For Schools › Privacy Policy
Privacy Policy
thelabgames.org is operated by Timothy Jackson, a science teacher in California.
The short version. Every sim and game works without an account. Accounts are optional and only for people 13 or older. We collect what an account needs to save progress, run classes and show leaderboards. We never sell or share it, show no ads, do no profiling, and use no third-party analytics or tracking. You can download or delete your data at any time.
1. Using the site without an account
Signed out, we collect nothing about you. The site keeps only anonymous counts, such as how many pages were viewed, how many sims were opened and how many games were finished each day. These counts carry no cookie, IP address, account ID or other identifier. Your browser may keep game settings and your best scores on your own device (browser storage); that stays on your device.
How we count visitors. We do this ourselves, with no cookies and no third-party analytics.
- Who is on the site right now. While a page is open and on screen, it sends a small signal about once a minute. The signal holds only a random code for that browser tab, the page’s address, and whether someone is signed in. It holds no name, account ID or IP address. The random code is never saved on your device; it disappears when the tab closes, and a new page gets a new one. The signal stops when the tab is hidden or closed. We delete these signals within 10 minutes and keep only the day’s highest number of people on the site at once.
- How many different visitors came each day. To estimate this without cookies, we combine your connection’s IP address, your browser’s name and version, and a random value that changes every day, and scramble them with a one-way function (a “hash”). The result can’t be turned back into your IP address. We never store your IP address or browser details. The scrambled values are used only to count each visitor once a day, and are deleted with that day’s random value at midnight (UTC). After that, visits on different days can’t be linked. We keep only the daily total.
2. What an account collects, and why
| Information | Why | Who can see it |
|---|---|---|
| Username (chosen by you, permanent) | Your identity on the site | Public on leaderboards. Also you, your teachers and site admins. |
| Country (optional; you can choose “Prefer not to say”) | A flag next to your username | Public as a flag on leaderboards |
| Avatar: the skin and skin tone you pick from preset cartoon art | Your character in review games and on leaderboards | Public on leaderboards and in games. It is never a photo. |
| Google account ID, email and name (only if you sign in with Google) | Signing in; letting your teachers recognize you | You, the teachers of classes you join, site admins. Never public. |
| “Confirmed 13 or older” and the date you confirmed | Accounts are for ages 13+ | Site admins. We do not store your birth date. |
| Account type (learner or teacher) | What the account can do | You, site admins |
| Classes you join; your name as your teacher entered it, and your student ID number (if your teacher uses them) | So your teacher can see your work | You, that class's teacher, site admins |
| Lab and sim results you turn in: scores, attempts, times, and the details the activity reports (for example your answers) | Saved progress, and your teachers' gradebooks | You, the teachers of classes you join, site admins |
| Review-game high scores (score, level, date) | Leaderboards and your Games tab | High scores are public on leaderboards, under your username only |
| Lab Token balance, skins you own, and a record of every token earned or spent | The avatar shop | You, site admins |
| Account dates (created, last active); records of username removals and reports | Keeping accounts safe; deleting inactive accounts | Site admins |
| Teacher accounts: Google email, name and profile picture link, and the classes you create | Running your classes | You and site admins. Your students see your name next to your class. |
Lab Tokens are points earned only by answering questions in review games. They are spent only on cartoon avatar skins. They have no cash value and are never sold for money.
See the data inventory for every stored field.
3. What we never do
- We never sell, rent or share personal information with anyone for their own use.
- No advertising, and no ads targeted using student information.
- No profiling of students, and no third-party analytics or tracking scripts.
- We never show a real name, email or class on a leaderboard.
- We never read your Google Drive, Gmail, Classroom or contacts. Google sign-in asks only for basic profile information (
openid,email,profile).
4. Cookies and browser storage
- Sign-in cookie (secure, not readable by page scripts): keeps you signed in for up to 7 days.
- Short-lived helper cookies: one remembers a sign-in in progress (30 minutes). One stops the age question being retried right away (24 hours). One keeps a class sign-in for a student without an account (up to 180 days).
- A plain
tlg_in=1cookie tells the page you are signed in. It contains no identity. - Browser storage on your own device holds your username for display, game settings, local best scores, and any turn-in waiting for an internet connection.
We use no advertising or tracking cookies. Visitor counting (section 1) uses no cookies or browser storage at all.
5. Where data is stored
Account and class data is stored in a database run by Cloudflare (Cloudflare D1 and Cloudflare Workers), in the United States. The website is hosted by Netlify. Google is used only to let you sign in with a Google account.
To slow down password-style guessing of class codes and sign-ins, the service keeps a short-lived count of attempts. The count is keyed by a one-way scrambled (hashed) form of the connecting address, never the address itself, and is deleted within minutes to an hour. Our hosting providers keep standard server logs, such as request times and IP addresses, for a limited time under their own policies.
6. Who can see your information
- Everyone: your username, flag, avatar and game high scores on leaderboards.
- You: everything about your account, on your account page, and in Download my data.
- Teachers of classes you join (with that class's code): your roster name, student ID number, username, Google name and email (if linked), and the lab and sim work you turn in, including work you did before joining. A teacher cannot see students who have not joined their class.
- The site operator and admins (people the site owner authorizes), only to run, support and moderate the site. Every admin action is logged.
7. How long we keep it
Accounts that are not used for 24 months are deleted, together with their progress, leaderboard entries and class memberships. Deleted accounts are removed from backups within 30 days.
If a teacher removes you from a class, your own work stays in your account. Deleting your account deletes everything right away (see below).
8. Download and delete
- Download: Account page → Settings → Download my data gives you a file with everything stored about your account.
- Delete: Account page → Settings → Delete my account permanently deletes your account, progress, leaderboard entries and class memberships at once. A username that a moderator removed stays blocked so no one else can take it; the list of blocked names holds only the name.
- Students and parents can also ask us to delete an account: thelabgamesorg@gmail.com.
9. Requests from schools and districts
A school or district can ask us to delete the accounts or class data of its students. Email thelabgamesorg@gmail.com from a school address with the class codes, usernames or student emails concerned. We confirm the request and complete it within 30 days. Teachers can also remove students from their classes at any time.
10. Children under 13
Accounts are only for people 13 or older. The account setup asks for a birth month and year once, uses it only to check age, and does not save it. If someone answers under 13, no account is created. Anyone can use every sim and game without an account. If you believe a child under 13 has an account, contact us and we will delete it.
11. Security and breach notification
Data is sent only over encrypted connections (HTTPS). Sign-in uses Google's verified sign-in and secure cookies. Every request is checked on the server, so users reach only their own data, and teachers reach only their own classes. If a data breach affects personal information, we will notify affected users and schools without undue delay, and within 72 hours of confirming it, as the law requires.
12. Student privacy laws
This policy is written to be compatible with FERPA, COPPA and California's Student Online Personal Information Protection Act (SOPIPA). Student information is used only to provide the service. It is not used for advertising, is not sold, and is not used to build profiles. We make no claim of certification.
13. Changes
If this policy changes, the new version is posted here with a new effective date. Before a significant change takes effect, we will email schools and districts that have agreements with us.