Pilot v0.5, 28 September 2026: in force for the pilot; it may change after legal review, and we will tell you about changes.
Simulacron privacy notice
Version 0.5 (pilot), 28 September 2026.
This notice covers the Simulacron app and websites (simulacron.world and its subdomains, including each place's own site). It's for members, for people who run our device test (for example on test.simulacron.world), and for anyone whose information ends up in a photo by accident.
1. Who is responsible
The controller is Simulacron. Contact: privacy@simulacron.world.
Each place (a "tenant") is run with an organisation, such as the campus operator or building owner, that appoints its admins. Send all requests to us; we coordinate with the place's organisation where needed.
2. What we process
- Sign-in data (your platform account, used only for signing in): Google subject ID, e-mail, name, verification status, timestamps, account status and any invitation.
- Member profile, separate in each place: display name, language, role, accepted terms versions and dates, credit choice, status and trust score. Each place gets a different ID for you, so places can't link your profiles (places that admit people by work e-mail also get your e-mail).
- Your contributions (photos and 360° media) and the link between you and each of them, with metadata: EXIF, time, the area you selected, GPS (only if you allow it), compass heading and orientation, a short motion-sensor trace around each shot, device model, app version, quality scores, and your IP address and country at upload.
- Content warnings on your photos and your decisions (keep, blur, delete).
- Reports: screenshot, position and view in the model, your outline, category and note.
- Moderation and audit logs: uploads, admin and moderator actions, sign-ins.
- Security logs: IP address, browser, requests and errors.
- Web push subscriptions, if you turn on notifications.
- Device tests (optional; for members, and for visitors of test.simulacron.world): phone model, operating system and browser, screen and graphics details, performance numbers, errors and logs, battery level and how accurate your location is (never the coordinates). They contain no names, e-mail addresses or photos, except a tiny blurred camera frame if you tick the box to send it. A member's report is linked to their member profile; a visitor's report is linked to no account.
- Crash reports (members): when a page fails, a small automatic report with the page, the error, the app version and a device summary.
- Later, only if you switch them on: presence (your display name and position in the 3D world), chat messages and live voice.
Other sources: Google (sign-in) and Cloudflare (your country). Only a work Google account and, for capture, camera and motion access are required.
Other people's information. Photos must never show people, but may show names on a whiteboard, a screen or a licence plate; these are flagged for review and can be blurred or reported.
How we use Google user data
Simulacron uses Google only to sign you in ("Continue with Google"). We ask Google only for the basic sign-in scopes: openid, email and profile. From Google we receive your Google account ID (the "subject"), your e-mail address, your name and whether your e-mail address is verified. We don't ask for or receive anything else: not your password, contacts, files, calendar or any other Google data.
We use this data only to sign you in, to run your Simulacron account and to check which places you may enter. Each place gets its own ID for you, your name and, if the place admits people by work e-mail, your e-mail address. No place ever receives your Google account ID or any Google token.
We don't sell Google user data, we don't use it for advertising, and we don't share it with anyone except as this notice describes. When you delete your Simulacron account, your Google account ID, e-mail address and name are deleted from it (section 6).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Signing you in, checking your access to a place, running your account and the contribution agreement | Contract (Art. 6(1)(b)): the terms of use and the contribution agreement |
| Building and showing the 3D world and related features (coverage, missions, stats, credit) | Legitimate interests (Art. 6(1)(f)), ours and the place organisation's: an accurate 3D world of the workplace for its people |
| Keeping originals and metadata for traceability and integrity | Legitimate interests: traceability, detecting fakes, rebuilding models, legal claims |
| Safety and security: person detection, content warnings, reports, moderation, abuse detection, security logs | Legitimate interests: protecting people's privacy, confidential information and security |
| Device tests and crash reports: making the app and the 3D world work on real phones | Visitors' device tests: consent (Art. 6(1)(a)), given by starting the test after the notice; you can stop at any step. The optional camera frame: consent (the tick box). Members' tests and crash reports: legitimate interests |
| GPS location; presence in the 3D world; notifications | Consent (Art. 6(1)(a)); you can withdraw it at any time in the app or your browser |
| Chat and voice (later) | Contract: features you choose to use |
| Records of what you accepted; your privacy requests; requests from authorities | Legal obligations (Art. 6(1)(c)) |
Your right to object. Where we rely on legitimate interests, you can object at any time, on grounds relating to your situation. We'll then stop, unless we have compelling legitimate grounds that override your interests, or need the data for legal claims.
4. Who sees your data
- Other members see the 3D world (built from processed copies, with blurs applied), your chosen credit and, if you switch them on, your presence and chat.
- The place's admins and moderators see original photos with their metadata and uploaders, warnings and decisions, reports, trust scores and the place's audit log.
- Platform admins see sign-in data only, and a place's data only through time-limited, audited "break-glass" support access in exceptional cases, such as fixing a fault.
- Authorities, where the law requires it.
Outside parties. Everything runs on our own servers (at Hetzner in Germany and our own machines in Lithuania), with no third-party analytics, fonts, scripts, maps or error tracking. The only outside parties are:
- Hetzner Online GmbH (Germany): hosting for our main server; our processor.
- Cloudflare, Inc. (USA): the network edge in front of our sites (DNS, encryption, firewall, tunnel), which carries all traffic; our processor.
- Google: sign-in only, under its own privacy policy, as a separate controller. It gets nothing beyond the sign-in; we get your Google ID, e-mail, name and verification status, never your password.
- Your browser's push service (e.g. Google, Mozilla, Apple), only if you turn on notifications, which carry minimal, encrypted content.
5. Transfers outside the EU
Data is stored in the EU (Germany and Lithuania). Cloudflare and Google are US companies; transfers to them, and to push services outside the EU if you use notifications, rely on the EU–US Data Privacy Framework and, where needed, standard contractual clauses.
6. How long we keep data
| Data | How long |
|---|---|
| Sign-in data | While your account exists; deleted or pseudonymised within 30 days after you delete it |
| Member profile, the links to your contributions, personal metadata in working copies | Until your identity is removed (see below) |
| Photos you discard before they are processed | 30 days in the recycle bin (you can restore them), then erased, including the original |
| Contributions: originals, working copies, 3D model versions | No end date; they stay after your identity is removed |
| Archive metadata of originals | No end date; pseudonymous after identity removal |
| Warnings, decisions, moderation and audit logs | No end date; pseudonymous after identity removal |
| Reports | 3 years after the case is closed |
| Device test and crash reports | 180 days |
| Security logs | 30 days |
| Sessions | 12 hours, renewed while you're active; 30 days at most |
| Chat messages (later) | 90 days |
| In-app notifications | 90 days |
| Push subscriptions | Until you turn notifications off or they expire |
| Database backups | Rotated: up to 30 daily and 12 monthly copies |
Contributions stay; your identity can go. The rights in contributions pass to Simulacron (see the contribution agreement), and every original is kept in a restricted archive ("never delete") for traceability, integrity and legal claims. To respect storage limitation and your right to erasure, we remove your identity instead of the content. When you delete your account, ask for erasure or lose access (for example, when you leave your job), within 30 days:
- your member profile is pseudonymised or anonymised;
- the link between you and your contributions is cut, and your credit is removed;
- personal metadata (IP address, device details, anything identifying) is stripped from working copies;
- archived originals are linked only to a pseudonym.
Photos of spaces without people are generally not personal data once unlinked from you. Pseudonymised archive records still are, so they stay restricted. Where the law requires more (for example, a person photographed by mistake asks for erasure), an admin can erase an original through an audited override.
7. Your rights
Under the GDPR (Arts. 15–22) you can ask for access to your data and a copy, correction, erasure, restriction and portability; you can object; and you can withdraw consent at any time. Some rights have limits, such as the exceptions to erasure in Art. 17(3).
How to use them:
- Settings → Privacy & data → Download my data: your profile, your contributions' metadata and processed copies. Ask us if you need more.
- Settings → Privacy & data → Delete account: removes your identity, as described in section 6.
- Discard a photo in My photos before it is processed: it goes to the recycle bin and is erased after 30 days.
- Request removal on a processed contribution in My photos: a request, as the rights are Simulacron's. Sensitive content is hidden at once; otherwise an admin decides and may keep it. Personal information about you in a contribution (such as your name on a whiteboard) is handled under data protection law, usually by blurring it.
- E-mail privacy@simulacron.world for anything else.
We reply free of charge within one month (complex requests: up to two months more, with reasons) and may ask you to confirm your identity.
8. Automated processing
- Person detection (people and faces) is an automated safety filter that never identifies or profiles anyone. It runs:
- on your phone: in auto capture it skips any frame with a recognisable face; in manual capture it checks each photo and, if it may show a person, asks you whether to upload it;
- again on our servers, before any use.
- Content detectors flag screens, whiteboards, documents, signs, text, licence plates, mirrors and reflections for your review. They never blur or delete anything by themselves.
- Photos where our servers find a person are set aside for an admin. The admin can release the photo (there's no person), cover the person and use the rest (the covered part is destroyed before any use), or discard it. Nothing showing a person is ever used in a model, and the original is kept only in the restricted archive.
- Location check: if you allowed location, photos taken outside the place's area are flagged.
- Trust score: an automated abuse signal, based mainly on how many of your photos fit into the 3D model. It can send your uploads to moderation; quarantining uploads or blocking an account is always a person's decision.
We make no decisions with legal or similarly significant effects on you based solely on automated processing (Art. 22).
9. Security
- Each place runs as an isolated cell, with its own database, processes, credentials, files and encrypted backups. Isolation is tested before every production release.
- Encryption in transit (HTTPS, and SSH between our servers).
- A restricted archive for originals.
- Append-only audit logs of uploads, moderation actions and sign-ins.
- Short-lived, host-only session cookies, rate limits and bot protection.
- Content shown to you may carry an invisible watermark linked to your account, to trace leaks.
10. Cookies and local storage
We use only strictly necessary first-party cookies, such as the session cookies that keep you signed in. There are no analytics, advertising or third-party cookies. The app stores its files and photos waiting to upload on your device, so it works offline. The device test keeps its results on your device until they're sent. Our analytics is self-hosted, uses no cookies and stores no personal data.
11. Children
The service is for adults at work; we'll close any account we learn belongs to someone under 18.
12. Changes
We'll announce changes in the app, telling you in advance about significant ones, and record which version you've seen.
13. Contact and complaints
You can contact us first: privacy@simulacron.world. You can also complain to the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI; vdai.lrv.lt, ada@ada.lt), or to the authority in the EU country where you live or work.