This policy describes what the LABD mobile application and the LABD web application at labd2.cyber-man.pl do with your information.
1. Who is responsible
Data controllerTomasz Dąbrowski
Contactlabd@cyber-man.pl
2. What LABD is
LABD is an inventory system for laboratory chemicals and consumables. You create a laboratory, describe its cabinets and fridges, and record what is on each shelf and how much of it remains. A laboratory can be shared with other LABD users, who are given a Viewer, Editor or Owner role by its owner.
3. What we collect
Your account. A username and a password, which you choose when you create an account on the web at labd2.cyber-man.pl. The mobile application cannot create accounts. Your password is stored only as a bcrypt hash and is never readable by us.
What you record. The laboratories you create or are invited to, and their contents: the names, descriptions and amounts of the substances you enter, and the layout of the room. This is ordinary text that you supply.
Who you share with. The usernames of people invited to a laboratory and the role each of them has.
We do not collect your name, email address, telephone number, location, contacts, photographs, advertising identifier, or any device identifier. The mobile application requests only two Android permissions: internet access and vibration.
4. What we do not do
LABD contains no analytics, no crash reporting, no advertising and no third-party tracking of any kind. The application communicates with one server, labd2.cyber-man.pl, and with nothing else. No data is sold, and none is shared with any third party.
5. Why we process it
To operate the service: to sign you in, to show you the laboratories you have access to, to save the changes you make, and to enforce who may read and who may edit each laboratory. Under the GDPR the basis is performance of a contract with you, Article 6(1)(b).
6. What is stored on your device
The mobile application keeps a copy of the laboratories you can see, so that it opens instantly and works when your phone has no signal. It also holds any change you made while offline until it can be sent.
This local copy is stored in the application's private storage. It is not encrypted by the application, so on a rooted or otherwise compromised device it could be read. It contains the contents of the laboratories you can access. It does not contain your password. Signing out deletes it, as does uninstalling the application.
Your session token is stored by the operating system in its own cookie storage and is removed when you sign out.
7. How long we keep it
Your account and your laboratories are kept until they are deleted. Deleting a laboratory removes it and its contents. Leaving a laboratory removes your access to it but does not delete the laboratory, which belongs to its owner.
Deletion is immediate and permanent. There is no archive, no recycle bin and no retention period after which a deleted account could be recovered.
8. Deleting your account
You can delete your account from within the mobile application, under Settings → Delete account. It asks for your password, because that is the only thing we hold that can show the request is yours, and it shows you exactly which laboratories are affected before you confirm.
Deleting your account removes your username, your password hash, the date your account was created, and your membership of every laboratory.
What happens to the laboratories you own depends on whether anybody else is in them:
- Nobody else is a member. The laboratory is deleted with your account, along with its layout and everything stored in it.
- Other people are members. Ownership passes to another member, so the laboratory keeps working for them. It is not deleted and its contents are not changed. You lose access to it. The new owner is the member with the highest access level, and where several are equal, the one who has been a member longest.
Laboratories you are a member of but do not own are unaffected; your access to them is simply removed.
After deletion nothing about you remains in the LABD database, and your username is released for anyone to register again.
If you have lost your password you cannot do this yourself, because LABD has no password reset and holds no email address or other identifier we could use to verify you. Write to labd@cyber-man.pl and we will work out what evidence is available. We action requests we can verify within 30 days and confirm when it is done.
This is also set out at https://labd2.cyber-man.pl/delete-account.html
9. Your rights
If you are in the European Economic Area you have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable form. Write to labd@cyber-man.pl to exercise any of these. You also have the right to complain to a supervisory authority; in Poland this is the Prezes Urzędu Ochrony Danych Osobowych.
10. Security
All traffic between the applications and the server uses HTTPS. Passwords are stored only as bcrypt hashes. Access to each laboratory is checked on the server for every request, not only in the interface.
11. Children
LABD is a tool for laboratory work and is not directed at children.
12. Changes
If this policy changes, the date at the top will change with it, and the current version will always be available at this address.