BurnSim Wiki:Privacy policy

This is the BurnSim Privacy Policy - the same policy published at www.burnsim.com/privacy.asp, reproduced here so it can be read alongside the License Agreement. It covers the BurnSim software, www.burnsim.com, this wiki, and the licensing service at licensing.burnsim.com.

Effective 29 September 2026 - version 1.1. Questions, requests and complaints: burnsim@burnsim.com (put "Privacy" in the subject).

The short version

• We do not sell your personal information. We never have, and we will not.
• We do not share it with third parties for their own purposes, and we do not use it for advertising, ad targeting, profiling, or cross-site tracking.
• Everything we collect is used to run BurnSim: to issue and check licenses, to answer your support email, to take payment, and to decide which features are worth working on.
• Your motor designs and propellant data never leave your computer. BurnSim does not upload your .bsx files, propellant formulations, burn-rate or characterization data, file names, or notes. That is your intellectual property and frequently unpublished research, and we treat it that way.
• Usage reporting is collected from Educational (EDU) licenses only, and consists of counts, not content. Personal and commercial licenses, and unlicensed evaluation copies, send no usage data at all.
• You can ask us to delete your data, and we will - see Your rights.

Who we are

BurnSim LLC is a Washington State limited liability company and is the data controller for the information described here. Contact: burnsim@burnsim.com. We answer privacy requests within 30 days, and within 45 days where United States state law allows longer.

What we collect, and why

When you activate or use a license

BurnSim contacts licensing.burnsim.com when you activate, and when it checks that an existing license is still valid. That exchange records:

• the email address and, if you have one, the license key you activate with;
• a machine fingerprint derived from your computer's hardware, used to tell one installation from another;
• your computer name, as your operating system reports it, so you can recognise your own installations when you need to release one;
• an installation ID, a random value generated once and kept for the life of that installation;
• the BurnSim version, your operating system version, and whether activation was online or by the offline request-and-response method;
• the IP address the request came from, and the date and time.

Why: to deliver the license you are entitled to, to enforce its installation limit, to renew Educational licenses annually, and to detect abuse of the activation service. Legal basis (UK/EU GDPR): performance of the license contract (Art. 6(1)(b)) and our legitimate interest in preventing license abuse (Art. 6(1)(f)).

The first activation from a new installation emails a validation link to the address given, which is how we confirm it belongs to you. See Activating BurnSim for what that process looks like.

When you accept the license agreement

BurnSim shows the End User License Agreement on first run, and again whenever the agreement text or the application version changes. When you accept it we record that you did: the version and a cryptographic hash of the exact text shown, the installation ID, machine fingerprint and computer name, the application and operating system version, whether a license was active at the time, your IP address, your browser's user agent if you accepted on the web, the timestamp, and your email address and license reference where already known.

Why: so both sides have a record of which terms were agreed. This log is append-only and never edited - an acceptance record that can be quietly rewritten is worthless to you as well as to us. See Your rights for how deletion interacts with it.

When you buy a license

Payments are processed by PayPal. Your card, bank or PayPal credentials are entered on PayPal's systems and are never seen, transmitted or stored by us. The purchase page loads a script from paypal.com to render the payment button, which lets PayPal see that you visited that page and may set its own cookies; PayPal's own privacy statement governs what it does with that.

From a completed payment we receive and keep the payer's name and email address, the transaction ID, the amount, the currency, and which product was bought - to issue your license, to contact you about it, and to meet tax and accounting obligations.

When BurnSim checks for a new version

BurnSim asks our web server for a small file listing the current version - at most once a week in the background, and whenever you choose Help > Check for Updates. The request carries no identifiers; it is an ordinary file download. Our web server log records the requesting IP address, time and user agent, as for any visitor.

Educational (EDU) usage reporting

This section applies only to licenses issued as Educational (EDU) licenses. If you hold a personal or commercial license, or are using BurnSim on an evaluation basis without a license, no usage data is collected from you at all.

Educational licenses are issued free of charge. In exchange, an installation running under an EDU license reports how the software is being used, so development effort goes where it is actually needed. An EDU installation sends periodic aggregate counts:

• how many simulations were run, how long they took, and how many were cancelled or failed;
• which grain types were used, and how many grains a motor had, as a range rather than an exact design;
• which features were invoked - characterization, the nozzle optimizer, the 3-D view, thermochemistry, DXF, SVG or .ric import, ENG export;
• your units preference;
• categories of error encountered, without the underlying data;
• the BurnSim version, operating system, and .NET runtime version;
• the installation ID and machine fingerprint already held for your license, so reports can be counted per installation.

What EDU reporting deliberately does not contain: no free text of any kind, no motor or propellant names, no notes, no file names or paths, no grain dimensions or other numbers from which a design could be reconstructed, no keystrokes or mouse activity, no student names, no coursework, no grades.

BurnSim can also keep a detailed diagnostic log, written only on your own machine, to help us investigate a bug you report. It is turned off by default and records nothing at all unless you switch it on yourself, under Settings > Log Activity for Bug Reports; a normal installation never writes one. Even when you do switch it on, that log is never uploaded - if it is useful for a bug report, you send it to us yourself. The EDU reporting described above is a separate, purpose-built set of counters, built that way precisely so that the diagnostic log can never become the thing that gets sent.

If your institution cannot permit this reporting, tell us at burnsim@burnsim.com and we will discuss a paid license without it, rather than leave you unable to install the software.

When you visit the website

Our web server keeps standard request logs: IP address, timestamp, page requested, HTTP status, referring page and user agent, used to keep the site working and to investigate abuse.

We use no third-party analytics and no advertising or tracking services - no Google Analytics, no advertising pixels, no social media trackers, no data brokers.

Cookies. The site sets one first-party cookie, bs3up, and only on the page offering BurnSim 3 users the upgrade to BurnSim 4. It holds a random tag and the date it was first set, expires after two years, and exists because many universities put hundreds of people behind a single changing IP address - without it we cannot tell three visitors from one visitor arriving three times. It is not used to profile you, is not read on any other page, and is shared with nobody. Blocking it costs you nothing. The purchase page also loads PayPal's script, which may set PayPal's cookies.

Because we do not track visitors across sites and do not sell or share personal information, there is nothing for a Do Not Track or Global Privacy Control signal to switch off - but we honour them regardless.

This wiki

This wiki runs MediaWiki. It is read-only: no account is needed to read it, accounts are not open to the public, and only BurnSim's own operator can edit it. There is therefore nothing for you to contribute, and nothing about you to record or attribute - visiting the wiki collects no more than the ordinary web server request log described above.

When you email us or join the announcements list

Support email is kept so we can follow up and so there is a record of what was reported. An announcements-list subscription is kept until you unsubscribe, and used only to announce BurnSim releases; every announcement says how to leave. Legal basis: consent, which you may withdraw at any time.

When you release an installation yourself

The self-service page at licensing.burnsim.com lets you free up an installation slot. It records the email address you enter, a hashed one-time token, the originating IP address, which installations you released and the reason you gave, and the time; that record also enforces the rate limits published on the page. The page answers the same way whether or not an address holds a license, so it cannot be used to find out who owns one.

What we never collect

• Your motor files, grain geometry, propellant formulations, burn-rate coefficients or characterization data.
• File names, folder paths, or anything else about the contents of your computer.
• Keystrokes, mouse activity, screen contents or screenshots.
• Your precise location. An IP address indicates roughly where a request came from and nothing finer, and we do not attempt to refine it.
• Consumer health data, biometric or genetic data, racial or ethnic origin, religious or political beliefs, sexual orientation, union membership, or any other special-category or sensitive data as those terms are used in the GDPR, the Washington My Health My Data Act and comparable United States state laws. We have no use for any of it and do not want it.
• Government identifiers, card numbers or bank details.

How long we keep it

Data	Retention
License records - your license, its type, term and installation limit	For as long as the license exists. A license is a continuing entitlement; deleting the record would delete the license.
Purchase and payment records	Seven years after the transaction, as required for tax and accounting.
Activation and installation records, and activation service logs	24 months, then deleted.
License agreement acceptance records	24 months, then deleted, except where an unresolved dispute or legal obligation requires a specific record to be kept longer.
Educational usage reports	24 months, then deleted. Anonymous totals that identify nobody may be kept indefinitely.
Web and wiki server logs	12 months.
Support correspondence	While useful for support, and no more than 24 months after the exchange ends, unless it relates to a license or purchase record still being kept.
Announcements list subscription	Until you unsubscribe.

Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA, or under comparable laws in other United States states. We have never done so.

We disclose personal information only to the service providers that make BurnSim work, each for that purpose alone and not for their own:

• PayPal - payment processing.
• Our hosting providers - the servers running the website, this wiki and the licensing service, and the mail servers delivering validation, license and support email.

We may also disclose information where legally required - valid legal process, a lawful government request, or the enforcement or defence of legal claims - or where necessary to comply with export control and sanctions law, which the License Agreement also addresses. If BurnSim LLC is ever sold or reorganised, license and customer records would transfer with the business; this policy would continue to apply to them, and we would say so publicly before anything changed.

Where it is processed

BurnSim LLC is in the United States and our servers are in the United States. If you are in the United Kingdom, the European Economic Area or Switzerland, using BurnSim means your information is transferred to and processed in the United States. Those transfers are necessary to provide the license you asked for and to perform the contract between us (UK/EU GDPR Art. 49(1)(b)); we also apply the Standard Contractual Clauses where a service provider offers them, and keep the transferred data to the minimum described above.

Schools, students and children

BurnSim is engineering software for adults and is not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us with personal information, email burnsim@burnsim.com and we will delete it.

Where an institution installs BurnSim under an Educational license, we act on that institution's behalf with respect to anything it enters. Note that:

• We ask institutions not to enter student personal information anywhere in BurnSim or in an activation. A departmental or staff email address is the right thing to activate an EDU license with.
• EDU usage reporting contains no student names, no coursework, no grades and no free text. We do not receive, request or want education records as defined by FERPA, and we do not act as a school official with access to them.
• A computer name is sometimes a person's name. We collect it so a license holder can identify their own installations; if that is a problem for your institution, tell us and we will discuss how to handle it.
• Institutions subject to FERPA, state student-privacy laws, or a data processing agreement under GDPR Art. 28 should contact us before deployment, so the paperwork matches what the software actually does.

Your rights

Wherever you live, you may ask us to tell you what we hold about you and what we do with it; give you a copy in a portable form; correct anything inaccurate; delete it; restrict or object to our use of it, including any use based on our legitimate interests; or let you withdraw consent you previously gave, such as for the announcements list.

Email burnsim@burnsim.com. We will ask you to confirm control of the email address the records are held under - usually by replying from it - because handing someone else's license data to the wrong person is the greater harm. An authorised agent may act for you with written permission. We will not charge you, refuse you service, or degrade the software because you exercised a right.

What deletion means in practice. On request we delete your license and activation records, your Educational usage reports, your support correspondence and your subscription. Deleting the license record ends the license - the software will no longer activate on your machines - so we will confirm that with you before acting. Two things survive a deletion request, and we would rather say so plainly than surprise you:

• The record that you accepted the license agreement, for as long as the retention table provides. We keep the terms version, its hash and the timestamp because it is the evidence of what was agreed, which protects you as much as us; we remove your email address from it on request. Legal basis: our legitimate interest in establishing the terms of a license, and the establishment or defence of legal claims (GDPR Art. 17(3)(e)).
• Purchase and payment records, for the seven years tax law requires.

If you are in the UK, EEA or Switzerland you may complain to your data protection authority - in the UK, the Information Commissioner's Office. If you are in California, Colorado, Connecticut, Virginia, Washington or another state with its own privacy law, you have the rights that law gives you, including the right to appeal a decision we make on your request: email us and say you are appealing, and a different answer will be given in writing with reasons. California residents may also ask, under the "Shine the Light" law, which categories of personal information we disclosed for direct marketing purposes in the previous year; the answer is none.

How we protect it

• Every activation, license check, purchase and page on our sites is served over TLS. The one exception is BurnSim 3's version check, a legacy endpoint returning only a version number and carrying no personal information; BurnSim 3 activation requires TLS like everything else.
• Your license file is stored on your own machine encrypted with the Windows Data Protection API, readable only by your account on that machine.
• Licenses are cryptographically signed, so a tampered license is rejected rather than trusted.
• One-time links are stored only as hashes, never in a usable form.
• The activation and self-service endpoints are rate limited, and the acceptance and release logs are append-only.
• We hold no card or bank details at all, which removes that risk entirely.

No system is perfectly secure. If we ever suffer a breach affecting your personal information, we will notify you and the relevant authorities as applicable law requires.

Automated decisions

The only automated decision BurnSim makes about you is whether an activation is within your license's installation limit, and whether an Educational license renews. Neither produces a legal or similarly significant effect, and a human - email us - will review either one.

Changes to this policy

If we change this policy we will update the effective date and version at the top and note the change on this page. Where a change materially affects how we use information we already hold, we will say so prominently on www.burnsim.com before it takes effect; the license agreement shown in the software is re-presented on every version change in any case.

Contact

BurnSim LLC, Washington State, United States - burnsim@burnsim.com. For support rather than privacy questions, see the contact page.

See also: License Agreement, Activating BurnSim.