Privacy Policy

LabPrepX ("we", "us", "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy describes how we collect, use, store, and share information when you use our platform at labprepx.com (the "Platform").

If you have questions or concerns about this policy, please contact us at support@labprepx.com.

We collect information in the following categories:

• Account Information: When you register, we collect your name, email address, institution affiliation, and role (student / researcher / admin). Passwords are hashed using bcrypt and never stored in plain text.
• Usage Data: We may log which calculators you use and approximate usage frequency to improve the Platform. We do not record the specific input values you enter into calculators.
• Lab Notebook Entries: If you use the built-in notebook feature, the notes you create are stored and associated with your account. These are private to you.
• Saved Formulations & Preparations: Any lab preparations you save are stored securely and are only accessible to you (and, where applicable, to admins in your institution).
• Session Data: We store a session token, login timestamp, IP address hash, and user-agent hash for security purposes (detecting session hijacking). Raw IP addresses are not retained beyond the session.
• Communication: If you contact us via email or the contact form, we retain your message to respond to it.

We do not collect payment card details, biometric data, or government-issued ID numbers.

We use collected data solely to:

• Provide, operate, and maintain the Platform and its features.
• Authenticate your identity and secure your account against unauthorised access.
• Send transactional emails (e.g. password reset, account verification). We do not send unsolicited marketing emails without your consent.
• Detect and prevent abuse, fraud, or security incidents.
• Improve Platform performance and reliability through aggregated, anonymised analytics.
• Respond to your support requests or contact form submissions.

We do not use your data to train AI or machine-learning models, to build advertising profiles, or to sell insights to third parties.

All data is stored on MongoDB Atlas with encryption at rest (AES-256) and in transit (TLS/SSL). Our application enforces:

• Bcrypt password hashing with a strong work factor.
• CSRF protection on all state-changing requests.
• Session fingerprinting (IP + User-Agent hash) to detect hijacking.
• Server-side session revocation on logout or password change.
• Absolute 24-hour session expiry with MongoDB TTL indexes.
• Rate limiting on login and authentication endpoints.

While we implement industry-standard security measures, no system is 100% secure. We encourage you to use a strong, unique password and to log out after each session.

We do not sell, rent, or trade your personal data. We may share data only in the following limited circumstances:

• Service Providers: We use MongoDB Atlas (database) and Mailtrap (email delivery in development). These providers process data solely to provide their service and are bound by data processing agreements.
• Institution Admins: If you belong to an institution on LabPrepX, institution admins can see your name, role, and account status within that institution. They cannot see your notebook entries, calculator inputs, or password.
• Legal Requirements: We may disclose information if required by law, court order, or to protect the safety of users or the public.

LabPrepX uses:

• Session Cookie: A secure, HTTP-only session cookie to keep you logged in. It expires after 24 hours.
• CSRF Token: A per-session CSRF token stored in a cookie to protect against cross-site request forgery attacks.
• Theme Preference (localStorage): We store your dark/light mode preference in your browser's local storage under the key labprepx-theme. This data never leaves your device.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies (e.g. Google Analytics). There is nothing to "opt out" of beyond the functional cookies required to operate the Platform.

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update inaccurate or incomplete information via your account settings.
• Deletion: Delete your account and all associated personal data at any time from your account settings. Deletion is permanent and irreversible.
• Portability: Request an export of your notebook entries and saved preparations in a machine-readable format.
• Objection: Object to certain processing activities (e.g. any future opt-in analytics).

To exercise any of these rights, email us at support@labprepx.com or use the contact form. We will respond within 30 days.

We retain your personal data for as long as your account is active or as needed to provide the Platform's services. Specific retention periods:

• Session records: Automatically deleted after 24 hours via MongoDB TTL index.
• Account data: Retained until you delete your account.
• Contact/support messages: Retained for up to 6 months for reference in case of follow-up queries, then deleted.
• Anonymised usage analytics: May be retained indefinitely as they contain no personally identifiable information.

LabPrepX is intended for users aged 13 and above. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us immediately and we will delete that information.

We may update this Privacy Policy from time to time. We will notify registered users by email for material changes and will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the Platform after changes are posted constitutes acceptance of those changes.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

• Email: support@labprepx.com
• Contact Form: labprepx.com/contact
• Data Controller: Parth Kumar Dubey, LabPrepX Project