Privacy policy

SwitchLab Inc., 5151 New St, Burlington, Ontario L7L 1V3, Canada, is responsible for the personal information described in this policy. Our designated Privacy Officer can be reached at switchlab.dev@gmail.com or at that mailing address.

SwitchLab collects the information needed to run a browser-based network lab simulator: account login details, saved lab progress, lab sessions, optional feedback, and optional analytics. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Tinky, our AI lab helper, can send your question and lab context to third-party AI providers when you use it. Do not enter real passwords, secrets, personal data, or production network information into Tinky.

• Account email address, optional username, authentication provider, and account creation date.
• Password hashes for email/password accounts. We do not store plaintext passwords.
• Google account identifiers and available profile names, email-verification claims, profile photo URL, language/locale, and Workspace domain when you sign in with Google. We record the source and capture date; a Workspace domain is an organization clue, not proof of employment.
• Successful sign-in date and method, and approximate sign-in country supplied by our hosting provider when available. Country can reflect travel or a VPN. We do not save Google login tokens or raw IP addresses in this account profile.
• Lab progress, objective progress, scores, selected vendor, command/session history, and saved UI state.
• Saved and shared Sandbox documents, including topology, device configuration, notes, simulated content, version history, invitations, tickets, and collaboration activity.
• Classroom information, including class and membership details, uploaded materials, whiteboards, assignments, answers, attempts, scores, transcripts, submissions, announcements, messages, and instructor feedback.
• Lab reports you submit, including the issue category, details, and technical snapshots needed to debug the report.
• Tinky AI helper inputs, including your question, current lab, objective state, recent CLI exchanges, validation feedback, and simplified switch state.
• Optional survey responses, feedback reports, and any email preferences you choose.
• If you create an account and join the yearly Member Access launch waitlist, your account email address, waitlist enrollment, reserved discount, and signup timestamps.
• Stripe customer and subscription status if you use checkout. Stripe handles payment card details.
• When you accept analytics, anonymous exam and custom-test diagnostics: question and release identifiers, answer-choice selections, completion and grading outcomes, and active question time. These diagnostics do not include exam scratch notes, terminal commands, or credentials.
• Product and acquisition events when enabled, including random analytics identifiers, account identifier, session identifier, page path, referrer, campaign source, lab or activity identifiers, and limited event properties.
• When you arrive through a paid Instagram link, the ad post, campaign tags, a random visitor identifier, click time, attribution expiry, and any later account, learning-activation, or first paid-member outcome linked to that visit. We do not store your IP address or raw browser user-agent for this attribution.
• Affiliate applications, including contact information, public channel details, audience range, country, and your proposed promotion plan.
• For approved affiliates, a login handle, hashed access credential, security-session records, and creator-scoped program analytics. An affiliate may see the username, masked email address, registration date, launch-offer type and plan, delivery status, and subscription status of accounts attributed to that affiliate. Full email addresses, promotion codes, payment details, billing identifiers, and another affiliate's users remain restricted to SwitchLab administrators.

• Run labs, validate configurations, save progress, and restore sessions.
• Create and protect accounts, including password resets and authentication.
• Sync progress across devices for signed-in users.
• Respond to support requests, bug reports, and feedback.
• Send transactional account, security, and billing emails.
• Send optional feedback or product update emails only when you opt in.
• Manage the yearly Member Access launch waitlist and send launch, Member Access, and reserved-offer emails to people who explicitly join it.
• Improve the product using consent-based analytics and aggregated operational information.
• Measure whether paid Instagram posts lead to visits, account creation, learning activation, and Member Access purchases.
• Provide Tinky AI responses when you choose to use the AI helper.
• Review affiliate applications, protect the affiliate portal, attribute partner referrals, and report privacy-limited program performance.

Guest users store progress, terminal history, and UI state in browser localStorage. Guest lab data stays on your device unless you sign in and sync it.

Registered users sync account data, lab progress, saved sessions, survey responses, and subscription status to our server so progress works across devices.

Browser storage may also hold your selected vendor, auth token, cached user profile, dashboard scroll position, survey draft, sound preference, dev-mode flag, and analytics consent choice.

We use localStorage and sessionStorage for core app behavior like saved lab sessions, UI restoration, login state, and remembering your analytics choice. We also use signed, HttpOnly first-party cookies to measure visits from SwitchLab's paid Instagram posts.

We use Vercel Analytics only after you accept analytics. If you decline, Vercel Analytics is not loaded by the app. You can change your analytics choice from the footer privacy choices link.

When you visit a named partner page, SwitchLab sets a signed first-party attribution cookie on the server before the page loads. It lasts for up to 60 days and may be saved with your account or launch-offer reservation so the partner can receive credit if you later purchase. We store the partner, campaign values, a random touch ID, and timestamps; we do not store an IP address or raw browser user-agent for this attribution. If you reserve a partner offer, we use your account email to deliver the requested launch code and record delivery and redemption status. This information is not used for advertising.

When you follow a SwitchLab paid Instagram link, we set separate signed first-party visitor and ad-attribution cookies. The most recent paid Instagram click replaces an earlier Instagram-ad touch and can be connected to your account when you register, sign in, or visit while signed in. Attribution lasts up to 30 days. Affiliate attribution remain separate and are not overwritten by this cookie.

This measurement stays within SwitchLab. We do not use a Meta Pixel, Meta Conversions API, or another third-party ad tracker for it, and we do not send your account, learning, or purchase outcomes back to Meta. Meta's own reporting figures are entered manually by an administrator.

Approved affiliates sign in with a separate first-party, HttpOnly session cookie. Each affiliate can see individual, privacy-limited registration and purchase-status rows only for accounts attributed to that affiliate. Affiliate leaderboard members see approved partner identities, rank, and aggregate unique founder-plus-partner-offer totals; they do not receive another partner's users, traffic, conversion rate, revenue, promotion codes, or commissions.

Tinky may set a first-party HttpOnly cookie named tinky_uid for rate limiting and abuse prevention. It is not used for advertising.

Tinky is an AI-assisted lab helper. When you use Tinky, we send your message and limited lab context to an AI provider so it can generate a response. Depending on deployment configuration and provider availability, this may use Groq, Vercel AI Gateway and its routed model providers, Google Gemini, Cerebras, and/or OpenRouter.

Tinky responses can be wrong or incomplete. Use it as study help, not as a guarantee that a command, certification answer, or troubleshooting path is correct.

We use Vercel for hosting, application logs, private file storage, AI Gateway routing, and consent-based product analytics. We use Neon for Postgres database hosting, Stripe for checkout and billing records, Google OAuth for Google sign-in, Resend for transactional and optional emails, and Groq, Vercel AI Gateway model providers, Google Gemini, Cerebras, and/or OpenRouter for Tinky AI responses when configured. These providers may process information in countries other than yours, where it can be subject to local law. Our paid Instagram measurement is first-party and does not use Meta Pixel, Conversions API, or a third-party ad tracker.

We use email addresses for account access, security, billing support, password resets, and optional communications. Creating an account does not subscribe you to feedback or product update emails.

Optional feedback requests and product updates require opt-in. You can change preferences from your account page or unsubscribe using the link in an email. Transactional account emails may still be sent when needed to provide the service.

Joining the yearly Member Access waitlist is an opt-in to receive SwitchLab launch, Member Access, and reserved-offer emails at your account address. You can unsubscribe at any time using the link in those emails without deleting your account.

• Download your account data from the account page.
• Delete your account from the account page.
• Update optional email preferences from the account page.
• Ask us to access, correct, delete, or export personal information by email.
• Decline optional analytics or change your analytics choice later.
• Clear the paid Instagram attribution cookies stored by this browser.
• Do not use Tinky if you do not want lab context sent to AI providers.

Account deletion removes or de-identifies product analytics, learning records, saved and shared Sandbox data, classroom membership data, and other account-linked product records. We may keep limited payment, tax, fraud-prevention, security, offer-audit, dispute, and email-suppression records when required or reasonably necessary; where practical, we remove direct account identifiers from those retained records.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information. You may also have the right to complain to a privacy regulator. Contact us and we will respond based on the laws that apply to your request.

SwitchLab is not currently designed to sell personal information or share it for cross-context behavioral advertising. If that changes, we will update this policy and provide required choices before doing so.

SwitchLab is not directed to children under 13. Do not use SwitchLab if you are under 13. If we learn that we collected personal information from a child under 13, we will delete it.

We use reasonable safeguards, including password hashing, HTTPS in production, restricted database access, and token-based authentication. No online service can guarantee perfect security.

We keep account data while your account is active. Lab progress and saved sessions are kept until you delete them, delete your account, or we no longer need them to provide the service. Password reset tokens expire after 1 hour. Tinky rate-limit identifiers may last up to 1 year. Suppression records may be kept after deletion so we do not email unsubscribed or deleted accounts again.

Pending affiliate applications are kept while we review and operate the program. Rejected or abandoned applications are scheduled for deletion after 12 months unless security, fraud-prevention, contractual, or legal needs require longer retention. Archiving an approved affiliate preserves historical attribution needed to honor already-earned credit while revoking future portal access and new referrals.

Pseudonymous paid-ad visit attribution is retained for up to 13 months. After that, the stored visitor hash and account linkage are removed. De-identified campaign totals and administrator-entered campaign records may be retained for historical reporting.

Payment, tax, fraud-prevention, security, and legal records may be kept longer when required or reasonably necessary. Backup copies may persist for a limited time before normal rotation deletes them.