Privacy Policy
This policy explains what personal data Physica Lab collects when you use our physics simulation library, why we collect it, how long we keep it, and the choices you have. It is written to be read, not to be skimmed past.
1. Who is responsible for your data
Physica Lab ("Physica Lab", "we", "us") operates this website and is the data controller for the personal data described here. Our postal address is available on request from the contact address at the bottom of this page.
Purchases are handled by Creem as merchant of record. For payment and tax data, Creem acts as an independent controller — see section 5.
2. What we collect
| Category | What it is | Why we need it |
|---|---|---|
| Account data | Email address, display name (optional), password stored only as a salted PBKDF2-SHA256 hash, account creation date. | To create your account, sign you in, and let you reset a forgotten password. |
| Session data | A random session token. We store only its SHA-256 hash, plus its expiry time (30 days). | To keep you signed in between visits. |
| Email verification data | The email address a code was sent to, a hash of the code, its expiry, and how many times it was tried. | To confirm you own the address and to stop code-guessing. |
| Membership data | Which plan is active, when it started, when it expires. | To unlock the features you paid for. |
| Order data | Order reference, plan, amount and currency, order status, Creem transaction and customer identifiers, timestamps. | To deliver your purchase, answer billing questions, handle refunds, and meet tax and accounting obligations. |
| AI tutor usage | A daily counter of how many questions you have asked. The text of your questions is not stored by us. | To apply the free-tier daily limit fairly. |
| Activation licences | A machine code you choose to enter, the activation code issued for it, and when it was last used. | To let you run downloaded material offline on your own devices. |
| Saved work | Circuit diagrams and configurations you explicitly save to your account. | So you can reopen them later. Deleted when you delete your account. |
| Technical data | Page path, referring page, browser user-agent, and a one-way hash of your IP address. We do not store your raw IP address alongside this. | To understand which simulations are used, and to block abuse and scraping. |
| Rate-limit counters | Short-lived per-minute counters keyed by a hashed identifier. | To stop automated abuse of sign-in, email and AI endpoints. |
What we do not do. We do not run advertising or third-party analytics trackers. We do not sell personal data. We do not store your card number — it never reaches our servers.
3. Cookies and local storage
We use one cookie, pl_session. It holds your session token, is
HttpOnly and SameSite=Lax, is marked
Secure over HTTPS, and expires after 30 days or when you sign out.
It is strictly necessary — without it you cannot stay signed in, so it is not
subject to consent under the ePrivacy Directive.
We also use your browser's local storage to remember interface preferences (such as language and theme) and to cache simulation assets so pages load faster. This stays on your device and is not transmitted to us.
4. Why we are allowed to process it
- Contract — to provide the account, simulations, downloads and AI tutor you asked for.
- Legal obligation — to keep invoices and order records for tax and accounting.
- Legitimate interests — to keep the service secure, prevent abuse, and understand aggregate usage. We balance this against your rights and keep the data minimal.
- Consent — where we ask for it explicitly, for example if you opt in to product emails. You can withdraw consent at any time.
5. Who else is involved
We use a small number of processors. Each is bound by a data processing agreement and may only use your data to provide their service to us.
| Provider | Role | Data involved |
|---|---|---|
| Creem | Merchant of record: takes payment, calculates and remits sales tax and VAT, issues invoices, handles refunds and chargebacks. | Name, email, billing country, payment details, order amount. Creem is an independent controller of this data under its own privacy policy. |
| Cloudflare | Hosting, content delivery and database. | All data described above is stored and served through Cloudflare infrastructure. |
| Resend | Delivers transactional email (verification codes, receipts, account notices). | Your email address and the contents of the message. |
| AI model provider | Generates answers for the AI tutor. | The text of the question you submit at that moment. We do not attach your account identity to it beyond what is needed to authorise the request. |
We may also disclose data where we are legally required to, or to establish or defend legal claims. If the business is ever transferred, data may pass to the acquirer under the same terms.
6. International transfers
Our infrastructure and processors operate globally, so your data may be processed outside your country, including in the United States. Where data leaves the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and membership | Until you delete your account. |
| Sessions | 30 days after sign-in, or immediately on sign-out. |
| Verification codes | A few minutes; deleted once used or expired. |
| Saved circuit diagrams | Until you delete them or your account. |
| Order and invoice records | Kept after account deletion, because tax and accounting law requires it (typically 6–10 years depending on jurisdiction). These records are reduced to what the law requires. |
| AI usage counters | Rolling daily counters; not kept long term. |
| Visit and rate-limit logs | Short-lived, then deleted or aggregated. |
| Payment webhook log | Kept for reconciliation and dispute handling, then deleted. |
8. Your rights
Depending on where you live, you may have the right to:
- know whether we hold data about you, and get a copy of it;
- correct data that is wrong;
- delete your data;
- receive your data in a portable, machine-readable format;
- object to, or ask us to restrict, certain processing;
- withdraw consent where processing is based on it;
- complain to your local data protection authority.
Two of these are self-service and take effect immediately:
- Export your data — signed in, request a machine-readable JSON copy at
/api/auth/export. - Delete your account — at
/api/auth/delete-account. This removes your profile, sessions, saved work, licences and membership. Order records are retained as described in section 7.
For anything else, email us at the address at the bottom of this page. We respond within 30 days.
9. Security
Passwords are stored as salted PBKDF2-SHA256 hashes, never in plain text. Session tokens are stored only as hashes, so a database leak does not hand out working sessions. Traffic is encrypted with TLS. Access to production systems is limited and logged. No system is perfectly secure, but we work to keep the data we hold small enough that a breach would be limited.
10. Children
The service is intended for use by teachers and students at secondary school level and above. It is not directed at children under 13, and we do not knowingly collect their data. If you believe a child under 13 has created an account, contact us and we will delete it. Where local law sets a higher age of digital consent (16 in parts of the EU), a parent, guardian or school is responsible for authorising the account.
11. Changes to this policy
If we change how we handle personal data, we update this page and move the effective date at the top. Material changes are announced on the site or by email before they take effect.