Privacy Policy

CyberLab runs this instance on its own server. It decides who gets an account, how the platform is configured, and who on its staff may see what. It is the operator of this instance and the party responsible for the personal data described here. You can reach it at the support address shown at the top of this page once the administrator sets it.

CyberLab is the software. Its developers receive no data from this server and cannot sign in to it, unless they are also the ones operating it. This policy therefore describes how the software behaves as configured here, so that you, or the institution you belong to, can review it against your own obligations.

Nothing here is used for advertising, profiling, or automated decisions about you. Scores are calculated by the rules your instructor set, and an instructor can always review them.

• You see your own progress, scores, certificates, messages and tickets.
• Classmates see the class leaderboard. An instructor can show full names, initials only, or switch the leaderboard off, and can hide the class list from students. Comments you leave under a lecture are visible to others reading it.
• Instructors and co-instructors of a class see everything its students do in that class: progress, every attempt and answer, marks, reports, and the credential slips they print. They hold the one-time password they hand you; resetting a password creates a new one-time password and invalidates the old.
• Administrators and support staff can see everything on this instance, including the audit log, tickets, meeting requests and backups.
• The public can see one thing: a certificate's verification page shows the student's name, the class name and the date to anyone who has its link. Links are long random tokens that cannot be guessed. Nothing else is public.

Everything is stored on the server CyberLab runs. Data reaches another organisation only through the features below, each of which an administrator switches on deliberately. Whether a given one is on is part of the server's configuration, which CyberLab can tell you on request; this page does not publish it.

• E-mail — if the administrator configures a mail server, it delivers notifications and the meeting-request messages from the public form. That mail provider sees the addresses and content of those messages.
• AI assistant — if the administrator enables it, the "ask" help inside lectures and labs sends your question and the relevant lecture or lab text to the AI provider the administrator chose: one of Google Gemini, OpenAI, Anthropic or OpenRouter. Your name, e-mail, grades and classmates are not sent. Instructors can switch the assistant off for a class, and the administrator can withhold it from an instructor entirely. The provider's own privacy terms apply to what it receives.
• IP location lookup — if the administrator enables it, the usage report can show where sign-ins come from. The administrator chooses between a database kept on this server, in which case nothing leaves, and the ip-api.com service, in which case the IP address is sent there over an unencrypted connection.
• Lab images — a lab's container image is downloaded from a public image registry when it is first needed. Only the image name is sent; nothing about you.
• The optional desktop client — if your school also uses the CyberLab desktop client, your progress syncs between that device and this server using a device token. No third party is involved.

Fonts, scripts and styles are served from this server. No content is loaded from advertising, analytics or social-media networks.

The complete list. There are no third-party cookies.

• Passwords are stored as bcrypt hashes; one-time passwords must be replaced at first sign-in.
• Sign-in is protected by a rate limit, a security-code image after repeated failures, and a check that requests come from this site.
• Every lab runs in its own container with a memory limit, cannot reach other students' containers, and is destroyed when the session ends.
• Uploaded files are checked by content, not just by name, and are stored with generated names.
• Backups are encrypted archives that only an administrator can create, download or restore.
• Administrative actions are written to an audit log.
• The connection to your browser is protected by the TLS certificate of the server CyberLab runs; that part is theirs to maintain.

No system is perfect. If you find a weakness, please tell the support address shown at the top of this page once the administrator sets it before telling anyone else.

• Accounts and coursework are kept for as long as the account exists. A student account also stops working after the last of the student's class terms has ended plus a grace period the administrator sets; the data stays until the school deletes the account.
• When an administrator deletes an account, its progress, attempts, messages, tickets and notifications are deleted with it, and audit-log entries about that person are scrubbed of e-mail address, IP address and location.
• The audit log is not deleted automatically. Administrators can export it and clear it; how often is CyberLab's decision.
• Server-load samples are deleted after 400 days. Meeting requests stay until staff delete them.
• Backups are kept up to the number of archives the administrator configures; older ones are removed as new ones are made. An archive an administrator has downloaded is outside this schedule.
• Lab containers are destroyed at the end of a session. Nothing inside them persists.

Whatever the law where you are calls them, here is what you can ask for and how it is done on this instance:

• See your data. Your dashboard and each class show your progress, attempts and scores. Instructors can print you a progress report.
• Correct it. You can change your avatar in Settings. Your name is fixed to the class list, so ask your instructor to correct it. Passwords are reset by your instructor.
• Delete it. There is no self-service delete button; ask the support address shown at the top of this page once the administrator sets it and an administrator will delete the account as described in section 08.
• Take it with you. Instructors and administrators can export class data as spreadsheets; ask for your part of it.
• Object. If you think something is being collected or used that should not be, say so; the optional features in section 05 can be switched off by the administrator.

Students and their parents or guardians should raise these requests with the school, which will act on them through its administrator. Where laws such as the GDPR, FERPA or COPPA apply, CyberLab is the party that answers to them, following its own procedures.

This instance may be used by school students, including children under 13. That is possible because the school, not the child, creates the account; the student signs in with a username instead of an e-mail address; and the school controls what the class can reach. There is no self-registration, no public profile, no advertising, and nothing is shared with other organisations except through the features in section 05, which the school controls.

Parents or guardians who want to see, correct or delete a student's data should contact the school; it will act through its administrator.

The date at the top says when this text last changed. When the wording changes in a way that matters, CyberLab will announce it inside the platform. An administrator can also replace this page with the school's own privacy notice.