Cookie Policy

This policy explains the cookies and browser storage LabSpace uses to keep you signed in and run the product, the analytics it runs only with your consent, and how to change your choice at any time.

1. Strictly necessary storage

These are always on because LabSpace cannot work without them. They keep you signed in, protect your account and remember your choices. They are not used for advertising or to build a profile of you.

• labspace_session: a first-party cookie set by the LabSpace API when you sign in, so you stay signed in. It is HttpOnly, so scripts on the page cannot read it, and it ends when you sign out or it expires.
• labspace_consent: a first-party cookie that remembers your cookie choice, so we do not ask on every page. It holds only that choice and the date you made it, is shared across labspacetrinect.tech and institution portals on it, and expires after 6 months, when we ask again.
• Browser storage (localStorage and sessionStorage) for your sign-in token, unsaved work on an experiment canvas, and small interface choices such as a dismissed announcement. It stays on your device.
• Our hosting providers, Vercel for the website and Railway for the API, may process request identifiers and set short-lived technical storage needed to route requests, protect the service from abuse, and deliver pages reliably.

2. Analytics, only with your consent

If you accept analytics, LabSpace loads Vercel Web Analytics and Speed Insights. They count page views and measure page speed: the page viewed, referring site, country, browser and device type, and load and responsiveness timings. They set no cookies, do not follow you to other sites, and give us aggregated reports only.

Until you choose, and whenever you reject analytics, these scripts do not load. If your browser sends a Global Privacy Control signal, we treat it as a rejection and do not ask, though you may still turn analytics on yourself.

3. What we do not use

LabSpace does not set advertising, cross-site tracking or social-media cookies, and it does not load advertising scripts. The fonts and images on the public site are served from our own domain.

4. Institution portals and connected services

When you sign in through your institution, your institution's identity provider may set its own cookies on its own sign-in pages, under its own policies. When you connect an outside service to LabSpace, such as a code repository or a cloud account, that service's sign-in pages follow its own cookie policy.

5. Changing your choice

Rejecting is as easy as accepting. Use “Cookie settings” at the bottom of any public page, or the button at the top of this policy, to change your choice at any time. Turning analytics off takes effect immediately and reloads the page so the scripts stop. You can also block or delete cookies in your browser settings; blocking the session cookie will sign you out, and if you delete the consent cookie, we will ask again.

6. Changes

If we add a new kind of non-essential cookie or analytics, we will update this policy first and ask for your consent again before using it. Questions may be sent to legal@trinect.org.