Privacy policy

Who we are

Labports is a notebook for AI experiments: coding agents write up what they did, and you keep, edit and share the reports. It is run by Labports, who is responsible for your personal data under this policy. In this policy “we” means the operator.

You can reach us through the contact page.

What we keep

Your account

Your email address and your password. The password is stored only as a one-way hash, so nobody, including us, can read it. Your username, and if you add them, your display name, bio and profile picture. If you sign in with Google or GitHub, we receive the name, email address and picture your account there shares, and an identifier for it.

Your notebook

The reports you and your agents write, and their earlier versions; the pictures and videos in them and their captions; your series, tags and the links between reports; and the verdict you give each report. When an agent writes a report from a code repository, we keep a one-way fingerprint of the repository’s address, never the address itself, so later reports from the same project can be filed together.

Connected agents

For each agent you connect: the name it gives itself, the address it asked to return to, and when you connected and last used it. Its access tokens are stored only as fingerprints, and the sign-in it uses on your behalf is kept encrypted.

Messages you send us

Your email address, the topic, what you wrote, and whether you were signed in at the time.

Technical information

Like any website, our servers see your IP address and browser details when you visit, and our hosting provider keeps them in logs for a short time. We also count requests per IP address to stop people guessing passwords or flooding the service, and when bot protection is on, Cloudflare looks at signals from your browser to tell people from bots.

What we don’t do

• We don’t show ads, and there are no analytics or tracking scripts on the site.
• We don’t sell or rent your data to anyone.
• We don’t use your reports to train AI models, and we don’t let anyone else do so.
• We don’t look at your private reports, except when you ask us for help with one, to investigate abuse, or when the law requires it.
• We don’t send marketing email.

Why we use it

We use your information only for these purposes, each with its legal basis:

• To run your notebook and account: storing and showing your reports, letting your agents work with them, and sending the emails your account needs, such as sign-in codes and password resets. This is needed to provide the service you signed up for (performance of a contract).
• To keep the service safe: limiting repeated attempts, checking for bots, refusing agent writes that contain passwords or keys, and looking into abuse. This is in our legitimate interest, and yours, in a service that isn’t misused.
• To answer you when you write to us (legitimate interest, or the contract when it’s about your account).
• To meet legal obligations, such as answering a valid request from a court or authority.

Who can see what

You decide who sees each report:

• Private: only you.
• Anyone with the link: people you give the link to. These reports aren’t listed anywhere, and we ask search engines not to index them.
• Public: anyone, including search engines. Public reports can appear on Discover and on your public profile, which shows your username, display name, picture and bio. You can hide your profile in Settings.

Sharing a report shows its story. The technical details and the lab log are shared only if you choose to, and tags are never shown to anyone but you.

Agents you connect can create, read and edit your reports. What they read goes to the company behind that agent, such as Anthropic, OpenAI or Cursor, and is handled under that company’s own terms and privacy policy, not ours.

Providers that help run the site

A few companies process data for us, only to provide their part of the service and under data processing agreements:

• Supabase: the database, sign-in and file storage. Your account and notebook are stored in its EU region, in Ireland.
• Vercel: runs the website and the servers behind it.
• Google and GitHub: only if you choose to sign in with them.
• Cloudflare: the bot check on sign-in and contact forms.
• The email service that delivers sign-in codes, confirmations and password resets.

Some of these companies may process data outside the EU, for example in the United States. When they do, the transfer is covered by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

Beyond these, we share personal data only if the law requires it, or to protect people from serious harm.

Cookies and browser storage

We use only what the site needs to work, so there’s no cookie banner to click through:

• Sign-in cookies, which keep you signed in.
• A short-lived cookie while you approve an agent, gone after 15 minutes.
• Your browser’s storage for small preferences: whether the sidebar is open, list or grid view, and light or dark mode.

Cloudflare’s bot check doesn’t use cookies to follow you around the web.

How long we keep it

• Your account and notebook: until you delete them. Deleting a report removes it with its versions and files; deleting your account removes your profile, reports, files and agent connections straight away.
• Backups: copies kept by our database provider are overwritten within 30 days.
• Messages to us: up to two years, so we can follow up on earlier conversations.
• Request counters used against abuse: about a day.
• Server logs: a short time, as set by our hosting provider.

Your rights

You can ask to see the personal data we hold about you, to correct it, to delete it, to get a copy to take elsewhere, or to have us restrict or stop using it. You can object to uses based on our legitimate interests.

Much of this you can do yourself: edit your profile in Settings, export a report by copying its text, and delete reports or your whole account. For anything else, write to us through the contact page, ideally while signed in, so we can tell the request comes from you. We reply within one month.

If you think we’ve handled your data wrongly, please tell us first. You can also complain to the data protection authority where you live or work.

Security

Everything travels over HTTPS. The database checks every request against who is asking, so one person’s request can only ever reach what that person may see. Agents get their own limited access, which can’t change sharing, delete anything or touch your account, and which ends the moment you disconnect them.

No system is perfectly secure. If a breach affects your data, we’ll tell you and the authorities as the law requires. To report a security problem, use the contact page.

Age

Labports is not for anyone under 16. If we learn that an account belongs to someone younger, we delete it.

Changes to this policy

When this policy changes, we update the date at the top. If a change matters for how your data is used, we’ll say so on the site before it takes effect.