Privacy

Who is responsible

Lab43 is a trading name of Robin Lauckner. The controller is Robin Lauckner, trading as Lab43, 10 William Jessop Way, Liverpool, L3 1DX, United Kingdom. Email: hello@lab43.dev. We are registered with the ICO, registration number ZC299187. You'll find the same details in our legal notice.

This policy covers this site, lab43.dev, and our account site, auth.lab43.dev: your Lab43 account, payments, ad bookings, the feedback boards and crash reports. We follow the UK GDPR and the Data Protection Act 2018 and, where it applies, the EU GDPR. The article numbers below are the same in both.

What happens when you visit this site

This site is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. To deliver the pages and keep them secure, Vercel's servers automatically process technical data that your browser sends with every request: your IP address, the date and time, the page you requested, the referring page, and your browser and operating system.

We have a legitimate interest in running this site reliably and securely (Art. 6(1)(f)). Vercel processes this data on our behalf under a data processing agreement (Art. 28). Data may be processed in the United States (see "Data outside the UK"). The request logs we can see in Vercel, which we use to find and fix problems, are kept for at most 30 days.

No cookies, no tracking

This site sets no cookies and uses no third-party analytics, advertising or tracking tools. Fonts and images are served from this site itself, so your browser doesn't contact any other provider while you're here.

How we count page views

We count page views ourselves. When a page opens, it tells this site's server which page it is and which site sent you, if any. The server passes one count to Lab43's internal dashboard with that page, that site's name only (not its full address) and the country Vercel works out from your IP address. Your IP address, your browser and anything that could tell visitors apart are not passed on or kept, so we see how many views each page had, not who visited. Nothing is counted when your browser sends Do Not Track or Global Privacy Control.

We do this to see which pages help people, which is our legitimate interest (Art. 6(1)(f)).

Links to our apps

Our product links take you to other websites, such as gamesweep.app or mc-planner.com. Each of them has its own privacy policy.

Your Lab43 account (auth.lab43.dev)

One Lab43 account works in all our apps, such as MC Planner and GameSweep. You can make one on auth.lab43.dev or in one of the apps. You never need one to visit this site, and GameSweep works without one. Each app's privacy policy says what that app keeps; this section is about the account itself.

The account holds:

• your email address, and a password if you set one
• your display name and colour, shown to the people you plan or play with and on your feedback posts
• if you sign in with a service such as Google, Discord or Microsoft, the basic profile it shares with us (your name and email address)
• when the account was made and when you last signed in
• where the account was made: in which of our apps, or on auth.lab43.dev
• which of our apps you use, and when each last asked us about your account (at most once an hour)
• the devices you connected (see below)
• what you have in each app: plans, free trials and records of what you bought (see Payments)

We use this to sign you in, to show your name where you use it and to tell each app what you may use (Art. 6(1)(b)). Where accounts are made and which apps they use also go into totals on Lab43's internal dashboard; knowing which apps people use is our legitimate interest (Art. 6(1)(f)). What Lab43's managers can see about one account is under "What Lab43's managers see" below. If a link from another site (such as reddit.com) brought you to sign up, that site's name goes with your request for a sign-in code. It is added to a count when you confirm the account and removed from the account then, or after a day if you never confirm it, so it isn't kept with you.

The account is stored with Supabase (Supabase Pte. Ltd., Singapore), in its Frankfurt region (Germany), which processes it on our behalf. auth.lab43.dev is hosted by Vercel (see above), and its server runs in Vercel's Frankfurt region.

Who can have an account. You need to be at least 13 years old to make a Lab43 account. If you think a child under 13 has made one, write to us and we'll delete it.

Sign-in emails. To sign in, make an account or reset a password, you get a code by email. These emails are sent from the Lab43 team's Gmail account through Google (Google LLC, USA), which handles your email address, the email and when it was sent. We haven't signed separate data processing or transfer terms with Google: it handles these emails under its own terms and privacy policy. They are part of the service (Art. 6(1)(b)).

Sign-in sessions. When you ask for a code or sign in, your browser talks to Supabase directly. Supabase uses your IP address to limit how many codes and passwords one address can try, and keeps the IP address and browser of each sign-in session until the session ends or the account is deleted, to keep accounts secure (Art. 6(1)(f)).

Cookies on auth.lab43.dev. The account site sets only the cookies that keep you signed in, plus lab43_fb on the feedback boards (see below). It has no analytics, advertising or tracking, and loads no fonts or scripts from other providers. The ad booking pages remember whether you chose light or dark in your browser's own storage, not in a cookie.

Connected devices. Some devices sign in with a code you confirm on auth.lab43.dev/device instead of a browser, such as the MC Planner mod in Minecraft. For each one we keep the name the device sent (such as "Minecraft 26.2 · Windows"), when you connected it, when it was last used, and a hash of its key, never the key itself. Your account page lists them under Connected devices, where you can disconnect each one; signing out on the device does the same.

Deleting your account. We keep your account until you delete it. You can do that on your account page (Delete my account). It first asks every Lab43 app that keeps data for your account to delete it (in MC Planner, the shared worlds you own) and ends any subscription that could still charge you. Only when every app has done so is the account deleted, with your profile, connected devices, trials and feedback posts. If an app can't delete its data, nothing is deleted and you can try again. Records of payments stay, no longer linked to your account (see Payments).

What Lab43's managers see

Lab43's managers can open an account in our internal dashboard: its email address and display name, when it was made and last signed in, where it was made, which of our apps it uses (first and last use), its plans and free trials with when a trial ends, its purchases, its MC Planner worlds and Minecraft mod sign-ins, and its feedback posts. The dashboard, which also runs on Vercel in Frankfurt, reads these from auth.lab43.dev when a manager opens them and keeps no copy. We do this for the same reasons as above (Art. 6(1)(b) and (f)). Managers can also mark an account as Lab43's own or a test account, so our numbers leave it out.

When someone makes a Lab43 account, Lab43's managers also get one email about it: the account's email address, its display name, where and when it was made, and how many accounts there are now. Our email delivery provider sends it for us. The email stays in the managers' inboxes until they delete it, and we delete it when you delete your account or ask us to. We do this so we know when someone joins (Art. 6(1)(f)).

For our numbers, the dashboard gets counts only, such as sign-ups per day and app and how many people use and pay for each app: never names, email addresses or account ids.

Payments

Plans in our apps, such as MC Planner's Cloud, Team and Lifetime and GameSweep's Remove ads, are sold through Stripe Managed Payments by Link, LLC ("Link"), Stripe's merchant of record. You pay on Stripe's checkout page. Link takes the payment, handles the tax, sends your receipts and invoices, and handles refunds and disputes, under its own privacy policy. Lab43 never sees your card details.

We keep one Stripe customer id for your account, and what you bought or subscribe to with its status (for example paid, refunded, renewing or cancelled) and its dates; for a one-time purchase also the amount and the email address it was paid with. We use this to give you what you paid for in each app and to show it on your account page (Art. 6(1)(b)). Your invoices and payment method are in Stripe's billing portal, which your account page opens.

These records stay after you delete your account, no longer linked to it, because we need them to deal with refunds and disputes and for our tax records (Art. 6(1)(f) and (c)). We keep them for up to 6 years after the purchase, then delete them.

Booking ads (Lab43 Ads)

Businesses can book ad weeks in our apps on auth.lab43.dev/ads, with a Lab43 account. Lab43 sells these itself: the business pays through Stripe Checkout, and Stripe sends it the invoice from Lab43.

We keep the business details entered for this: company name, the name shown on its ads, address, VAT ID (which Stripe checks), invoice email and the business's own Stripe customer. We also keep its campaigns and ads, the weeks booked with their payment and refund status, our review notes, and daily totals of how often each ad was shown and clicked, with nothing about the people who saw it. We use this to run the bookings and invoice them (Art. 6(1)(b)), and keep invoices and payment records as long as UK tax law requires: at least 5 years after the 31 January tax return deadline for the tax year they belong to (Art. 6(1)(c); GOV.UK). Deleting the account deletes the business details; its bookings and invoices stay, no longer linked to the account.

Feedback boards (auth.lab43.dev/feedback)

Each of our apps has a public feedback board on our account site, auth.lab43.dev. Anyone can read the boards and post or comment, with a Lab43 account or without one; voting needs an account. We read posts and comments before they show on the board: always those written without an account, and those with an account when we choose to.

When you post, we store your post (its title and details), up to three screenshots you add, the app it is about and when you posted it. With an account, we store it together with your account and show it with your account's display name, which you can change on your account page at any time; we also keep your votes. Without an account, it shows as "Anonymous": we keep no name, email or address. To limit spam we keep a hash of your IP address that changes every day and is deleted after 7 days, so it can't be traced back to you, and your browser solves a small puzzle before sending. A cookie (lab43_fb) lets your browser show you your own posts and comments while they wait; it holds a random number and nothing else, so it ties together only what you send from that browser.

Screenshots are checked and stripped of hidden details such as location before we store them, and they show only once the post does. Your posts, comments and screenshots are public once shown. We use them to decide how to improve our apps (Art. 6(1)(f)): each post we show is copied, without your name or email address, into our internal task list.

That task list is part of Lab43's internal dashboard, whose database Supabase runs for us in the EU. Claude, the AI assistant we use (see "Who else gets data"), reads these copies to suggest what we could do about them; a person decides. We keep the copies as part of the record of our work, with no set end date. When we delete a post for good, its words are also removed from our task list.

Emails about posts you voted for. If we email you about a post you voted for, it's because you turned on Feedback emails on your account page (it offers them once we have set them up). They tell you when the post ships, Resend (Plus Five Five, Inc., USA) sends them for us, and each one says how to turn them off (Art. 6(1)(a)). We delete our record of each email 30 days after it was queued, sent or not.

Posts written without an account that we never show, or hide later, are deleted after 90 days. Deleting your Lab43 account deletes your posts, comments, votes and screenshots from the boards. Copies already in our task list stay there, with nothing that links them to you. We delete any post or comment for good on request, also one written without an account: tell us which one. The account site is hosted by Vercel (see above); its database and file storage are run by Supabase.

Crash reports from our apps

When one of our apps (GameSweep, MC Planner and its Minecraft mod, or our own tools) crashes, it can show you a crash report. Only if you press Send is it sent to our account site, auth.lab43.dev. Nothing is sent on its own.

A crash report contains what went wrong (the error and where in the code), the app's version, your operating system and similar technical details, recent entries from the app's own log, and the note you add, if any. The apps remove names of your games, worlds, plans and files, your user name in folder paths, email addresses, IP addresses and anything that looks like a password or key before showing it to you, and the account site removes such things again. We keep a hash of your IP address that changes every day, only to limit how many reports one sender can send, and delete it after 7 days.

Only we read crash reports, to find and fix the problem (Art. 6(1)(f)). They are deleted after 90 days.

When you email us

If you write to us, we use your email address and message only to reply (Art. 6(1)(b) or (f)). We keep your emails as long as we need them to help, at most 2 years after the conversation ends, unless the law requires us to keep them longer.

Emails to hello@lab43.dev are forwarded by ImprovMX (ImprovMX Incorporated, USA; servers in the EU and the USA) to the Lab43 team's mailbox with Google (Gmail), so we can read and answer them (Art. 6(1)(f)). We haven't signed separate data processing or transfer terms with ImprovMX or Google: they handle these emails under their own terms and privacy policies.

Who else gets data

AI tools. We use Claude, an AI assistant made by Anthropic, to build and run our sites and apps. When we use it to look into a problem or a request, it can see the personal data involved, such as an account's details in our database, crash reports and feedback posts. The feedback posts we copy into our task list (without your name or email address) also go to Claude, to suggest tasks. We do this to help people and to improve our services (Art. 6(1)(f)); you can object (see Your rights).

We don't sell personal data and don't share it for advertising. We would only give it to the police or another authority if the law requires us to.

Data outside the UK

What protects personal data that leaves the UK, provider by provider:

• Anthropic (Claude): None of ours: no data processing agreement and no transfer agreement. Anthropic's own privacy policy covers its transfers.
• Google (Gmail): None signed: no separate data processing or transfer terms.
• ImprovMX: None signed: no separate data processing or transfer terms.
• Link and Stripe: Not needed: Link and Stripe are responsible for this data themselves.
• Sign-in services: Not needed: each is responsible for this data itself.
• Supabase: Data in the EU (UK adequacy regulations); support from elsewhere: Supabase's DPA, the EU SCCs with the ICO's UK Addendum.
• Vercel: EU-U.S. Data Privacy Framework and its UK Extension; the SCCs with the UK Addendum in its DPA.

How long we keep data

• Your Lab43 account: until you delete it
• Sign-in sessions, with IP address and browser: until the session ends or the account is deleted
• Purchase records: up to 6 years after the purchase
• Ad invoices and the business details on them: at least 5 years after the 31 January tax return deadline for the tax year they belong to
• Request logs at Vercel: at most 30 days
• The hash of a poster's IP address on the feedback boards: 7 days
• Feedback posts without an account that are never shown, or hidden later: 90 days
• Crash reports: 90 days
• Emails people send us: as long as we need them to help, at most 2 years after the conversation ends
• Feedback posts, comments and screenshots: as under Feedback boards

Your rights

You have the right to:

• get a copy of the data we hold about you (Art. 15)
• have it corrected or deleted (Art. 16 and 17)
• restrict how we process it (Art. 18)
• receive it in a portable format (Art. 20)
• object to processing based on our legitimate interests (Art. 21)

To use any of them, write to hello@lab43.dev, from the email address of your account if it's about your account. Asking is free. We answer within one month; for complicated requests we may need up to two more months, and we'll tell you if so. Some things you can do yourself on your account page: change your display name, disconnect a device or delete your account.

Complaints

If you're unhappy with how we handle your data, please tell us first: write to hello@lab43.dev, or by post to the address under "Who is responsible". We confirm that we received your complaint within 30 days, look into it, keep you updated, and tell you what we found and what we're doing about it without undue delay.

You can also complain to the Information Commissioner's Office (ICO) at any time: ico.org.uk/make-a-complaint, phone 0303 123 1113. If you live in the EU, you can also complain to the data protection authority in your country.