diagnostic log, written only on your own machine, to help us investigate a bug you report. It is turned off by default and records nothing at all unless you switch it on yourself, under Settings > Log Activity for Bug Reports; a normal installation never writes one. Even when you do switch it on, that log is never uploaded — if it is useful for a bug report, you send it to us yourself. The EDU reporting described above is a separate, purpose-built set of counters, built that way precisely so that the diagnostic log can never become the thing that gets sent.

Why: to understand real-world use of features, in exchange for the license being free. Legal basis: performance of the license contract under which the EDU license is granted (Art. 6(1)(b)), and our legitimate interest in improving the software (Art. 6(1)(f)).

If your institution cannot permit this reporting, tell us at burnsim@burnsim.com and we will discuss a paid license without it rather than leave you unable to install the software.

2.6 When you visit the website

Our web server keeps standard request logs: IP address, date and time, the page requested, the HTTP status, the referring page, and the user agent. We use them to keep the site working and to investigate abuse.

We use no third-party analytics and no advertising or tracking services — no Google Analytics, no advertising pixels, no social media trackers, no data brokers.

Cookies. The site sets one first-party cookie, named bs3up, and only on the page that offers BurnSim 3 users the upgrade to BurnSim 4. It holds a random tag and the date it was first set, expires after two years, and exists for one reason: many universities put hundreds of people behind a single changing IP address, so without it we cannot tell three visitors from one visitor arriving three times. It is not used to profile you, is not read on any other page, and is not shared with anyone. Blocking it costs you nothing. The purchase page also loads PayPal's script, which may set PayPal's own cookies (see 2.3).

Because we do not track visitors across sites and do not sell or share personal information, there is nothing for a Do Not Track or Global Privacy Control signal to switch off — but we honour them regardless.

2.7 The wiki

wiki.burnsim.com runs MediaWiki. It is read-only: no account is needed to read it, accounts are not open to the public, and only BurnSim's own operator can edit it. There is therefore nothing for you to contribute, and nothing about you to record or attribute — visiting the wiki collects no more than the ordinary web server request log described above.

2.8 When you email us or join the announcements list

If you email support, we keep the correspondence so that we can follow up and so that we have a record of what was reported. If you subscribe to the announcements list, we keep your address until you unsubscribe, and use it only to announce BurnSim releases. Every announcement tells you how to leave. Legal basis: consent, which you may withdraw at any time.

2.9 When you release an installation yourself

The self-service page at licensing.burnsim.com lets you free up an installation slot. It records the email address you enter, a hashed one-time token, the IP address the request came from, which installations you released and the reason you gave, and the time. The request record also enforces the rate limits published on that page. The page answers the same way whether or not an address holds a license, so it cannot be used to find out who owns one.

3. What we never collect

• Your motor files, grain geometry, propellant formulations, burn-rate coefficients, or characterization data.
• File names, folder paths, or anything else about the contents of your computer.
• Keystrokes, mouse activity, screen contents, or screenshots.
• Your precise location. An IP address indicates roughly where a request came from and nothing finer, and we do not attempt to refine it.
• Consumer health data, biometric identifiers, genetic data, racial or ethnic origin, religious or political beliefs, sexual orientation, union membership, or any other special-category or sensitive data as those terms are used in the GDPR, the Washington My Health My Data Act, and comparable United States state laws. We have no use for any of it and do not want it.
• Government identifiers, card numbers, or bank details.

4. How long we keep it

Data	Retention
License records — your license, its type, term, and installation limit	For as long as the license exists. A license is a continuing entitlement; deleting the record would delete the license.
Purchase and payment records	Seven years after the transaction, as required for tax and accounting.
Activation and installation records, and activation service logs	24 months, then deleted.
License agreement acceptance records	24 months, then deleted, except where an unresolved dispute or a legal obligation requires a specific record to be kept longer.
Educational usage reports	24 months, then deleted. Anonymous totals that identify nobody may be kept indefinitely.
Web and wiki server logs	12 months.
Support correspondence	While it is useful for support, and no more than 24 months after the exchange ends, unless it relates to a license or purchase record still being kept.
Announcements list subscription	Until you unsubscribe.

5. Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA, or under comparable laws in other United States states. We have never done so.

We disclose personal information only to the service providers that make BurnSim work, each for that purpose alone and not for their own:

• PayPal — payment processing (2.3).
• Our hosting providers — the servers that run the website, the wiki, and the licensing service, and the mail servers that deliver validation, license, and support email.

We may also disclose information where we are legally required to — a valid legal process, a lawful government request, or the enforcement or defence of legal claims — or where it is necessary to comply with export control and sanctions law, which the license agreement also addresses. If BurnSim LLC is ever sold or reorganised, license and customer records would transfer with the business; this policy would continue to apply to them, and we would say so publicly before anything changed.

6. Where it is processed

BurnSim LLC is in the United States and our servers are in the United States. If you are in the United Kingdom, the European Economic Area, or Switzerland, using BurnSim means your information is transferred to and processed in the United States. Those transfers are necessary to provide the license you asked for and to perform the contract between us (UK/EU GDPR Art. 49(1)(b)); we also apply the Standard Contractual Clauses where a service provider offers them, and we keep the transferred data to the minimum described in section 2.

7. Schools, students, and children

BurnSim is engineering software for adults and is not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us with personal information, email burnsim@burnsim.com and we will delete it.

Where an institution installs BurnSim under an Educational license, we act on that institution's behalf with respect to anything it enters. Note that:

• We ask institutions not to enter student personal information anywhere in BurnSim or in an activation. A departmental or staff email address is the right thing to activate an EDU license with.
• EDU usage reporting contains no student names, no coursework, no grades, and no free text (2.5). We do not receive, request, or want education records as defined by FERPA, and we do not act as a school official with access to them.
• A computer name is sometimes a person's name. We collect it so that a license holder can identify their own installations; if that is a problem for your institution, tell us and we will discuss how to handle it.
• Institutions subject to FERPA, state student-privacy laws, or a data processing agreement under GDPR Art. 28 should contact us before deployment so the paperwork matches what the software actually does.

8. Your rights

Wherever you live, you may ask us to:

• tell you what we hold about you and what we do with it;
• give you a copy of it, in a portable form;
• correct anything inaccurate;
• delete it;
• restrict or object to our use of it, including any use based on our legitimate interests;
• withdraw consent you previously gave, such as for the announcements list.

Email burnsim@burnsim.com. We will ask you to confirm control of the email address the records are held under — usually by replying from it — because handing someone else's license data to the wrong person is the greater harm. An authorised agent may act for you with written permission. We will not charge you, refuse you service, or degrade the software because you exercised a right.

What deletion means in practice. On request we delete your license and activation records, your Educational usage reports, your support correspondence, and your subscription. Deleting the license record ends the license — the software will no longer activate on your machines — so we will confirm that with you before acting. Two things survive a deletion request, and we would rather say so plainly than surprise you:

• The record that you accepted the license agreement, for as long as section 4 provides. We keep the terms version, its hash, and the timestamp because it is the evidence of what was agreed, which protects you as much as us; we remove your email address from it on request. Legal basis: our legitimate interest in establishing the terms of a license, and the establishment or defence of legal claims (GDPR Art. 17(3)(e)).
• Purchase and payment records, for the seven years tax law requires.

If you are in the UK, EEA, or Switzerland you may complain to your data protection authority — in the UK, the Information Commissioner's Office. If you are in California, Colorado, Connecticut, Virginia, Washington, or another state with its own privacy law, you have the rights that law gives you, including the right to appeal a decision we make on your request; email us and say you are appealing, and a different answer will be given in writing with reasons. California residents may also ask, under the "Shine the Light" law, which categories of personal information we disclosed for direct marketing purposes in the previous year; the answer is none.

9. How we protect it

• Every activation, license check, purchase, and page on our sites is served over TLS. The one exception is BurnSim 3's version check, a legacy endpoint that returns only a version number and carries no personal information; BurnSim 3 activation requires TLS like everything else.
• Your license file is stored on your own machine encrypted with the Windows Data Protection API, so that it is readable only by your account on that machine.
• Licenses are cryptographically signed, so that a tampered license is rejected rather than trusted.
• One-time links are stored only as hashes, never in a usable form.
• The activation and self-service endpoints are rate limited, and the acceptance and release logs are append-only.
• We hold no card or bank details at all, which removes that risk entirely.

No system is perfectly secure. If we ever suffer a breach affecting your personal information, we will notify you and the relevant authorities as the applicable law requires.

10. Automated decisions

The only automated decision BurnSim makes about you is whether an activation is within your license's installation limit, and whether an Educational license renews. Neither produces a legal or similarly significant effect, and a human — email us — will review either one.

11. Changes to this policy

If we change this policy we will update the effective date and version at the top, and note the change on this page. Where a change materially affects how we use information we already hold, we will say so prominently on the website before it takes effect, and the license agreement shown in the software is re-presented on every version change in any case.

12. Contact

BurnSim LLC
Washington State, United States
burnsim@burnsim.com

For support questions rather than privacy ones, see the contact page. The license agreement that governs use of the software is shown when you install BurnSim and is available on request.