Skip to content
SimanticDashboard

Privacy Policy

Effective date: TBD

1. Who we are

Simantic, Inc. (“Simantic,” “we,” “us”) operates this website and the Simantic CLI, MCP, Desktop and Github Apps. You can reach us at privacy@simantic.dev.

2. Information we collect

We collect the following categories of personal information:

  • Contact form submissions: first name, last name, job title, company, and work email when you fill out our contact form.
  • Job applications: first name, last name, email, project descriptions, cover letter text, and resume file (PDF) when you apply through our careers page.
  • Account information: if you sign in with Google, we receive your email address, name, and profile picture URL from Google.
  • API credentials and usage data: personal access token names you create, and usage reports submitted by the Simantic CLI you have authenticated. Each report holds:
    • the command run, its exit code, start time and duration
    • the CLI version, OS, CPU architecture and build type
    • the MCU model and timeout
    • the firmware’s size and SHA-256 hash
    • every command-line flag you typed, with its value (which can include local file paths, such as the path to your firmware)
    • an error category when a run fails
    Reports never include the firmware itself, UART or trace output, or memory contents.
  • Cloud Sim runs: the firmware files (ELF) you run on Cloud Sim, their size and SHA-256 hash, the URL you had us fetch one from, each run’s MCU, engine and options, and what it printed (its UART output and console). See Cloud Sim firmware below. A run also carries your API key, which we keep encrypted until the run ends; for runs you start from the dashboard, we create an API key named “Cloud Sim” for you and keep it encrypted.
  • Cloud Sim demo: when you run an example on simantic.com/cloud-sim without an account, we keep the run and a keyed hash of your IP address, which limits how many runs each visitor has at once. We do not keep the address itself.
  • GitHub pull request reviews: if you connect the Simantic GitHub App, the installation (its id, the GitHub account it is installed on, your GitHub login and the repositories you selected), and for each review you ask for: the pull request’s repository, number, title and commit hashes, the reviewer’s report (its summary, the scenarios it ran with their simulator output, and its findings), its log, the token counts and cost of the review and what was charged for it, the firmware files (ELF) it built from the pull request’s head and base with their size and SHA-256 hash, and the email addresses of the people you invite to a review or a repository’s reviews. See GitHub pull request reviews below.
  • Authentication session: our auth provider stores a session token in your browser so you stay logged in.
  • Website analytics: aggregated, non-identifying information about visits to this site (such as pages viewed, referring site, approximate location by country, and device or browser type), collected via Vercel Web Analytics without cookies.

3. How we use your information

  • To respond to your inquiries and evaluate job applications.
  • To provide, secure, and improve the Simantic product.
  • To run your Cloud Sim simulations and, unless you turn firmware storage off, to let you download your firmware and run it again.
  • To review the pull requests you ask us to, by building and simulating the firmware they change and posting the result on GitHub, and, unless you turn firmware storage off, to let you download the firmware a review built.
  • To analyze aggregated usage of the CLI to improve reliability and compatibility.
  • To comply with legal obligations.

4. How your information is stored

We use Supabase (a managed PostgreSQL and object storage service) as our backend. Form submissions, account data, and uploaded resumes are stored in Supabase. Authentication is handled by Supabase Auth, with Google as our identity provider.

Cloud Sim runs on InstaCloud: your runs and their results are kept in a PostgreSQL database InstaCloud manages, their stored firmware in a private storage bucket InstaCloud manages, and each run executes in a container of its own on InstaCloud, which is removed when the run ends. Firmware and API keys are encrypted (AES-256-GCM) before they are stored.

Pull request reviews run on InstaCloud too: each review clones the repository into a container of its own, which is removed, clone and all, when the review ends. The review’s report and log, what it cost, and the people you invited to it are kept in the same database as your Cloud Sim runs, and the firmware it built in the same private storage bucket as your runs’ firmware, encrypted the same way.

5. Sharing

We do not sell your personal information. We share data only with the service providers required to operate the site (Supabase for storage and authentication, Google for sign-in, Vercel for hosting and website analytics, and InstaCloud for Cloud Sim’s database, its firmware storage and the containers its runs execute in), and where required by law.

For pull request reviews, two more: GitHub, whose App reads the pull request and posts the review as simantic-bot, and Anthropic, our model provider, to whose API we send the pull request’s diff, the build output and the simulator output of the review, under Simantic’s agreement with Anthropic as an API customer. You give us no key of your own.

A review you share is shown to the people you invite, once they sign in to Simantic with the email you gave, or, if you open it to anyone with the link, to any signed-in Simantic user who has it. They see the review’s report, log and scenarios, not what it cost you.

6. Data retention

Contact submissions and job applications (including resumes) are retained for [TBD] months unless you request earlier deletion. Account data is retained for the life of your account. Cloud Sim runs are retained for the life of your account, and their firmware as described in the next section. Pull request reviews, their reports, logs and charges are retained for the life of your account, and the firmware they built as described in section 8; the people you invited to a review until you remove them.

7. Cloud Sim firmware

When you run firmware on Cloud Sim, through the API, the CLI, the MCP server or the dashboard, we keep the firmware file after the run, encrypted, so that you can download it and run it again. We use it only for that and to run your simulations.

You decide how long we keep it:

  • Delete one run’s firmware from that run’s page in the dashboard, or through the API.
  • Turn off firmware storage in your account’s Cloud Sim settings, or through the API. This deletes all of your stored firmware at once, your runs’ and the firmware your pull request reviews built, and from then on each run’s firmware is deleted when the run ends and reviews keep none.

Otherwise we keep it until you ask us to delete your account. A run’s details and results, including the firmware’s size and SHA-256 hash and what the run printed, are kept for the life of your account whether or not its firmware is.

A firmware file can hold more than code: text strings, file paths from the machine that built it (which may include your user name), and any keys or passwords compiled into it. Leave secrets out of the firmware you run on Cloud Sim, or turn firmware storage off.

The examples on simantic.com/cloud-sim run on a separate demo server, which keeps no firmware.

8. GitHub pull request reviews

When you ask Simantic to review a pull request, by mentioning @simantic-bot in a comment on it, we read the repository’s contents at the pull request’s head and base commits, the pull request’s diff and the comment that asked, with the GitHub App installation you connected. We clone the repository into a container of its own, build its firmware, run it in the simulator, and send the diff, the build output and the simulator output to Anthropic’s API, under Simantic’s agreement with Anthropic, so the reviewer can write its report. The container and the clone are removed when the review ends; the report, the log and what the review cost are kept, as above, and the review is posted on the pull request.

Unless you turn firmware storage off, we also keep the firmware files the review built, encrypted, so that you can download them: the firmware of the commit it reviewed, and of the pull request’s base (where its branch started from the base branch), when the review built it to compare with. We keep one base for all of the pull request’s reviews, its current one: when the pull request moves to a different base, a later review replaces it with the new base’s firmware, or deletes it if that review did not need to build the base. We use them only to let you download them. Delete one from the review’s or the pull request’s page in the dashboard, or through the API; turning off firmware storage in your Cloud Sim settings deletes them all, as it does your runs’ firmware. Otherwise we keep them until you ask us to delete your account. Like the firmware you run, a built firmware file can hold text strings, file paths and any keys or passwords compiled into it.

Anyone with write access to a connected repository can ask for a review, and it comes out of the plan of the account that connected the installation. To stop reviews, disconnect the installation in the dashboard or uninstall the app from your GitHub settings. A repository can hold more than code: keep secrets out of the repositories you connect, as you would out of the firmware you run on Cloud Sim.

Reviews are private to the account that connected the installation until you share one: with people you invite by email, or with anyone signed in to Simantic who has the link, for one review or for every review of a repository. You can change or withdraw that at any time on the review’s page or in the dashboard’s repository list. The people you share a review with do not get the firmware it built.

9. Your rights

Depending on your jurisdiction (including the EU/UK under GDPR and California under CCPA/CPRA), you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise any of these rights, email privacy@simantic.dev.

10. Cookies and similar technologies

We use only the storage strictly necessary to keep you signed in. For aggregate traffic measurement we use Vercel Web Analytics, which counts page views without using cookies or storing identifiers on your device, and does not collect personally identifiable information or track you across other sites. We do not use advertising or marketing trackers.

11. Security

We use reasonable technical and organizational measures to protect your data. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

12. Children

This service is not directed to children under 16, and we do not knowingly collect personal information from them.

13. Changes to this policy

We may update this policy from time to time. We will post the new effective date at the top of this page.

14. Contact

Questions about this policy? Email privacy@simantic.dev.