Privacy & data security
DataLab does not do more with your data than it needs to: minimum data, minimum time, explicit rules.
What do we store, where, and for how long?
- The files you upload and the versions you create are kept on the server outside the web root, in a directory with a random private ID (128-bit) that is yours alone. No other visitor can reach it.
- Retention: you choose the period (1, 6, 12, 24, 72, 168 hours); it counts from your last activity, is renewed with every action, and your workspace is deleted automatically when it ends. Uploads left pending during import are deleted within 30 minutes.
- Immediate deletion: the “Delete all my data” button in the side panel removes all datasets and their history at once; you can also delete single datasets.
- The format converter page only processes the file during conversion and stores nothing.
- Data is never shared with third parties and never used for advertising or analytics.
Logs
Server logs contain only technical information (request path, operation type, row/column counts, error stack). Cell values, file contents and file names are never written to logs.
Cookies and browser storage
| Name | Purpose | Duration |
|---|---|---|
dl_ws | Links your workspace (HttpOnly, Secure, SameSite=Lax) | 7 days (data may be deleted sooner) |
dl_lang | Your language preference | 1 year |
localStorage: dl-theme | Light/dark theme preference (stays in your browser) | Until you clear it |
No tracking, advertising or third-party cookies are used.
Security measures
- File type is verified from the content; size, row, column and cell limits apply; zip bombs (excessively expanding Excel/ODS) are blocked.
- Excel output is protected against formula injection.
- Formulas run in a safe interpreter without
eval; SQL runs read-only with a time limit. - Workspaces are isolated from each other; IDs are validated before touching the file system.
- A strict Content Security Policy (CSP), HSTS and Origin checks against cross-site requests are enforced.
- Long-running operations are stopped by a timeout; unexpected errors do not leak details to you.
What we ask of you
Do not upload data you have no legal right to process. For very sensitive data we recommend masking identifiers before uploading. This service is provided “as is”; keep your own backup of critical data because workspaces are designed to be temporary.
Contact
For questions use the contact channels on mirac-ozdemir.com.