Legal

Privacy Policy

Last updated: 2 June 2026

SimQuota is built on a simple principle: collect as little as possible, never sell what we have. Free-tier usage stays on your device. If you opt into a paid plan or family monitoring, only the data needed for those features syncs to our servers — and only to power the feature you turned on. We never sell, rent, or share your personal information with advertisers or data brokers.

Quick jump

→ Cookies → Security → Data retention → Your rights (GDPR)

1. Who we are

SimQuota is developed and operated by Marco Curcio ("we", "us", "our"). For privacy enquiries contact [email protected].

2. What data we collect

2a. Data you provide

Email address — required for account creation and sign-in.
Password — stored as a PBKDF2-SHA256 hash (100,000 iterations, random salt). We never store your plain-text password.
Display name — optional, shown in your profile.
SIM configuration — carrier names, data limits, roaming countries, and cost-per-GB settings you enter in the app. Stored in the cloud only when you are signed in.

2b. Data generated by your use

Usage snapshots — daily and monthly GB totals (Pro subscribers). These are aggregate numbers only — not a log of which apps or websites you visited.
Session tokens — cryptographically random tokens stored in your device Keychain and on our servers to keep you signed in.
Referral and promo code usage — which code was used and by which account.

2c. Data collected automatically

IP address — used ephemerally for rate limiting (brute-force protection). Not stored in our database.
Country code — derived from your IP by Cloudflare (CF-IPCountry header), used to detect roaming. Not stored persistently.

2d. What we do NOT collect

We do not collect browsing history, app usage logs, contacts, GPS location, advertising identifiers, or any behavioural tracking data. Cellular data readings are computed entirely on-device by iOS — we never receive raw network interface statistics.

3. How we use your data

Purpose	Data used	Legal basis (UK/EU GDPR)
Providing the service (auth, sync, family dashboard)	Email, session tokens, SIM config, snapshots	Contract performance
Transactional emails (verification, password reset, weekly digest)	Email address	Contract performance
Rate limiting and abuse prevention	IP address (ephemeral)	Legitimate interest
Processing subscriptions and promo codes	Account ID, subscription tier	Contract performance
Improving the service	Aggregate, anonymised metrics	Legitimate interest

We do not use your data for advertising, profiling, or any purpose beyond operating SimQuota.

4. Third-party services

Service	Purpose	Data shared	Privacy policy
Cloudflare	API hosting, database, KV storage, CDN	All server-side data transits Cloudflare infrastructure	cloudflare.com/privacypolicy
Resend	Transactional email delivery	Your email address and email content	resend.com/legal/privacy-policy
Apple	App distribution, Apple Sign In, payments	Governed by Apple's own privacy policy	apple.com/legal/privacy

Geist is now self-hosted on simquota.com under /fonts/geist/; we do not send any visitor data to Google for webfont delivery.

We do not sell data to any third party. We do not use advertising SDKs, Facebook Pixel, or Google Analytics.

See our Data Processing Agreement page for the current subprocessor list and how to request our standard DPA terms.

4a. Cookies and similar technologies

SimQuota.com uses cookies and local storage sparingly. We do not use third-party advertising or tracking cookies. Here is the complete list:

Name / key	Type	Purpose	Lifetime
`access_token`	localStorage	Keeps you signed in to the web dashboard.	1 hour (auto-renewed)
`refresh_token`	localStorage	Issues new access tokens without re-login.	30 days or until sign-out
`simquota_referral_code`	localStorage	Remembers a referral code from `/refer` for use during signup.	Until used or cleared
`__cf_bm` / `cf_clearance`	Cookie (Cloudflare)	Bot management / DDoS protection. Strictly necessary, set by our CDN.	Session

You can clear all of these by signing out, clearing your browser's site data for simquota.com, or using private browsing. We do not use analytics cookies, advertising pixels, social-media trackers, or session replay tools.

5. Data storage and security

All data is stored in Cloudflare's infrastructure (EU and US data centres).
All data is transmitted over HTTPS/TLS only.
Passwords are hashed with PBKDF2-SHA256 (OWASP-recommended iteration count, 16-byte random salt). We cannot recover your password.
Session tokens are 128-bit cryptographically random values stored in your device Keychain.
Access tokens expire after 1 hour; refresh tokens after 30 days.

6. Data retention

Data type	Retention
Account (email, password hash, display name)	Until you delete your account
SIM configuration	Until you delete your account or remove the config
Usage snapshots	30 days (auto-pruned daily)
Sessions	30 days, or until sign-out
Email verification tokens	24 hours
Password reset tokens	1 hour

7. Your rights (UK & EU GDPR)

Access (Art. 15) — request a copy of the data we hold about you. Available in the web dashboard: Settings → Export your data. Returns a complete JSON file of every record we hold against your account.
Rectification (Art. 16) — correct inaccurate data. You can update your display name in the app at any time.
Erasure (Art. 17) — delete your account and all associated data. Available in the app (Settings → Profile → Delete account) and on the web (/settings). A 30-day grace window applies, after which all personal data is hard-deleted by an automated daily job.
Portability (Art. 20) — the data export above is machine-readable JSON, suitable for re-import into a competing service.
Restriction / objection (Arts. 18, 21) — request that we stop processing your data.
Withdraw consent (Art. 7(3)) — withdraw consent for any consent-based processing at any time. The mechanism is at least as easy as giving consent: weekly digest opt-out is one-click from any digest email, marketing-email opt-out is in /settings, and analytics opt-out is in the iOS app under Settings → Privacy.
No automated decision-making (Art. 22) — SimQuota does not use your personal data for profiling or automated decisions that produce legal or similarly significant effects. We do not score, rank, or differentiate users algorithmically.

To exercise any right contact [email protected]. We respond within 30 days. You may also lodge a complaint with the UK ICO at ico.org.uk or your local EU supervisory authority.

7a. Data collected indirectly (Art. 14)

Some data we hold about you was not provided by you directly:

Family invitee data — when an existing user invites you to their SimQuota family, your email address (if they used the email invite flow) is shared with us by the inviter so we can send the invitation. Source: the inviting user. If you decline or never sign up, the invite code expires after 10 minutes and the email address is purged.
eSIM coupon attribution — upvotes and downvotes on community-submitted eSIM codes are associated with your account ID. Source: your in-app vote.
Referral attribution — when you sign up via someone else's referral code, the link between you and the referring account is recorded so both parties receive their free Pro month. Source: the URL parameter on the referral page.

8. Children's privacy

SimQuota is not directed at children. We do not knowingly collect personal data from children under the applicable digital-age-of-consent in your jurisdiction:

United States (COPPA) — under 13.
United Kingdom — under 13.
European Economic Area — the threshold varies by member state, ranging from 13 (e.g. Belgium, Denmark, Estonia, Finland, Latvia, Malta, Norway, Portugal, Sweden, UK) to 14 (Austria, Bulgaria, Cyprus, Italy, Lithuania, Spain) to 15 (Czechia, France, Greece, Slovenia) to 16 (Croatia, Germany, Hungary, Ireland, Luxembourg, Netherlands, Poland, Romania, Slovakia). We apply the local threshold for users in each country.

Family Kids Mode — Pro Family includes a "Kids Mode" feature that lets a family admin restrict another member's data limit and disable monitoring toggles. Kids Mode requires the child member's own consent to receive the invite (they click an emailed link), but it is the parent / family admin's responsibility to ensure the child meets the local digital-age-of-consent. We do not independently verify parental consent for users below the local age of consent, so SimQuota's Family feature should not be used for children below that threshold.

If you believe a child below the applicable age has registered, contact [email protected] and we will delete the account.

8a. Data Protection Officer

SimQuota is operated by a single self-employed developer and our processing does not meet the thresholds in GDPR Art. 37 that mandate appointment of a Data Protection Officer (large-scale systematic monitoring of data subjects or large-scale processing of special-category data). We have therefore not appointed a DPO. All privacy enquiries are handled by the controller directly at [email protected].

8b. EU representative (Art. 27)

SimQuota is operated from the United Kingdom. For data subjects in the European Economic Area, an Article 27 representative is being appointed; the name and contact details will appear here once registered. In the interim, EEA data subjects may exercise their rights by contacting [email protected] directly, or by lodging a complaint with their local supervisory authority.

9. International transfers

Your data may be processed in the United States and elsewhere via Cloudflare infrastructure. We rely on:

The EU-U.S. Data Privacy Framework for transfers to Cloudflare's U.S. entity (Cloudflare is a certified participant).
Standard Contractual Clauses (Module 2: Controller to Processor) approved by the European Commission, incorporated by reference in our Data Processing Agreement with Cloudflare and Resend, for transfers to any non-DPF jurisdiction.
A transfer impact assessment for transfers to the U.S. that concludes the safeguards above, combined with technical measures (TLS in transit, at-rest encryption), are sufficient given the data we process.

10. Changes to this policy

We will notify you by email of any material changes. The "last updated" date at the top of this page always reflects the current version. Continued use after changes constitutes acceptance.

11. Contact

Email: [email protected] — subject line "Privacy Request"