Loading…
Reading your data.
Loading…
Reading your data.
LabReach helps a high school student find professors, read one of their papers, and send a few careful, personal emails. This page says what LabReach collects, why, who else ever sees it, how long it is kept, and what you can do about it. It is written for students and parents, not lawyers.
Effective and last updated October 26, 2026.
LabReach is run by Aarush Gupta, an individual in New Jersey, United States (“we”, “us” in this policy). We are responsible for the information described here. LabReach is offered only to students in the United States, and this policy is written for US law. To reach us about anything on this page, see Contact.
Your account. Your email address and name (from Google when you sign in with Google). If you sign in with Google, also the account number Google gives your Google account, so that if your email address is ever given to someone else (schools sometimes reuse addresses), their Google account cannot open yours; it is deleted with your account. And a record that you are 13 or older: when you answered, and which wording you saw. We ask your age once and keep only whether it is 13 or older, never the age itself; we never ask for your birthdate. We keep the name of your time zone (like “America/New_York”) so your three-emails-a-day limit resets at your midnight; it is a region name, not your location. We keep the day you last used LabReach (the date only, never the time), so that an account nobody has used for 12 months can be deleted (see How long we keep it). If you sign in with an email and password, a scrambled form of your password and of your recovery code (never the password or the code itself). Before an email-and-password account is made, we check that the address's domain can get email (only the domain, such as gmail.com, goes to our server's name lookup, and the answer is kept in memory for at most an hour), then email an 8-digit code to the address, and the account is made only when that code is entered, together with the password typed again, so nobody can make an account with an address they can't read. That code email, and a short note if someone tries to sign up with an address that already has an account, are the only emails LabReach itself sends; it never emails a professor or anyone else. While the code is waiting (until 30 minutes after the newest code, so about 2 hours at the very most, and deleted within an hour after that; never in a backup), we keep the email address, the name, a scrambled form of the password, your setup answers and a scrambled form of the codes. A LabReach with no email service set up makes new accounts with Google only, unless the person who runs it turns password sign-up on without the code; there, we can't check that the email address is yours. Until Google confirms it (the first time you sign in with Google as that address), such an account can't connect Gmail and isn't counted in the “several students emailed this professor” notice, and its daily allowances belong to the account rather than to the email address. If someone else made an account with your address and you sign in with Google as that address (Google must ask for your Google password), we ask whether it is yours: if it is, you sign in with its password once, Google works from then on, every other device is signed out and you get a new recovery code; if it isn't, we delete that account and everything in it and make you a new one. For an address that isn't a Google account, contact us.
Your profile. What you tell the setup questions and Settings: grade, research interests and keywords, schools you want to reach, a short bio, projects, weekly availability and whether remote work is fine, and, only if you choose, coursework, test scores, activities and skills. Optionally a parent's email address, used for the parent update you send and, only if a security breach affects you, to tell your parent (see If something goes wrong).
Your resume, if you upload one. The PDF file and the text inside it. The file is stored privately and is never shown on a web page.
A research paper or writing sample, if you add one. The PDF file. LabReach checks that it opens and counts its pages, but doesn't keep or use the text inside it, and no AI reads it. The file is stored privately and is never shown on a web page.
Your work in LabReach. The professors you look at and save, your answers to the reading questions about a paper (and any paper text you paste in), including answers you haven't submitted yet, saved as you type so you can finish on any device; email drafts; and a lasting record of each email you sent: what it said, to whom, when, and what happened next (a reply, a meeting, a follow-up). Professor replies you add, meeting dates, meeting prep you ask for, and the Reply Kit documents you edit (such as the permission letter for a parent). Private notes you write about a professor, and professors you marked “Not interested”.
Your Gmail connection, if you connect Gmail. Your Gmail address, which permissions you granted, and the access keys Google issues, stored encrypted. We never see your Google password. See Gmail and Google data for exactly what LabReach reads.
Activity records. A record of each AI request (which feature, when, how big; on the hosted LabReach never the text itself), counts of how many searches you ran each day so allowances are shared fairly, a scrambled code made from your email address that carries those daily counts across a deleted and re-created account (see below), and a short list of account events (each sign-in, with a password or with Google, sign-in pauses after wrong passwords or recovery codes, password changes and resets, a new recovery code, Google being linked to a password account, data downloads, Gmail being connected or disconnected, a change of sign-in account, and web content that looked like an attempt to trick the AI), each a fixed sentence, with no email contents or addresses. You can see your own recent ones in Settings, under Account. We also keep short notes about how the app behaved for you: an AI draft that broke one of our writing rules or contained a link and had to be redone (with the rule or phrase it tripped on), and unusual patterns such as many reading checks started within a few minutes or the daily email limit reached day after day. These notes are kept for 180 days (warnings for 365), or until you delete your account.
In your browser. A sign-in cookie (it holds your account number and the name and email address Google gave at sign-in, encrypted), a few short-lived cookies that protect the sign-in and Gmail-connect steps, a cookie with a scrambled label for your account so small preferences on a shared browser stay yours, and, if someone gives an age under 13, a cookie that stops that browser from answering again until the browser is closed (it is deleted then, so the next person on a shared computer isn't blocked). Your browser also keeps small conveniences for us (the tour was seen, a filter you chose) and, until you close the tab, your unsaved setup answers and reading-check answers so a reload loses nothing. Only cookies are sent to our server. Every one is listed, with how long it lasts, under Cookies and browser storage below.
Technical information. Like every website, our host sees your IP address when you connect. We use it only, briefly, to slow down repeated attempts (signing in, creating accounts, and the school search on the sign-up pages) and to share the daily limit for AI steps fairly between internet connections. It is held only in memory, for about two hours at most (longer only while a limit it triggered is paused, up to a few hours), is forgotten when you delete your account, and is not stored in our database. If one of those limits is reached, the pause is remembered for a few hours under a scrambled label that can't be turned back into your email or IP address without a secret only our server has. Our server logs record account numbers (not names), when emails were sent, errors with personal details removed, and a daily line of totals.
What we don't collect. We don't ask for or knowingly collect sensitive information such as your precise location, government ID numbers, health information, biometrics, race, religion or immigration status. Test scores are optional; leave them out if you prefer. Please don't put sensitive information in free-text boxes.
Finding universities near a place. If you use it, the city you type (or your device's location, if you press “Use my location” and your browser asks and you allow it) is used only inside your browser, to measure distances to a list of universities that ships with the page. It is never sent to us and never stored. We only receive the universities you then choose to save.
LabReach uses only the cookies and browser storage it needs to work: to keep you signed in, to protect signing in and connecting Gmail from forgery, and to remember choices you made. None is used for advertising or analytics, none tracks you across other websites, and LabReach's pages load nothing from other companies, so no one else can set a cookie through them. That is why there is no cookie banner. You can clear all of it in your browser's settings at any time; you will be signed out and small preferences will reset.
Cookies (sent to our server with each request; on the hosted site the Auth.js names begin with __Secure- or __Host-):
Browser storage (kept in your browser and never sent to our server):
Only to provide the features you ask for, and to keep them working and safe:
We do not use your information for advertising, we do not build a profile of you for anyone else, and we do not make decisions about you that have legal or similarly serious effects. The reading check is graded by AI; if you think it got your answer wrong, you can answer again.
We don't sell it, and we don't “share” it for advertising. We never sell personal information, never share it for cross-context behavioral advertising (targeted ads based on what you do on other sites), and show no ads at all. No other company can collect information about what you do across websites through LabReach.
Services that run parts of LabReach. We send information to these companies only to provide the feature you are using:
People you choose. Professors receive the emails you send. Your parent receives the update if you send one: which professors you emailed and when, replies and meetings with their dates and times, and follow-ups due, never what any email says. With Gmail connected, emails go from your Gmail; otherwise you copy the email or open it in your own mail app, send it there, and mark it sent in LabReach. Your resume, and a research paper or writing sample if you add one, are attached only to emails you choose to attach them to, never to a follow-up or the parent update.
The law and safety. We may disclose information if the law requires it (for example a valid court order), or if we believe it is needed to protect someone's safety or to stop fraud or abuse of LabReach.
Signing in with Google gives us your name, email address, profile-picture link and the account number Google uses for your Google account (we keep that number; see section 2). Connecting Gmail is separate and optional (on the hosted LabReach it is by invitation; everyone else sends from their own mail app). If you connect it, LabReach can:
Nothing else in your mailbox is read. How we treat what we get from Google:
LabReach's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting Gmail in Settings removes LabReach's access at Google and deletes the stored keys. You can also remove access at myaccount.google.com/permissions.
LabReach uses Anthropic's Claude AI. The reading questions, the grading of your answers, paper summaries, professor ratings and email drafts are written by it, and labelled as AI in the app. This is the biggest way your words leave LabReach, so here is exactly what goes.
Sent when a feature needs it: your name, grade, bio, interests, keywords, projects, availability and time-zone name, coursework, test scores, activities, skills and resume text; your reading-check answers and your “why this lab” answer; drafts, and earlier emails when writing a follow-up; professor replies you added and the note you type into the reply helper; and the interests you type into the interest helper, even before you save them.
Never sent: your account's email address, your parent's email address, or your private notes. Before your resume text, an earlier email or a professor's reply goes into a request, email addresses, phone numbers, web links and street addresses are removed from it. Anything you type into a box yourself (your bio, for example) is sent as you typed it. No account number or other identifier is sent with a request.
What Anthropic does with it. Under Anthropic's commercial terms, what LabReach sends is not used to train its models, and Anthropic deletes it within 30 days, except content its safety systems flag, which it may keep for up to 2 years to enforce its usage policy.
To help students choose whom to write to, LabReach gathers public information about professors: name, school, published papers and their abstracts, research topics, public grants, what their public lab and department pages say (including whether they have worked with students before), and a work email address found on a public page, always shown with the page it came from, never guessed. The AI rates how good a fit and how open to students each professor seems.
Each student's list is private to that student. Nothing about a professor is published or shown outside LabReach, and nothing that identifies you is ever shown to another student.
The one thing pooled across students. When 3 or more students have emailed the same professor recently, LabReach shows other students looking at that professor an anonymous, rough count (“several students (5+) have emailed this professor in the last month”) so students can spread out instead of all writing to the same person. Your own first email to a professor is counted this way for other students; your own emails never count toward what you see. How it is counted: only first emails (never follow-ups), sent during the four full weeks (Monday to Monday, UTC) before the current week, so the number changes only once a week; only from accounts at least two weeks old; one count per person, so a second account on a variation of the same email address (such as name+tag@) is not counted again; only accounts whose email address Google has confirmed (an account made with Google, or a password account that has since signed in with Google), so accounts made up with an unconfirmed address can neither raise the count nor be used to work it out; an email still counts if its sender later marks it as not sent; and only emails sent on or after October 19, 2026, when this policy first described the count. It never shows a count below 3, never the exact number (only 3+, 5+ or 10+), and never who sent them, their school, or any date. It is worked out on our server each time the page is shown, from the records of emails already sent; nothing new is stored and nothing leaves the server. Practice (demo) accounts are not counted.
What this count cannot fully prevent. It assumes the accounts it counts belong to different people. Someone who controls several established accounts under unrelated email addresses, each confirmed by Google, each of which really emailed the same professor, could use the count to learn that at least one other student wrote to that professor in those weeks. They would never learn who, and doing it means sending real emails to a real professor; we think the notice is worth that small risk, and we will turn it off if it is misused.
If you are a professor and want information about you corrected or removed, write to us (see Contact). We can correct or delete it in the student lists that hold it, and on request keep you out of every later search: we then store only your research-database ID, so the app can skip you, and delete our cached research-database records that name you. Cached copies of public web pages and web searches expire on their own within 60 days. A student who already emailed you keeps the record of their own email. We can tell you which public source your information came from.
Backups. So that a mistake or an outage can't wipe out everyone's work, copies are kept for a limited time:
When you ask to delete your account, the deletion happens 7 days later, so that a deletion started by someone else on a shared or school computer can be stopped. Until then the account works as usual, every page says when it will be deleted, and one click cancels it; you can still download your data. When the deletion runs, the account is gone from the live database right away, and disappears from every backup as the backups age out, within about 90 days. If a backup is ever restored, accounts deleted after it was made are deleted again before the service restarts, a deletion you had asked for that the backup predates is put back (with the same date, or a day after the restore if that date has passed, so you can still cancel it), and everyone is asked to sign in again. Backups are used only to recover from a problem, never for anything else.
Connections to LabReach are encrypted (https). The server's disk is encrypted by our host, and Gmail access keys are encrypted a second time by LabReach. Only the person who runs LabReach can reach the database; they look at it only to fix a problem you report, to keep the service secure, or when the law requires it. Every request checks that you can only see your own information. Errors are logged with personal details removed.
No system is perfectly secure, and we can't promise that yours never will be exposed. Use a strong password (for LabReach and for your Google account), turn on 2-step verification for Google, and keep your recovery code somewhere only you can reach.
Under 13. LabReach is not meant for children under 13, and we don't knowingly collect personal information from them. Every new account is asked their age; we keep only whether they are 13 or older, never the age, and we don't ask for a birthdate. If someone answers with an age under 13, they can't continue: after one confirmation, the account and everything in it is deleted at once (a connected Gmail is disconnected at Google too). Two things are kept, each only under a scrambled code made from the email address with a secret key (the code can't be turned back into the address, and no age or birthday is ever kept): the daily allowance counts, which stop deleting and re-creating an account from resetting the limits and expire within about 2 days; and a note that this email address was used with an age under 13, kept for one year so that the same email address can't be used to create a new account, or be added to an existing one, in that time (see How long we keep it). That note is written only for an email address Google has confirmed: an age under 13 typed on the email-and-password sign-up form creates nothing and locks no address (anyone can type anyone's address there), only that browser. Until the browser is closed, that browser also can't answer the question again. If they leave without confirming, the account is deleted anyway, within about a day. If we learn in any other way that an account belongs to a child under 13, we will delete the account and its information. Copies in backups age out within about 90 days, as described above.
Parents. If you believe your child under 13 is using LabReach, or you are the parent or guardian of a student who uses it and want to review or delete their information, write to us (see Contact). We will take reasonable steps to confirm you are the student's parent or guardian before showing or deleting anything.
Teens. Most of our users are under 18, so we treat everyone that way: no ads of any kind, no selling or sharing for advertising, no precise location, no collecting information that a feature you are using doesn't need, and no designs meant to push you into sharing more. We encourage you to involve a parent; the parent view and update exist for that.
Removing what you posted (for users under 18). You can remove what you have written in LabReach: edit or clear your profile, resume and writing sample in Settings, delete notes and added replies on a professor's page, change drafts before you send them, or delete your whole account to remove everything, including your reading-check answers. Removal doesn't reach copies that already left LabReach (emails you sent are in the recipients' mailboxes and your own Sent folder), and backups age out as described above. You can also ask us to remove something for you.
Whatever state you live in, you can:
Asking us. You can also make any of these requests by writing to us. We answer within 45 days (if we need more time, up to 45 more days, we'll tell you why). To protect you, we confirm a request comes from the account holder, usually by having you make it while signed in or by replying from the account's email address. A parent or guardian, or someone you authorize in writing, may ask on your behalf.
Appeals. If we turn down a request, we'll say why. You can appeal by replying with “Appeal” in the subject; we'll answer within 45 days and explain the result. If you are still not satisfied, you may contact your state's attorney general.
LabReach is for users in the United States. Our database, files and backups are stored in the United States (our host's New Jersey region), and the backup copy kept by the person who runs LabReach is also in the United States. Some of the services listed in Who receives it may handle requests in other countries under their own terms.
If a security breach affects your personal information, we will tell you (and your parent, if you have given us their email address) as required by applicable state law and without unreasonable delay, saying what happened, what information was involved, what we have done, and what you can do.
LabReach's software can also be run privately by someone for themselves. In that case the person running it is its operator: the information stays wherever they run it, the hosting, backups and off-site copies described here don't apply, and the services in Who receives it are reached with that person's own accounts.
The date at the top says when this policy last changed and when that version took effect. If we make a significant change, such as collecting something new or sending information to a new kind of recipient, we will announce it in the app before it takes effect. We will not use information you already gave us in a significantly different way without your consent.
Aarush Gupta, an individual in New Jersey, United States
aarushgupta0821@gmail.com
Use this for privacy questions, requests to see, correct or delete information, parents' requests, professors' requests, and appeals.
See also the terms of use.