Privacy policy

Last updated: 6 November 2026

This is a translation. If it differs from the Hebrew version, the Hebrew version governs.

Simu stores only what it needs for practice to work. You do not have to sign up, and we do not ask for a name, email address or phone number. This page explains what is stored, why, who receives the data, for how long, and what your rights are.

Who is responsible for the data

Simu is run by Johnny Labs, which is responsible for the data stored in it. You can write to us about any privacy matter: hello@johnnylabs.co.il.

What is stored in the practice app

• Guest account. On your first visit a guest account opens, with a random ID and a made-up email address that the system creates. It holds no name, real email address or phone number.
• Language. If you chose a language in the app (Hebrew, Arabic, Russian, French or English), it is stored in the account so that the app appears in that language on your next visit too. If you did not choose one, the app appears in Hebrew. The language is included in the data file you can download, and it is deleted with the account.
• Sign-in cookie. One cookie connects the browser to the guest account, so that your progress is kept for your next visit. It expires 90 days after your last visit. The IP address and the browser description are not stored with the sign-in.
• Practice answers. For each question you answered: the question's ID, the answer you chose, whether it was correct, how long it took and when.
• Simulations. Which simulation you started, when you started and finished each section, the answers you chose, questions you marked, and the time you spent on each question. An estimated score is calculated from these.
• Essays. The text you wrote, when you started and submitted it, and if you asked for a check: the scores and comments you received. Write in an essay only what you are comfortable having stored. There is no need to write identifying or personal details. If an essay suggests distress, a flag is stored with it that shows you helplines, and no person is alerted.
• Score log. If you chose to record scores from practice tests of the National Institute for Testing and Evaluation: the test name, the date and the score you entered.
• Mistake reports. If you reported a mistake in a question: the question's ID, what is wrong with it, the comment you wrote, where you saw it and when.
• Transfer to another device. If you created a code, only a one-way code (HMAC) and an expiry time are stored. The code is valid for 10 minutes and for one use, and it is deleted shortly afterwards. A device that enters it switches to the account, and what was on it stays in its own guest account until that expires.
• Protection counters.To prevent misuse, the app counts requests by IP address and account. The database stores only a one-way encrypted code (HMAC) in place of the address or ID, and it is deleted within two days. Cloudflare's rate limit receives the address itself, counts in memory for a minute and does not store it with us.
• In your browser. The site and the app keep in the browser's local storage the language, dark or light mode, and during a simulation or essay also answers and a draft not yet saved on the server, so that they are not lost if the connection drops. They are deleted from the browser once saved on the server, on signing out of the account or after 7 days.

Why

To keep your progress, show an estimated score, check essays when you ask, and protect the service from misuse. We do not sell data and do not use it for advertising or marketing. Your progress and estimated score are calculated only to show them to you.

Giving the data is your choice, and there is no legal duty to give it. Without a guest account you can read the site, but the app cannot save answers and progress.

Who receives the data

• Cloudflare hosts the site and the app and stores the database, in a data centre in Western Europe. As with any server, every request is recorded in a technical log that includes the IP address, the browser and device type, the page opened and an approximate location derived from the address (country, city and postal code). The log is kept for up to 7 days and is used only to find faults. When you submit an essay for checking, Cloudflare also checks that the submission came from a person and not from automated software (Turnstile), and to do so it processes the IP address and browser data.
• Anthropic, in the United States, receives only essays you chose to send for checking: the text you wrote and the essay topic, without the account ID. The check is done by the Claude model. According to Anthropic's Privacy Center, when used through the API it deletes the texts within 30 days and by default does not use them to train models. There are two exceptions: when the law requires retention, and when a text is flagged as violating its usage policy. In that case it keeps the text for up to two years, and the text's safety scores for up to 7 years. On Anthropic's website: how long data is kept, use for training and privacy policy.
• Sentry, in a data centre in Germany, receives a technical report when something breaks on the site or in the app: the error message, the page address, and the browser and device type. We remove database query values from the report, and it does not include the account ID, IP address, answers or essays.
• GitHub, in the United States, runs the nightly backup process. The copy is there only while the process runs, until it is encrypted and sent to backup, and then it is deleted.
• Backblaze, in the United States, stores an encrypted nightly backup of the database, in case of a fault. The backup does not include the text of essays, the comments in reports or the score log. It is encrypted before upload, and Backblaze does not have the key.

No data is given to anyone else, unless the law requires it.

For how long

A guest account is deleted automatically about 90 days after the last visit to it, with all its answers, simulations, essays, score log and reports. A guest account with nothing saved in it is deleted after just two days, and an account that has been signed out on all devices is deleted within a day. You can also delete everything yourself at any time.

Each nightly backup is kept for about 36 days and then deleted, and for the first 30 days it cannot be changed. In addition, Cloudflare keeps restore points of the database for up to 30 days, and they also include essays and reports. So what is deleted from the app stays in these copies for up to 30 days and in the encrypted backups for up to 37 days, and is used only to restore after a fault.

Your rights

On the My data page in the app you can:

• View the data (section 13 of the Privacy Protection Law): download a JSON file with all the data stored on the account.
• Delete: delete the account and all its data from the app right away. The deletion is final, and the copies described above are deleted up to 37 days later.

Correct data (section 14): a score in the score log can be deleted and entered again. For any other request, you can contact us.

A guest account is not linked to a name or an email address, so we cannot identify it from an email request. The safe way to view or delete the data is from inside the app, in the same browser.

Under 18

Simu is open to all ages and does not ask for identifying details. If you are under 18, ask a parent or guardian for consent before sending an essay for checking, because it is passed to Anthropic's model in the United States.

This site

Simu's information pages and theory pages store no cookies and collect no personal data. In theory practice your answers stay in the browser and are not sent to us. If a page breaks, a technical report is sent to Sentry, as described above.

How to reach us

For questions about privacy, to correct data or for any other request, write to us: hello@johnnylabs.co.il. If the matter is not resolved, you can also turn to the Privacy Protection Authority.