Privacy Policy
This explains what BogdansLab keeps about you, why, who can see it, and how to get it or delete it. It describes what the site actually does, and it covers the whole lab — every Specimen and Sample. Each Specimen adds what is specific to it on its own page — all listed on Specimen pages — which is part of this policy.
1. Who is responsible
BogdansLab is run by Bogdan Druta, Barcea, Galați county, Romania, who decides how your data is used (the "controller" under the GDPR). Contact for anything about your data: contact@bogdanslab.com, in English or Romanian.
2. In short
- We keep what's needed to give you an account and run the lab — and nothing for ads.
- No analytics, no tracking, no advertising, no selling of data. The only cookies keep you signed in.
- Your account and everything in it lives in the EU (Frankfurt). A few services help us run the lab; they're listed below.
- Others see your username, never your email.
- You can download or delete everything from your dashboard at any time.
3. What we keep, and why
| What | Why | Legal basis | Kept |
|---|---|---|---|
| Your email address and how you sign in (email code or Google) | To create your account and sign you in | Contract | Until you delete your account |
| Your username and avatar | How others see you in the lab | Contract | Until you delete your account |
| When you agreed to these texts, and to which version | Proof that you agreed | Legal obligation / legitimate interest | Until you delete your account |
| Your XP, level, achievements, game scores and rounds, and the days you played each experiment | The games, the levels and the records | Contract | Until you delete your account (or the experiment ends) |
| The certificates you hold: which one, its edition number, registry number and date | To issue it and let anyone check it's real | Contract | Until you delete your account |
| What you make in a Specimen (for example projects and share links) |
"Contract" means we need it to give you the service you signed up for (GDPR Art. 6(1)(b)). "Legitimate interest" means we need it to run the lab safely and fairly, in ways you'd reasonably expect (Art. 6(1)(f)) — you can object (section 10).
Your email address is the one thing you must give us: without it there's no account. Everything else comes from using the lab.
If you sign in with Google, Google tells us your email address. Google also sends your name and photo; we delete them — the lab never uses them.
4. What others can see
With your username and avatar: your level, rank, XP and achievements; your scores on the RECORDS boards; your wishes; the certificates you hold (to anyone who checks one by its registry number); and on the home page's live feed, that you joined and the achievements you unlock — you can switch the live feed off in Privacy & data. Visitors without an account can see these too. What you share by link in a Specimen can be opened by anyone who has the link. Nobody else sees your email, your COMMS messages or your moderation record.
5. What we don't do
- No analytics or statistics tools, no tracking pixels, no advertising, no third-party cookies.
- We don't sell or rent your data, and we don't use it to profile you.
- No decision with legal or similar effect on you is made automatically. Moderation is done by a person.
- We never ask for sensitive data (health, beliefs and the like). Please don't post it — especially not about others.
6. Who helps us run the lab
| Service | What it does | What it gets | Where |
|---|---|---|---|
| Supabase | Database, sign-in and image storage | Everything above | EU (Frankfurt); Supabase is a US company |
| Vercel | Hosts the websites (servers in Frankfurt) | Every page request: your IP address, the page, the time — kept briefly in its logs | Global network; US company |
| Resend | Sends the sign-in code emails | Your email address and the email | EU (Ireland); US company |
| Cloudflare | Our domain's address book (DNS); the bot check on the sign-in page (Turnstile); forwards emails sent to contact@bogdanslab.com | For the bot check: your IP address and browser details, on the sign-in page only. For emails: the email | Global network; US company |
| Upstash | Holds the sign-in attempt counters | Only the unreadable fingerprints described above | EU (Frankfurt); US company |
| Only if you choose "Sign in with Google"; also the owner's mailbox, where emails to contact@bogdanslab.com arrive |
Each works for us under a data processing agreement and may use your data only to provide its service. Google, when you choose it for sign-in, also acts under its own privacy policy.
We give data to authorities (police, courts, regulators) only when the law requires it — for example a court order — and only what is asked for. If the law allows, we tell you first.
7. Data outside the EU
Some of these companies are in the US, and some data may pass through their networks outside the EU. Transfers are protected by the EU–US Data Privacy Framework where the company is certified, and otherwise by the EU's Standard Contractual Clauses (GDPR Art. 45–46).
8. How long we keep it
As listed in section 3. When you delete your account, everything linked to it is deleted at once — profile, scores, achievements, certificates, wishes, COMMS messages, notices, restrictions, and what you made in every Specimen (including share links). Two things stay, without your name: network addresses blocked because of your account (until their 90 days end) and the owner's action log. Backups are replaced within about two months, so deleted data disappears from them too.
9. Security
Sign-in cookies can't be read by scripts in your browser; there are no passwords to steal; every table in the database has access rules, so each person reaches only what they're allowed to; the admin area needs a second factor; we keep only what's needed. No system is perfect: if a breach ever affects your data, we'll tell the authority within 72 hours and tell you if you're at risk, as the law requires.
10. Your rights
You can, at any time:
- see and download everything we keep about you — Dashboard → Privacy & data → Export my data (Art. 15, 20);
- correct it — write to us (Art. 16);
- delete your account and everything linked to it — Dashboard → Privacy & data (Art. 17);
- object to uses based on legitimate interest, or ask us to restrict them — for example, leave the live feed with one button, or write to us (Art. 18, 21);
- ask for the owner's private notes about what you sent through COMMS.
Write to contact@bogdanslab.com — we answer within one month. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or the authority where you live.
11. Age
BogdansLab is for people 16 and older. If you believe a younger person has an account, tell us and we'll delete it.
12. Changes
When this policy or a Specimen page changes, the new version is shown with its date and you'll be asked to agree again on your next visit. Earlier versions stay readable on these pages.
13. Contact
Bogdan Druta · Barcea, Galați county, Romania · contact@bogdanslab.com