Privacy statement
1. Who is responsible
Ordinate 2D is made by Solapsis, a sole proprietorship (eenmanszaak) of Efe Kapukulak, Box E6862, Verdunplein 17, 5627 SZ Eindhoven, the Netherlands. Chamber of Commerce (KVK) number: not yet registered. Contact: [email protected]. Solapsis decides why and how your personal data is used, so it is the "controller" under the GDPR.
2. The studio (the app at /app/)
The simulator runs entirely in your browser. The scenes you build, your settings, your autosave and the Python scripts you write stay on your device (in your browser's local storage) and are not sent to us, unless you save them to My Assets in your account (section 3). We use no advertising, no tracking cookies and no analytics service from another company; we count visits and the use of the studio ourselves, without cookies and without anything that identifies you (section 6). Signing in is optional; if you sign in, we set one cookie that keeps you signed in (section 3), and none otherwise. Fonts, scripts and the simulation engine are served from this site, not from third parties. The one exception is the payment window (section 4), which loads from Paddle only when you press Upgrade. Clearing your browser data removes what the studio stored.
3. Your account (optional)
| What | Your email address; if you continue with Google, also your name and Google's ID for your account (Google tells us these and that the address is verified, nothing else); your plan and, if you have a Pro subscription, its status, its billing period and whether it is cancelled (section 4); when the account was made and when you last signed in. For each browser you are signed in on: how you signed in, the browser's description (its "user agent"), and when the sign-in started and was last used. For each sign-in link or code you ask for: the address, the time, a keyed hash of your IP address (not the address itself), to limit how many can be requested, and, for the six-digit code, only a keyed hash of it. If you use My Assets in your account: the scenes and scripts you save there, with their names, folders, thumbnails and dates. |
|---|---|
| Why | To sign you in and keep your account, and to protect sign-in against abuse. |
| Legal basis | The agreement with you about your account (GDPR Article 6(1)(b)); protecting the service against abuse is our legitimate interest (Article 6(1)(f)). |
| Who sees it | Only the owner. The data is stored with Cloudflare, Inc. (hosting and database) and sign-in emails are sent through Resend, Inc.; both act as our processors and may process data outside the EU under the standard contractual clauses or the EU–US Data Privacy Framework. If you choose Google, Google's own privacy policy applies to your Google sign-in. We do not sell or share your data. |
| How long | Until you delete the account: Account → Delete Account in the studio deletes it at once, with everything stored with it, My Assets included; an item you delete in My Assets is deleted at once. A sign-in on a browser ends after 30 days without use, or when you sign out. Sign-in links and codes are deleted a day after they expire (15 minutes after they are sent). |
| Cookie | One cookie, __Host-o2d_session, holding a random sign-in key; strictly necessary for being signed in, so it needs no consent. While you sign in with Google, a second cookie holds the sign-in's security values for at most 10 minutes. |
Account → Download My Data in the studio gives you everything stored about you as a file.
Share links. When you share a scene, a copy of it, its name and a picture of it are stored with Cloudflare and anyone who has the link can open and play it; we count how often it is opened. It is not listed anywhere or shown to search engines. Unshare it in the studio (Share → Unshare) to delete it at once; deleting your account ends all your links.
4. Paying for Pro
| What | When you start a Pro subscription we pass your email address and your account's random ID to Paddle, so the payment is linked to your account. Paddle collects what it needs to sell to you: your name or company, billing address and country, the payment method, and the payment history. We receive back from Paddle only the subscription's status, its price, the billing period, whether it is cancelled, and Paddle's customer and subscription numbers. We never see your card. |
|---|---|
| Why | To sell you the subscription, give you Pro while it lasts, and let you manage and cancel it. |
| Legal basis | The agreement with you (GDPR Article 6(1)(b)); keeping invoices and tax records is a legal duty (Article 6(1)(c)). |
| Who sees it | Paddle.com Market Limited is the merchant of record and is responsible for the personal data it needs to process the payment, tax and invoices, under its own privacy policy. The payment window is Paddle's script, loaded from cdn.paddle.com only when you press Upgrade, and it may store data in your browser to work and to prevent fraud. Nothing from Paddle is loaded otherwise. |
| How long | The subscription row stays until you delete your account, which also ends the subscription at Paddle at once. Paddle keeps invoices and payment records for as long as tax law requires. |
5. The marketplace and the forum (public content)
| What | What you choose to publish: the display name and bio you chose, marketplace items (title, description, tags, the scene file, its thumbnail, versions and licence) and forum threads and posts. Also: reports you file (the reason you give) and, for moderation, the decisions taken, their reasons and when. We count how often items and threads are opened and downloaded. |
|---|---|
| Why | To run the marketplace and the forum, to keep them safe and lawful, and to handle reports of illegal or harmful content. |
| Legal basis | The agreement with you about what you publish (GDPR Article 6(1)(b)); keeping the places safe and stopping abuse is our legitimate interest (Article 6(1)(f)); handling notices of illegal content is a legal duty (Article 6(1)(c)). |
| Who sees it | What you publish is public: anyone can read it, and search engines may list it. Your email address is never shown. Moderators (the owner and people the owner names) see waiting items and posts and the reports about them, with the display name of whoever reported, to decide. We write to you by email about decisions. The moderators are emailed about items and posts that wait. Hosting and email are processed by Cloudflare and Resend as in section 3. |
| How long | Until you delete the item or post, or your account: deleting your account deletes your items and replies and removes your name from the threads you started; reports you filed stay without your name. Records of a moderation decision are kept only as long as needed to handle an appeal or a legal claim. |
6. Statistics (counting visits and use)
| What | Counts, per day: which page was opened (for example the pricing page, never a forum thread's or item's own address), which site or link the visit came from (for example Google, Reddit, a link we tagged ourselves, or none), the country (from Cloudflare, not from your address in our data), a coarse screen size (phone, tablet or desktop), and in the studio which tools, menu items, example scenes and property fields were used (the name of the property field, never the value you typed, and never a scene, a name or any text of yours). We also count events such as sign-ups, posts, published items, shared scenes and payments as totals, not linked to any account. |
|---|---|
| Why | To see what works and what does not, which parts of the studio are used and which are not, and where visitors come from, so we can improve Ordinate 2D and decide where to spend effort. It is not used for advertising or sold. |
| Legal basis | Our legitimate interest in improving the service (GDPR Article 6(1)(f)). It is done with as little data as possible: no cookie, no identifier stored on your device, only anonymous daily totals. We think this is the kind of low-impact counting that needs no consent under the Dutch cookie rules; if that view changes we will ask first. |
| How it works | Your browser sends the counts to our own server at ordinate2d.com; nothing goes to another company. To count a visitor once a day, the server briefly calculates a one-way code from your IP address and browser type with a secret key that changes its meaning every day; that code cannot be turned back into your address, is deleted after two days, and is never stored with the totals. The totals contain no IP address, no account and no code. |
| Who sees it | Only the owner. The data is stored with Cloudflare, Inc. (hosting and database), our processor. |
| How long | The daily totals are kept as long as the service runs; they are not personal data. The daily code is deleted after two days. |
| Your choice | Nothing is counted if your browser sends "Do Not Track" or "Global Privacy Control". You can also switch it off here, for this browser: (this saves that one setting on your device, which is all it stores). |
7. Server logs
Like any website, our host processes technical data (such as your IP address and the pages requested) to deliver the site and to protect it against abuse. We do not store this data ourselves or use it to identify you.
8. Your rights
You may ask us to show you your data, correct it, delete it, restrict its use, or give it to you in a portable format, and you may object to its use or withdraw your consent. Write to [email protected]; we answer within one month. If you think we handle your data wrongly, you may complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority in your own country.
9. Changes
If this statement changes in a way that matters to you, we will say so on this page and, for account holders, by email.