Privacy policy

Most of the work never leaves your browser

Importing an acquisition folder reads the files in the browser on your own machine. Nothing is uploaded by importing, and your original acquisition files are never modified. Signed out, an experiment is held in that browser's local storage on that device only: it is not sent to a server, it is not visible to us, and clearing the browser's site data deletes it.

Figure, plot, CSV and SVG exports are produced in the browser and saved wherever you choose to save them.

What is collected

Account

Signing in asks for an email address. The Simple Lab Tools account service emails a one-time code to that address and, once the code is verified, stores the email address, an account identifier, an optional display name, the workspaces the account belongs to, and the session that keeps you signed in. A session token is held in your browser's local storage. No password is stored, because there is none.

Experiment backups

While signed in, the experiment you are working on is backed up to private cloud storage. A backup is a single compressed archive of that experiment, which holds what the experiment contains: the scan image and radiance data imported from your acquisition folders, acquisition settings read from those folders such as exposure, binning and field of view, and everything you entered in SimpleBLI, including experiment and animal names, groups, time points, measurement regions, dates of death and other survival entries, and figure settings. Alongside the archive, the service records the experiment title, the workspace and experiment identifiers, which account uploaded each revision, the size of each archive, and the time of each change.

Experiment data is treated as your research data. It is not read for any purpose other than serving it back to you and the people you share it with, it is not used to train models, it is not sold, and it is not shared for advertising.

Billing

Paid plans are handled by Stripe. Card details are entered on Stripe's own checkout pages and never reach SimpleBLI. What SimpleBLI stores is the Stripe customer and subscription identifier for a workspace, the plan, the subscription status, and renewal or cancellation dates.

Usage measurement and logs

The site loads Google Analytics 4 under a Simple Lab Tools property, which sets cookies and records page views and product events such as which view was opened or which export was used, together with the information Google Analytics collects by default, including an approximate location derived from your IP address. Event properties are filtered before they are sent: values containing an email address or a URL are dropped, and experiment content, animal names and file names are never included.

Requests to the backup and API service are logged by Cloudflare for diagnostics. A log line can contain the request path, the workspace and experiment identifiers, the account identifier and the size of an upload. It does not contain experiment content. These logs sit in Cloudflare's own short diagnostic retention window, one week or less, and are not copied anywhere else.

How it is used

• To sign you in and keep you signed in.
• To store, list, restore and serve back your experiment backups, and to enforce the experiment count and archive size limits of your plan.
• To serve a public link for an experiment, when you create one.
• To answer an authorized app or agent asking for your experiments on your behalf.
• To bill a paid plan and to answer support email.
• To find faults, and to count how the product is used in aggregate.

There is no other use. The service does not profile you, does not build an advertising audience, and does not make automated decisions about you.

Who else processes it

These providers operate globally, so data may be processed in data centres outside the country you are in. Nothing is sold, and nothing is disclosed to anyone else except where the law requires it, or where it is necessary to investigate abuse of the service.

What you choose to share

Public links

Creating a public link for an experiment makes the newest backup of it readable by anyone holding that link, without signing in. They can browse and export its scans, results, groups and imported metadata. Revoking the link ends that access, and replacing it invalidates the old URL. Links are long random strings and are not listed or indexed, but a link is the whole credential: anyone you pass it to can pass it on.

Connected apps and agents

SimpleBLI can be connected to an AI assistant or other client over the Model Context Protocol. Connecting shows a consent screen naming the app, the address it will be sent back to, and the account that is granting access. Approving it issues that app a token that reads your experiments as you: it sees exactly the workspaces your account can see, and nothing else. Tokens are granted read-only access to experiments. An access token expires after an hour and is renewed by the app until you disconnect it. Revoking a connection stops it immediately.

How long it is kept

• Experiment backups: the three newest revisions of each experiment are kept. A fourth backup expires the oldest one, which is deleted from storage.
• Deleted experiments: deleting an experiment in the cloud moves it to Trash, where it stays recoverable for 30 days. After 30 days its database records and every stored revision are purged automatically. Delete forever skips the wait and removes both immediately.
• Account and sessions: kept while the account exists. A session expires on its own, and signing out discards the token in your browser.
• Connection tokens: an access token lasts one hour and a renewal token 30 days. Revoked and expired tokens are deleted a week later. An app registration that nothing has used for 30 days is deleted.
• Billing records: kept as long as a tax or accounting obligation requires, independently of the account.
• Request logs: Cloudflare's own retention window, one week or less.
• Analytics: the retention period set on the Google Analytics property, which Google caps at 14 months for event data.

Your choices

• Work without an account. Everything except cloud backup, public links and connected apps works signed out, and then nothing reaches a server.
• Take a copy. Download backup in the editor writes the whole experiment, including the data you entered, to a .sbli archive on your machine. CSV and SVG exports cover the measurement, signal and survival tables.
• Delete. Delete an experiment from the cloud, or use Delete forever. To delete the account itself and everything attached to it, email the address below and it will be removed.
• Disconnect. Revoke a public link or a connected app at any time.
• Ask. Write to the address below for a copy of what is held about you, for a correction, or for deletion. A request is answered within 30 days.

Analytics cookies can be refused in your browser or by a tracker blocker, and the application itself keeps working without them.

Security

Traffic is HTTPS only. The archive bucket is private, with no public access, and is reachable only through the API after an authorization check against your workspace membership. Sign-in codes are single use. Connection tokens and public link tokens are stored as hashes, so a copy of the database does not yield a working credential. No system is proof against every attack; if a breach affects your data you will be told what happened and what to do.

Children

SimpleBLI is a tool for research laboratories and is not directed to children. Accounts are not knowingly created for anyone under 13, and such an account will be deleted if one is reported.

Changes

When this policy changes, the date at the top changes with it. A change that affects what is collected or who receives it will also be announced in the application before it takes effect.

Contact

Simple Lab Tools, the publisher of SimpleBLI, is the controller of the data described here. For any privacy question, data request or account deletion, write to simplelabtools@gmail.com.