For Schools › Data inventory
Data inventory
Every piece of information The Lab Games stores about a person, taken from the site's database design.
Where: “Database” means the Cloudflare D1 database behind thelabgames.org/api, in the United States. “Device” means the user's own browser storage. Retention: “Account” means kept until the account is deleted, by the user or after 24 months without use.
Accounts
| Field | Purpose | Stored | Who can see it | Retention |
|---|---|---|---|---|
| Username | Identity on the site | Database | Public (leaderboards); user; their teachers; admins | Account |
| Country code (optional, 2 letters) | Flag on leaderboards | Database | Public (as a flag) | Account; user can clear it |
| Avatar skin and skin tone | Character in games and on leaderboards | Database | Public (leaderboards, games) | Account |
| Account type (learner or teacher); admin flag | What the account can do | Database | User; admins | Account |
| Confirmed 13+ (yes) and confirmation time | Age requirement. The birth date is never stored. | Database | Admins | Account |
| Onboarding, creation and last-active times | Setup; inactivity deletion | Database | User (download); admins | Account |
| Google account ID, email, name | Sign-in (keyed on the Google ID); teachers recognize students | Database | User; teachers of classes joined; admins | Account; removed on unlink |
| Lab Token balance | Avatar shop | Database | User; admins | Account |
| Owned skins, with purchase time | Avatar shop | Database | User; admins | Account |
| Token ledger (each change: amount, earned/spent, reason, game, time) | Checking the token system | Database | User (download); admins | Account |
| Game sessions (game, start and claim time) | Server-checked Lab Token awards | Database | User (download); admins | Account; unclaimed ones are deleted after 2 days |
| Username removal count, and whether the account may be a teacher or file reports | Moderation | Database | Admins | Account |
| Hidden-from-leaderboards flag | A reported name is hidden until reviewed | Database | Admins | Account |
Classes and schoolwork
| Field | Purpose | Stored | Who can see it | Retention |
|---|---|---|---|---|
| Class name, period, school year, class code, join settings | Running a class | Database | The teacher; admins. Students see the class and teacher name. | While the teacher's account exists (archived on teacher deletion) |
| Name on the roster (typed by the teacher or the student) | Teacher's roster and gradebook | Database | That class's teacher; the student; admins | Until the student leaves or is removed, or the account is deleted |
| Student ID number (optional) | Class-code sign-in; matching grades to a school gradebook | Database | That class's teacher; admins. Never shown to other students. | Same as above |
| Approval status; joined and first-sign-in times | Self-join approval | Database | That class's teacher | Same as above |
| Turned-in results: activity, score, maximum, first-attempt score, attempt number, start/submit/receive times, duration, activity version, and the activity's reported details (such as answers) | Saved progress; teachers' gradebooks | Database | The student; teachers of classes they join; admins | Account (kept if the student leaves a class) |
| Which attempt counts (a teacher's choice) | Gradebook | Database | That class's teacher | Until the student leaves the class |
Games
| Field | Purpose | Stored | Who can see it | Retention |
|---|---|---|---|---|
| Best score per game board, level reached, run length, date | Leaderboards; Games tab | Database | Public under the username (with flag and avatar) | Account |
| Recent score-post counts | Stopping automated score spam | Database | Nobody (automatic) | Minutes to an hour |
Moderation records
| Field | Purpose | Stored | Who can see it | Retention |
|---|---|---|---|---|
| Username reports (name, reporter, time, decision) | Admin review queue | Database | Admins | Deleted 24 months after the report is resolved, or sooner with the reported account |
| Admin log (who did what, when, to which account) | Accountability | Database | The site owner only | 24 months |
| Blocked usernames (the name only) | A removed name can't be reused | Database | Admins | Permanent |
Site improvement records
| Field | Purpose | Stored | Who can see it | Retention |
|---|---|---|---|---|
| Teacher suggestions: original message, attribution, optional reply email, manual activity links, category and workflow status | Improving activities and addressing teacher feedback | Database | Site admins | Deleted with the teacher account; linked triage goes with the suggestion |
| Explicit test-account and internal-class analytics exclusions, with reason | Separating test records from adoption reports | Database | Site owner only | Until removed or the referenced account/class is deleted |
| Owner-entered release date, version and change description | Observational activity release comparisons | Database | Site owner only | Kept with the owner account |
| Owner-only product bookmarks, notes, status and resolution summary (activities, aggregate reports or suggestions) | Planning product improvements; no student links or profiles | Database | Site owner only | Kept with the owner account; suggestion-linked items are deleted with the source suggestion |
Security and technical
| Item | Purpose | Stored | Who can see it | Retention |
|---|---|---|---|---|
| Sign-in cookie (signed; not readable by page scripts) | Staying signed in | Device | Nobody | 7 days |
| Helper cookies: sign-in in progress; age retry block; class sign-in without an account | Sign-in steps | Device | Nobody | 30 minutes; 24 hours; 180 days |
tlg_in=1 hint cookie | Tells pages a session exists | Device | Nobody | 7 days |
| Attempt counters keyed by a hashed connecting address (never the raw address) | Rate limits on sign-in, account creation and class codes | Database | Nobody (automatic) | Minutes to an hour |
| Anonymous daily counts (“page viewed” by page address, “sim opened,” “game finished,” most people on the site at once) | Usage statistics | Database | Admins | Totals only; no identifier is ever stored |
| Live “on the site now” signal: a random code for the browser tab (made fresh on each page and never saved on the device), the page address, and signed in yes/no. Sent about once a minute while the page is on screen; stops when the tab is hidden or closed. | Showing admins how many people are on the site right now | Database | Admins (as counts only) | Deleted within 10 minutes |
| Signed-out visitor estimate: a one-way hash of IP address + browser name and version + a random daily value. The IP address and browser details themselves are never stored. | Counting different signed-out visitors per day, without cookies | Database | Nobody (automatic); admins see the daily total | The hashes and the daily value are deleted at midnight UTC; only the daily total is kept |
| Daily number of signed-in accounts (a count, not which accounts) | Usage statistics | Database | Admins | Totals only |
| Browser storage: display name, queued turn-ins, game settings, local best scores | Working offline; settings | Device | The user | Until cleared |
| Hosting providers' server logs | Operating the service | Netlify, Cloudflare | Providers; site operator | Under each provider's own policy |
Teacher accounts also store the Google profile picture link, shown in the teacher's own header. See the Privacy Policy for download and deletion.