Privacy and data choices
Implementation notice / 5 October 2026. This beta has no configured email sign-in or third-party advertising analytics.
Trace processing
Free Lab scores traces transiently by default. Inputs are sent to the configured backend for computation. Explicit result sharing stores the scorecard, declared scope, input fingerprint and consent receipt. Raw traces enter the benchmark store only when the separate contribution option is selected.
The full validation workspace stores scored runs and compiled dossiers on the configured backend. It is a shared demonstration workspace, not an isolated private tenant. Do not upload secrets, personal data or proprietary traces to a public demo.
Keys and local preferences
Anonymous demo keys are kept in session storage in the browser and expire after seven days. The service stores keyed hashes, not the original keys. Introduction preferences use local storage. No analytics tracking cookie is added by Free Lab. Existing authenticated console sessions have their own security cookies.
Operational records
The service maintains rate-limit counters, consent receipts, challenge attempts and tamper-evident event hashes. Application rate-limit identities are keyed hashes of network addresses. Hosting providers may keep their own network access logs under their policies. The deployment operator controls those logs.
Public artifacts and retention
A public link is accessible to anyone who has it. Board publication is a separate opt-in. Demo links expire after seven days; expiry is not an assurance of physical deletion. Consented benchmark traces persist until operator removal. Ephemeral hosting can reset data sooner. Download records you need to retain.
Pilot requests
The pilot dialog states whether it is creating a local draft or sending a request to the configured backend. A stored request is not an email-delivery receipt. No customer relationship is implied.
Deployment responsibility
The deploying organization must add its legal identity, contact address, jurisdiction, hosting providers and data-request process before collecting personal or confidential information from the public. Until then, use public or synthetic demonstration inputs only.