Legal

Privacy Policy

Last updated: 19 May 2026

SimQuota is SimQuota is built on a simple principle: your data is yours. We collect only what's needed to run the service and never sell, rent, or share your personal information with advertisers or data brokers.

1. Who we are

SimQuota is developed and operated by Marco Curcio ("we", "us", "our"). For privacy enquiries contact privacy@simquota.com.

2. What data we collect

2a. Data you provide

Email address — required for account creation and sign-in.
Password — stored as a PBKDF2-SHA256 hash (100,000 iterations, random salt). We never store your plain-text password.
Display name — optional, shown in your profile.
SIM configuration — carrier names, data limits, roaming countries, and cost-per-GB settings you enter in the app. Stored in the cloud only when you are signed in.

2b. Data generated by your use

Usage snapshots — daily and monthly GB totals (Pro subscribers). These are aggregate numbers only — not a log of which apps or websites you visited.
Session tokens — cryptographically random tokens stored in your device Keychain and on our servers to keep you signed in.
Referral and promo code usage — which code was used and by which account.

2c. Data collected automatically

IP address — used ephemerally for rate limiting (brute-force protection). Not stored in our database.
Country code — derived from your IP by Cloudflare (CF-IPCountry header), used to detect roaming. Not stored persistently.

2d. What we do NOT collect

We do not collect browsing history, app usage logs, contacts, GPS location, advertising identifiers, or any behavioural tracking data. Cellular data readings are computed entirely on-device by iOS — we never receive raw network interface statistics.

3. How we use your data

Purpose	Data used	Legal basis (UK/EU GDPR)
Providing the service (auth, sync, family dashboard)	Email, session tokens, SIM config, snapshots	Contract performance
Transactional emails (verification, password reset, weekly digest)	Email address	Contract performance
Rate limiting and abuse prevention	IP address (ephemeral)	Legitimate interest
Processing subscriptions and promo codes	Account ID, subscription tier	Contract performance
Improving the service	Aggregate, anonymised metrics	Legitimate interest

We do not use your data for advertising, profiling, or any purpose beyond operating SimQuota.

4. Third-party services

Service	Purpose	Data shared	Privacy policy
Cloudflare	API hosting, database, KV storage, CDN	All server-side data transits Cloudflare infrastructure	cloudflare.com/privacypolicy
Resend	Transactional email delivery	Your email address and email content	resend.com/legal/privacy-policy
Apple	App distribution, Apple Sign In, payments	Governed by Apple's own privacy policy	apple.com/legal/privacy

We do not sell data to any third party. We do not use advertising SDKs, Facebook Pixel, or Google Analytics.

5. Data storage and security

All data is stored in Cloudflare's infrastructure (EU and US data centres).
All data is transmitted over HTTPS/TLS only.
Passwords are hashed with PBKDF2-SHA256 (100,000 iterations, 16-byte random salt). We cannot recover your password.
Session tokens are 128-bit cryptographically random values stored in your device Keychain.
Access tokens expire after 1 hour; refresh tokens after 30 days.

6. Data retention

Data type	Retention
Account (email, password hash, display name)	Until you delete your account
SIM configuration	Until you delete your account or remove the config
Usage snapshots	30 days (auto-pruned daily)
Sessions	30 days, or until sign-out
Email verification tokens	24 hours
Password reset tokens	1 hour

7. Your rights (UK & EU GDPR)

Access — request a copy of the data we hold about you.
Rectification — correct inaccurate data. You can update your display name in the app.
Erasure — delete your account and all associated data instantly. Available in the app: Settings → Profile → Delete account.
Portability — export your usage history as CSV (Pro feature).
Restriction / objection — request that we stop processing your data.

To exercise any right contact privacy@simquota.com. We respond within 30 days. You may also lodge a complaint with the UK ICO at ico.org.uk or your local EU supervisory authority.

8. Children's privacy

SimQuota is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from children. Contact privacy@simquota.com if you believe a child has registered.

9. International transfers

Your data may be processed in the United States via Cloudflare infrastructure. Cloudflare participates in the EU-U.S. Data Privacy Framework. By using SimQuota you consent to this transfer.

10. Changes to this policy

We will notify you by email of any material changes. The "last updated" date at the top of this page always reflects the current version. Continued use after changes constitutes acceptance.

11. Contact

Email: privacy@simquota.com — subject line "Privacy Request"