Privacy
Reading LSLab needs no account, and we collect as little data as we can.
This page says what LSLab stores if you choose to sign in, what stays on your own device and what happens when you write to us. The general rule is to collect as little as possible, because readers include children.
What is stored
| Data | Purpose | Who can read it | How long, and how it is deleted |
|---|---|---|---|
| User ID (the sign-in provider, currently Google, and your ID there) | Recognise your account | The project owner, through the database console | Deleted when you delete your account |
| Display name (the name only, no email) | Greeting in the interface | As above | As above |
| Sign-in session (a random code, stored as a hash; creation and expiry dates) | Keep you signed in | As above | Expires on its own; stops working when you sign out or delete your account |
| Time of the sign-in session's last use (written at most once an hour) | Know that the session is still in use | As above | As the sign-in session |
| Profile photo you chose (a small square the browser cut beforehand; optional) | Show your photo on every device | The project owner and administrators | Deleted when you remove the photo or delete your account; included in the JSON export |
| Learning progress: article ID, state, position, time of update | Save progress and suggest the next article | As above | Deleted when you delete your account; you can export it as JSON |
| Language and light or dark theme | Personalisation | You, on your device (localStorage); when you sign in, these two choices are also stored in your account and the project owner can read them through the database console | You clear your browser data; the copy in your account is deleted when you delete your account and is included in the JSON export |
| The days your account was active (the day and your user ID) | Count users per day | The project owner, through the database console | Deleted on its own after 35 days; deleted when you delete your account |
| Access an administrator granted to your account (user ID, what was granted, who granted it, when) | Let the account open some non-public areas | The project owner and administrators | Deleted when the access is withdrawn or you delete your account; included in the JSON export |
| Aggregate visit counts (a cookie-free tool is planned) | Know which pages are read | The project owner | Set by the provider; the provider's policy has not been confirmed |
What accounts do not collect
A LSLab account does not store your email address, date of birth or location. LSLab does not use advertising cookies and does not sell or share data. When you sign in with Google, LSLab asks for only two permissions, openid and profile. The picture on your Google account is only shown by your browser: LSLab does not store it, or its address, in the database.
When you write to us
The form on the Contact page and the Report this article button at the bottom of each article only open the email app on your device with a message ready. LSLab has no server that receives the form, so nothing is sent or stored until you press send in your email app.
When you send, the message reaches the lssoft.adm@gmail.com mailbox with your email address and everything you wrote, including the article title and address that the report button fills in. We use it to read, check the content and reply to you, and we do not publish it on the site.
Third-party services
The two providers that process account data are Cloudflare and Google. Your message passes through your own email provider and our Gmail mailbox. Each has its own policy.
Your rights
You can export your account data and delete your account yourself. Deleting really deletes; it does not just hide. For a message you already sent us, you can email to ask what we hold or to ask for it to be deleted.
Administrators
An administrator can see the list of users (ID, display name, creation date, the profile photo if you chose one), each person's progress and aggregate figures. An administrator cannot read tokens and cannot impersonate a user. Disabling, signing out and deleting work on one account at a time; granting or withdrawing access can be done for several accounts at once. Every write action is logged (only the ID, the action and the time). Two kinds of data are added to the table above: an account-disabled flag and the administration log.
Security by design
- The session cookie carries the
HttpOnly,SecureandSameSite=Laxflags. - Google's token is verified on the server and then discarded.
- Secrets are stored at Cloudflare, not in the source repository.
No way of sending data over the Internet or storing it electronically is completely secure, so we keep the amount of data to a minimum.
Children and signing in
You can read LSLab without signing in. Article age hints only help you choose suitable content.
Google requires people in Vietnam to be at least 15 to manage their own Google Account; younger children can have a parent-managed account through Family Link. This is Google's rule, not evidence that LSLab has verified a reader's age or obtained valid parental consent.
Vietnam's Law on Children defines children as people under 16. Article 24 of the Personal Data Protection Law 91/2025/QH15 assigns the exercise of children's data rights to their legal representatives, subject to statutory exceptions. Processing to publish or disclose private information about a child aged 7 or older requires consent from both the child and their legal representative.
LSLab does not collect dates of birth and currently has no age-verification or parental-consent step. If a child's account use requires that consent, please read without signing in and contact lssoft.adm@gmail.com before creating an account. Parents can also use that address to request a review or deletion of a child's data; please do not send identity documents in your first message.
Data protection rules
The Law 91/2025/QH15 and Decree 356/2025/ND-CP took effect on 1 January 2026. Article 42(2) of Decree 356 repealed Decree 13/2023/ND-CP from the same date.
Duties to assess include the basis for processing and consent, people's data rights, security, incident handling, impact assessments and cross-border transfers, with the relevant exceptions. Using Google or Cloudflare does not fulfil LSLab's own obligations.
Elsewhere, rules depend on their scope. For example, where GDPR Article 8 applies to consent-based online services, the age of independent consent is 13–16 depending on the EU country. In the United States, COPPA requires notice and verifiable parental consent for collecting data from children under 13 on covered services.
These sources were checked on 2 November 2026. This describes the rules and the site's current behaviour; it is not certification that LSLab has met every legal obligation. A full assessment of LSLab's applicable duties, documentation and compliance procedures still needs to be completed.
Changes to this policy
When the way LSLab handles data changes, this page is updated with a new date.
Contact
Privacy questions go to lssoft.adm@gmail.com, or use the Contact page.