Policy

Privacy and retention

Last updated 25 October 2026.

What is stored

Account details (name, email, salted password hash), workspace membership and roles, uploaded dataset records, annotation answers, review decisions, adjudication rationales, release snapshots, and audit events. Production request logs may contain IP addresses and request metadata.

Uploaded dataset content

Imported records are stored in PostgreSQL as normalized JSON. LabelForge does not send records to an external model provider and does not require an AI service. Import previews are staging records and expire after one hour. Row-level error messages quote field names and error reasons, not full record bodies.

The public demo deployment contains synthetic product reviews and support cases. Do not upload confidential or personal data to the demo.

Cookies

LabelForge sets one essential session cookie. It is HTTP-only, uses SameSite=Lax, and is marked Secure in production. There is no analytics or advertising cookie, and no third-party tracking script on the application.

Retention and deletion

Import preview rows and errors1 hour staging
Committed dataset versions and annotationsUntil project deletion
Published releasesUntil project deletion
Audit eventsUntil workspace deletion
Expired session rowsNot reused; revocable

Archiving a project is reversible and keeps its data. Permanent project deletion and workspace deletion remove their data, including records, annotations, releases, and audit events. Deletion cannot be undone. The operator may retain provider-level backups for a limited period as configured by the hosting provider.

Subprocessors

This deployment uses Vercel for application hosting and function execution, and a hosted PostgreSQL provider for storage and backups. These providers process data on the operator's behalf. No separate analytics, email, or model provider is configured. Invitation links are displayed in the application for the owner to share; the application does not send invitation email.

Security limits

LabelForge uses server-side workspace checks, hashed opaque session tokens, scrypt password hashing, rate limits, optimistic concurrency, and checksummed releases. No system is perfectly secure. This is not a security certification or a compliance guarantee. Report a concern to devtechedge@gmail.com.

Requests

Workspace owners can export data through release manifests and delete projects or workspaces. For other access or deletion requests, contact the operator at devtechedge@gmail.com. Identity verification may be required.