Coming November 1, 2026, in the US only: sharing run results (and fits) will be on by
default, with a "Stop sharing" button after every shared run and the switch on this page. A Global Privacy Control signal
still turns it off. Outside the US, including the EEA, the UK and Switzerland, nothing changes: nothing is sent unless
you say yes. Lending your GPU stays opt-in everywhere. Details in Run results.
Erode Lab runs on your own device. You can use it without an account, and we collect as little as we
can. It shows no ads and doesn't use Google Analytics. This page explains what we do collect, why, and who else
receives data when you use it. DeepInTime's games at deepintime.com are a separate site with their own privacy policy
and their own accounts.
Rob Williams is responsible for this data (the "controller" under EU and UK
law). Postal address: 7426 Cherry Ave, Ste 210 PMB 1076, Fontana, CA 92336-4263, United States. Email: hello@erodelab.com.
Without an account
The simulation runs in your browser. Your maps, settings and runs stay on your device;
we don't receive them, except a run's score where you allow it (run results, below).
Hosting. erodelab.com is served by Cloudflare, including the fonts, code libraries and
fault database the lab uses, so loading them doesn't contact anyone else. Like any web host, Cloudflare processes
your IP address and request details to deliver pages and protect the site from abuse.
Cloudflare Web Analytics. Cloudflare adds a small script to our pages that reports each page load
and how long it took (the page, the website you came from, your browser and country). It sets no cookies, stores
nothing on your device and doesn't follow you across sites.
Visitor statistics. Our own pages send our own server a note of each page view: the page, the
website you came from (its name only), your country and device type. Visits are counted with a code made from
your IP address and browser that changes every day and can't be traced back to you once the day is over; nothing
is stored on your device for this.
How the lab is used, anonymously: the place loaded (rounded to the nearest degree, about
100 km), the preset, engine and grid size chosen, how far a run got, and which data services failed to answer
(their names, not the request). We use it to fix problems and decide what to build. You can turn these
statistics and the page-view counts above off for this browser; the choice is remembered in a cookie,
dt_stats_choice (13 months).
Anonymous statistics: checking…
A visitor ID cookie (dt_vid, a random number, 13 months), only where allowed: it
lets us count returning visitors and how many visits come before someone buys. It's first-party and read only by
our own statistics.
In the US it's on unless you turn it off below or your browser sends a Global Privacy Control signal.
Everywhere else it's set only if you turn it on with the switch below, and removed if you turn it off.
The switch remembers your choice in a second cookie, dt_vid_choice (13 months).
Visitor ID: checking…
Browser storage. The lab remembers a few conveniences in your browser's local storage, such
as whether you've seen the timeline hint. This never leaves your device.
Run results, shared fits and lending your GPU
To check the model and make it more accurate, the lab can send us the result of a run from the past
(the button that runs a place from 1 to 2 million years ago to today and compares the result with the real terrain).
Outside the US, nothing is sent unless you say yes. In the US, until November 1, 2026, the same
applies; from November 1, 2026, sharing is on by default (see below), and you can stop it at any time.
In the US from November 1, 2026: the lab doesn't ask; it shares each run from the past and
says so under the result ("Results are shared to improve the model · Stop sharing"). One click on Stop sharing,
or the switch below, turns it off for this browser, remembered in the cookie dt_runs_choice. A Global
Privacy Control signal turns it off too. What is sent, and what is not, is exactly as listed below.
How you say yes (outside the US): after a run from the past, the lab asks whether to share it, with three
answers: share this run only, share this and later runs, or no. You can also use the switch below. A run finished
before you said yes is never sent later. Your answer is remembered in a cookie, dt_runs_choice
(6 months, then we ask again).
How you stop: the "Stop sharing" button the lab shows after each shared run, or the switch
below. Sending stops at once, including for a run that is still finishing. A Global Privacy Control signal from
your browser stops it too, whatever you chose.
What is sent: how far the run landed from today's real terrain, how long it took (roughly), the
engine and grid size, the version of the model, whether you changed settings, and a few figures about the map
rounded to two significant figures (how much fault slip it has, its relief, how much of it is sea, the rock map).
The map's place is sent only as precisely as needed: one of the lab's listed places by its exact centre; a map on
the shared 0.01° grid (below) to 0.01° (about 1 km); any other map only to 0.1° (about 10 km). For listed places
and the shared grid we also get the run's settings as a short code (a fingerprint), and the full settings once
per new fingerprint; for any other map we don't, because the code could be matched back to the exact centre.
Shared fits: with "Fit start and uplift first" on, a map away from the listed places is centred
on the nearest 0.01° grid point when it loads (the lab says so), so that fits can be shared. If you said yes, the
finished fit (a coarse 64 × 64 correction map of the terrain) is sent too, so later runs at the same place can
start from it, and a later run of yours from someone else's fit sends how close it came, which is how fits are
checked. Your browser remembers the codes of fits it shared (local storage, forgotten when you stop sharing) so
it never checks its own. A fit is offered as checked only after two later runs agree with it.
What is not sent or kept: no visitor ID, no account, no name or email, and we don't keep your
IP address: our server uses it only to limit how often requests can be made, in counters that last a minute. The
time of each result is kept only to the hour. It all goes to our own server, never to anyone else. The place of a
map is the place you chose to study, not your location.
Using a shared fit needs no yes: with the fit on at a listed place or a grid point, the lab
asks our server for that place's fit (the place travels in the request body, not the address, so it isn't in
request logs), and nothing about you is kept.
Why: to find problems after a change to the model, to see which places and settings people
study, and to measure where the model needs correcting.
Run results: checking…
Lend my GPU (in the lab, below Run from the past): off until you tick it, on every visit
and in every country. While it's ticked and the lab is idle, your browser asks our server for a model experiment (a
place and some settings), runs it in a hidden copy of the lab and sends back the same kind of score as above. Before
you tick it, the lab says what it costs you: each job keeps your GPU busy for a minute or two (more electricity, heat
and fan noise, and battery drain on a laptop) and downloads the experiment's map data, about 1 to 1.5 MB a job, from
the data services listed below, which see your IP address and the experiment's place (not yours). It pauses while you
use the page, when the tab is hidden, on battery (where your browser can tell; where it can't, the lab says so), and
with your browser's data saver on or on a cellular connection. It does at most 12 jobs a visit; unticking or Stop
ends it at once, and Global Privacy Control switches it off. Besides the score it sends a random code made for that
browser tab (in session storage, forgotten when the tab closes), so the same tab is never given both copies of an
experiment we run twice to check results; we keep that code's hash only until the experiment is settled (at most 7
days). Nothing else on your device is read.
Data services your browser contacts
To build a map, your browser fetches data directly from public scientific data services. Each request
includes the coordinates of the place you pinned (not your own location) and, as with any web
request, your IP address. These services are independent of us and have their own privacy terms:
Elevation, and the pin map's hill shading: Terrain Tiles on Amazon Web Services (s3.amazonaws.com)
Geology: Macrostrat (macrostrat.org), University of Wisconsin–Madison
Fossils: Paleobiology Database (paleobiodb.org)
With an account
Email address, to sign you in (we email you a one-time link and a 6-digit code) and to contact you
about your account, purchase or subscription. We don't send marketing email unless you opt in.
Display name you choose.
A session cookie (__Host-dt_session) that keeps you signed in: 90 days, renewed while you
use the site, or only until you close the browser if you untick "Keep me signed in". It's strictly necessary, so it doesn't need consent. We store only a one-way hash of it.
Purchase and subscription status: whether your account has Lab Tools, whether it has Lab Cloud
(its status, plan, renewal date and Stripe's references), the Lab Cloud invoices paid and refunded, and any teacher
classes or seats on the account.
Preferences you set, such as a home place, units and graphics settings, so they follow you between
devices.
A sign-in cookie (__Host-dt_link, 15 minutes) set when you ask for a sign-in email,
so the 6-digit code only works in the browser that asked for it. It's strictly necessary.
Passkeys, if you add one: the public key, an ID for it, the device type, a name for it (we
suggest one from your browser, and you can change it), and when it was last used. The private key never leaves your
device. We also keep whether you said "Not now" to the offer to add one, so we don't ask again.
A passkey cookie (__Host-dt_wa, 5 minutes) set while you add a passkey or sign in
with one, so the one-time challenge only works in the browser that asked for it. It's strictly necessary.
Cloud saves and share links, if you use them: the saved runs you upload (terrain and settings,
which can include a place you chose), their names and sizes, and the share links you create. Anyone with a share
link can open and copy that run, and sees its name and your display name (not your email).
Terrain you upload (Lab Cloud): if you upload your own elevation data, the file is read and resampled
in your browser, and we store the resampled copy (a grid of heights with its position and size, not your original file)
in your account in our cloud storage. We don't use it for anything else. It is private to your account unless you
make a share link, which anyone who has it can open, and it counts toward your cloud storage.
Account activity: when you signed up, signed in, changed your name, bought or were refunded,
kept for security and support. It's included in your data export.
A log of the emails we send, with your address stored only as a one-way hash, so we can
spot delivery problems and abuse. The sign-in link and a one-way hash of its code are kept for a day after they expire.
Your visits while signed in are counted against your account (with the statistics above), so
we can see how often account holders come back, but only where the visitor ID is allowed (see above: in the US
unless you turn it off, elsewhere only if you turn it on). The visitor ID is then linked to your account.
Research and Classroom plans: the interest form and quote requests
The form on the pricing page works without an account and isn't linked to one. If you send it we
store your email address, the role and boxes you chose, anything you wrote in the note, whether you ticked the box that lets
us email you, and when. We use it to decide what to build and to email you once, when those plans open. We don't use it for
anything else, share it, or add you to any other list. Writing again from the same address replaces the earlier answers.
Because these answers aren't tied to an account, your account export and account deletion don't include them. To see,
change or delete yours, or to stop the email, write to hello@erodelab.com from that
address and we'll do it within 30 days. We keep them until those plans open plus 12 months, or until you ask us to delete them.
Our own statistics record only that the form was sent, with the role and boxes you ticked; never your email or note.
Get a quote. If you ask for a quote on the pricing page we store your email address, the plan, your
role, the organisation and number of seats you gave, your note, that you agreed to be emailed about the quote, and when.
The request is also emailed to us so we can answer it. We use it only to reply about that quote; we don't add you to any list.
It is stored with any interest-form answers from the same address, but doesn't change them or their consent. We keep a quote
request for 12 months after you last asked, then delete it (if you go on to buy, the order and invoice records are kept as
described under Payments). Please don't put students' names in the note. Our statistics record only that the quote form was
opened or sent, with the plan and role; never your email, organisation, seats or note. To see or delete a request, write to
hello@erodelab.com from that address.
Other people on the map
If you choose to share your pin, other visitors see your display name, the place you pinned and what you're
doing there (for example the simulated year) while you're online. We relay this live and don't keep a history of it
after you disconnect.
Rooms
If you host or join a room (one landscape shared with others), the room keeps the landscape, its saved states,
the changes each member made and the members' names and roles, so everyone in it sees the same thing. The host's account
is also charged the time the room is used. Anyone with the room's link can join it.
Payments
Lab Tools and Lab Cloud are sold through Stripe Managed Payments: Stripe is the merchant of record. It takes the
payment, collects Lab Cloud renewals, works out and pays any sales tax or VAT, and handles your payment and tax details as
its own customer data. You give your card details to Stripe, not to us. Stripe tells us that a payment succeeded or failed,
the amount, your email and your country, and the state of a Lab Cloud subscription. Stripe's own use of your data is
covered by the Stripe Privacy Policy.
Invoices to schools, universities and companies are different: we sell those ourselves, through a separate Stripe
account where Stripe is our payment processor, not the merchant of record. For an invoice we keep the organisation's
name, the billing contact's email, the billing address, the purchase order number, the organisation's tax status (and
its exemption certificate, if it sends one), and the invoice and payment records. Stripe processes these for us,
including working out sales tax from the billing address (Stripe Tax). Payment details are given to Stripe, not to us.
No ads, no Google Analytics
Erode Lab shows no ads and loads no advertising code. It doesn't use Google Analytics or any other analytics beyond
Cloudflare Web Analytics and our own statistics described above, and nothing about you is sent to Google.
Why we use your data (legal bases)
To run your account, sign you in, provide Lab Tools, Lab Cloud and teacher classes, and store your saves, rooms and
preferences: to perform our contract with you.
Hosting, security, abuse prevention, Cloudflare Web Analytics and anonymous statistics: our legitimate interest in
running a safe, working service.
The interest form: your consent, which you can withdraw by email.
The visitor ID cookie: your consent (in the US, our legitimate interest, with an opt-out).
Run results and shared fits: your consent, which you can withdraw at any time; in the US from November 1, 2026,
our legitimate interest in improving the model, with an opt-out (Stop sharing, the switch above, or Global Privacy
Control).
Lending your GPU: your consent, everywhere, which you can withdraw at any time.
Keeping payment records: legal obligation (tax and accounting law).
How long we keep it
Account data: until you delete your account, then removed within 30 days (backups within 90).
During that 30-day window, a restricted restore record holds your old email and display name so support can
restore your account identity if you ask. Sign-in methods, cancelled subscriptions and removed shared content
are not restored. Stripe webhook payloads used to check payments are kept for 90 days after successful handling.
Research and Classroom interest form: until those plans open plus 12 months, or until you ask us to delete it.
Quote requests: 12 months after your last request, or until you ask us to delete them.
Class links and their daily counts: 30 days after the link ends or is turned off.
Visitor statistics and lab usage: 90 days. The daily code's ingredient is deleted after two days.
Statistical totals (such as daily page and funnel counts, and page counts by UTC hour) can be kept longer. They contain no
visitor codes, account IDs, emails or IP addresses. Referrers are grouped by type and URLs lose queries,
fragments and share codes. Global Privacy Control also stops our first-party statistics.
The visitor ID's record (first and last visit): 13 months after your last visit.
Sign-in links and codes: a day after they expire. Email log: 90 days.
Cloud saves and uploaded terrain: until you delete them or your account. If Lab Cloud ends, saves beyond the free
allowance become read-only, and uploaded terrain becomes read-only too (you can still open, download or delete it);
both are kept 12 months, with an email 30 days before they're deleted. Expired share links stop working at once and
are removed within 30 days.
Live map positions: not stored after you disconnect.
Rooms: while the room is open, then 7 days after it ends (12 months for rooms hosted with Lab Cloud), or at once if
the host deletes it or their account. Room-time totals: until the host's account is deleted.
Run results, shared fits and lent-GPU results: 13 months, then deleted. The random tab code's hash: until its
experiment is settled, at most 7 days (your browser forgets the code when the tab closes). A lent-GPU job not
finished within 15 minutes: its record is deleted then. Your "share run results" answer: 6 months.
Payment records: as long as tax law requires, typically 7 years.
Admin audit records: our restricted console records the operator's email, role, action, reason, IP address,
time and the record accessed or changed. These records are append-only and kept for security accountability.
Operators are told not to put customer personal details in reasons.
Security-policy reports: counts grouped by day, policy rule and known service, kept 30 days. We discard
page URLs, query strings, report samples and unknown hostnames; no visitor identifier is stored.
Server and security logs: kept by Cloudflare for a short period under its own retention.
Who processes data for us
Cloudflare, Inc.: hosting, database, file storage (cloud saves), email sending, Cloudflare Web Analytics, and
storing our own statistics.
Cloudflare Turnstile, if enabled on sign-in and the interest form: a security check against automated abuse.
It processes challenge tokens and browser/network signals to verify the request. It is off by default and is
separate from analytics.
Stripe, Inc. and its affiliates: payments, as merchant of record for Lab Tools and Lab Cloud, and as our payment
processor (with tax calculation) for invoices to organisations.
We don't sell your personal information. Some of these companies process data outside your country,
including in the United States; where required, transfers rely on the EU–US Data Privacy Framework or
standard contractual clauses.
Your rights
You can ask to see, correct, export or delete your personal data, object to or restrict its use, and withdraw
consent at any time. Email hello@erodelab.com; we'll reply within 30 days. You can also download your data
and delete your account yourself on the account page. If you're in the EEA or UK you may complain to your data protection
authority.
Run results, shared fits and lent-GPU results carry no identifier, so we can't tell which of them came from you,
and can't show, export or delete them for you individually. Stopping sharing stops anything more being sent at once.
California residents: we don't sell or share personal information. Erode Lab shows no ads, so there is
nothing to opt out of; we still honour a Global Privacy Control signal as described above.
Classroom links
A teacher with a Teacher class can make a class link. We treat everyone who opens one as possibly under 13, so a
class link is built to collect nothing about students:
No accounts, names, emails or free text. Students can't sign in, make an account, buy anything
or type anything that is sent to us. If a teacher is signed in on the same browser, the class link ignores that.
Two cookies, and nothing that identifies the student.dt_class holds the class link's
code (so the lab knows it's a class link) and dt_cm says classroom mode is on. Both last until the class link
ends, so the student can come back to it. The visitor ID cookie is removed.
No analytics, ads, tracking or profiling. Pages opened from a class link send no visitor statistics
or lab usage, and don't share run results or lend your GPU. Rooms are off, and a pin can't be shared without an
account. Nothing is sold or shared.
Nothing from anyone else. The elevation tiles, geology and fossil data the lab uses are fetched by
our server and passed on, so the student's browser contacts only erodelab.com. The browser is told to refuse
anything from any other site. We don't pass on anything about the student when we fetch that data.
What we count. For each link, the number of browsers that opened it each day, to apply the
40-students-a-day limit and show the teacher a total. Not who, not which device, and no IP address is stored
(limits on request rates are kept in memory for a short time only).
What the teacher gives us. A class name (we ask that it contain no student names), an end date and
a confirmation that their school has authorised them.
How long. A class link and its daily counts are deleted 30 days after it ends or the teacher turns
it off, or when the teacher's account is deleted.
Children
Erode Lab isn't directed at children under 13, and accounts require you to be at least 13 (or older where your
country requires). Class links (above) are the one way a school can let younger students use the lab, and they
collect no personal data from students. If you believe a child has given us personal data, contact us and we'll delete it.
Changes
If we change this policy in a significant way, we'll post a notice on the site, and email account holders, before
the change takes effect.
October 26, 2026: the science lab moved to its own site, Erode Lab at erodelab.com, and
this is now its own privacy policy, separate from DeepInTime's games, with its own accounts. Erode Lab has no ads and
no Google Analytics, so those sections, races and the shared build world are no longer described here. Supporter is
now Lab Tools and World is now Lab Cloud. Class links now contact only erodelab.com. Added Cloudflare Web Analytics,
a cookieless page-load report.
October 21, 2026: invoices to schools, universities and companies are sold by us through a separate Stripe account
(Stripe as processor, with tax calculation): what we keep for an invoice, including the billing address and tax status.
October 21, 2026: added classroom links: no student accounts or personal data, no analytics or ads, third-party
data fetched through our server, daily open counts only, deleted 30 days after a link ends.
October 21, 2026: added quote requests from the pricing page: what we store, that the request is emailed to us,
and that it is kept 12 months.
October 20, 2026: described the restricted admin console's append-only access and change audit records.
October 20, 2026: explained account identity restoration within the existing 30-day deletion window and
90-day retention of successfully handled Stripe webhook payloads.
October 20, 2026: added daily and hourly aggregate statistics without identifiers, retained beyond the 90-day raw
event window; clarified URL reduction and Global Privacy Control for first-party statistics.
October 20, 2026: described optional Turnstile form protection and 30-day aggregate security-policy reports.
October 18, 2026: sharing run results and fitted starts, and lending your GPU, both opt-in;
race leaderboards, rooms and the shared build world described; non-personalised ads with Global Privacy Control.
October 18, 2026 (announced; takes effect November 1, 2026): in the US only, sharing run results and fits on by
default with an opt-out; Global Privacy Control still turns it off. No change outside the US.
October 18, 2026: US fault data is now served from our own storage alongside the global fault tiles rather than
fetched live from the U.S. Geological Survey (earthquake.usgs.gov).