Privacy

There is no registration, no email address and no password. We do not ask who you are and have no way to find out.

When you open the lab, your browser receives one cookie named mlab_session containing a random token. It is the only thing that links you to your lab.

• –It is HttpOnly, so page scripts cannot read it.
• –It is Secure, so it is only sent over HTTPS.
• –It is host-only — no other subdomain receives it.
• –The server stores only an HMAC hash of the token, never the token itself.
• –It expires after 4 hours.

To stop one person creating unlimited labs, we need to recognise repeat activity from the same network. We do that without keeping the address: your IP is converted to an HMAC fingerprint using a server-side secret, and only that fingerprint is stored.

The raw IP address is not retained in the quota or abuse-event tables. The fingerprint cannot be reversed back into an address, is never shown to you, and is never used to identify you.

We store the devices you create — their profile, display name, state and the generated SNMP community — for as long as your lab lives. Communities are encrypted at rest.

All of it is deleted automatically 4 hours after the lab is created, or immediately when you delete a device.

We keep a minimal record of lab and device creations, and of refusals, holding only the source fingerprint, an event type and a timestamp. These are removed after about 7 days.

The web server and application keep operational logs, which include request paths and the connecting address, in the ordinary way. They are used for running and debugging the service. SNMP community strings and session tokens are deliberately kept out of them.

• –We do not sell or share personal data.
• –There is no advertising and no third-party analytics.
• –There are no tracking cookies — the session cookie is required for the lab to work at all.

A community string is a temporary credential for a disposable device, sent in cleartext by SNMP v2c. Do not reuse one on equipment you care about.