# Lab Rat Privacy Policy Source page: https://underthebehavior.com/labrat/privacy How the Lab Rat app and web game handle data: an anonymous ID, game backup, analytics, crash reports, ads and consent, purchases, and how to delete it. Effective 8 November 2026. Developer: Under the Behavior (Measify). Contact: [underbehavior@gmail.com](mailto:underbehavior@gmail.com) Lab Rat is a game made by Under the Behavior ("we", "us"). This policy explains what the Lab Rat app for iPhone and Android, its challenge links and the Lab Rat pages on this site collect, why, who else sees it, and what you can do about it. There is no account, no email and no sign up in the app. On this page 1. [Who we are](#who) 2. [What the app collects](#app-data) 3. [Ads, consent and tracking](#ads) 4. [Challenge links on the web](#links) 5. [Lab Rat on underthebehavior.com](#web) 6. [What we do not collect](#not) 7. [Why we use it](#use) 8. [Who else sees it](#third) 9. [How long we keep it](#keep) 10. [Delete your data](#delete-data) 11. [Your rights](#rights) 12. [Children](#children) 13. [Security](#security) 14. [Changes](#changes) 15. [Contact](#contact) ## Who we are Lab Rat is made by **Under the Behavior**, a brand of Measify, which publishes the app on the App Store and Google Play. Under the Behavior (Measify) decides how this data is used (the "controller" under data protection law). Questions or requests: [underbehavior@gmail.com](mailto:underbehavior@gmail.com). This policy covers: - the Lab Rat app for iPhone and Android, - the challenge and invite links the app shares: on this site (underthebehavior.com/labrat/r/, /d/, /i/, /v/ and /labrat/reply), and older links on Firebase (web.app), - the Lab Rat page and the free web game on this site (underthebehavior.com/labrat and /labrat/play/). ## What the app collects - **Anonymous ID.** The app signs you in with Firebase Anonymous Authentication. This makes a random ID that is not linked to your name, email or phone number. - **Game backup.** Through our Firebase Cloud Functions and Cloud Firestore, we keep a backup of your game progress (including your cheese balance and the store purchase IDs of cheese packs you bought, so each pack is added only once), your invite code, and the challenges and replies you send or receive, all under that anonymous ID. - **Display name (optional).** If you type a name to show on challenges, it is stored with the challenge links and replies you make. Leave it empty and nothing is stored. You do not have to use your real name. - **Invites.** When a friend installs through your invite link and finishes a first scored run, we record that against both anonymous IDs so the reward goes to the right player and is not paid twice. - **Install link (Android).** On Android, the app reads the Google Play Install Referrer once after install, so a challenge or invite link you tapped before installing still opens. On iPhone, the app reads a link from your clipboard only when you tap Paste on the "Got a link from a friend?" screen. - **Usage and device information.** Firebase Analytics records app events (for example which screens you open and how runs go), basic device and app details (device model, operating system and app version, language) and your approximate region from your IP address. - **Crash reports.** Firebase Crashlytics collects crash logs and technical details so we can fix bugs. - **Game settings from our servers.** Firebase Remote Config lets us switch features on or off without an update. It uses a Firebase installation ID. - **Purchases.** Lab Pass, Full Lab Forever and cheese packs are bought through the App Store or Google Play. Adapty checks those purchases for us: it receives your store purchase receipts and purchase history and keeps them in an Adapty profile linked to your anonymous ID, so the app knows what you bought and adds bought cheese once. Payment is handled by Apple or Google. We never see your card or payment details. - **Ads.** The app offers optional rewarded ads through Google AdMob, with Google's consent tool where it is required. See the next section. - **Notifications.** If you allow notifications, the app schedules its reminders on your own device (at most one a week). The app also includes Firebase Cloud Messaging, which gives the device a push token. We do not store that token or use it for marketing. ## Ads, consent and tracking Ads in Lab Rat are optional: you choose to watch one for a reward, such as extra tickets or keeping a run going after a crash. There are no ads you have to sit through, and Lab Pass holders see none. Ads are served by Google AdMob, and every ad request asks for non personalized ads only, with a content limit suitable for a general audience. AdMob may still use your IP address, device information and, where your platform and consent allow, your advertising ID to deliver ads, limit how often you see them, measure them and prevent fraud. If you are in the European Economic Area or the United Kingdom, or anywhere else Google's consent rules apply, the app shows Google's consent form (Google User Messaging Platform) and does not start the ad service until you have made your choice. You can change your choice later under Privacy choices in Settings. The app does not track you across other companies' apps and websites, so it does not show Apple's App Tracking Transparency prompt and does not ask for the iPhone advertising identifier. On iPhone, ad networks may use Apple's SKAdNetwork, which counts installs from ads without identifying you. ## Challenge links on the web When you open a Lab Rat challenge, daily, video, invite or reply link in a browser without the app, the page runs one game in your browser and shows where to get the app. These pages never ask for an account or email. **Links on this site** (underthebehavior.com/labrat/r/, /d/, /i/, /v/ and /labrat/reply) use our own anonymous play counts, not Google Analytics: link opens, runs started and finished with their score, how long until the first tap, and taps on the store and "open in browser" buttons. They work exactly like the counts in the web game, with the same opt outs (Do Not Track, Global Privacy Control and "Don't count my visit"), as described in "Lab Rat on underthebehavior.com" below. **Older links on Firebase (web.app)** still work. Those pages use Google Analytics (GA4) to count visits and button taps. In the EEA, the UK and Switzerland, analytics storage is off by default and no analytics cookies are set. Elsewhere, analytics storage is on. Advertising storage is always off on those pages. ## Lab Rat on underthebehavior.com This section covers the Lab Rat pages: underthebehavior.com/labrat, the web game at underthebehavior.com/labrat/play/, and the challenge and invite link pages under underthebehavior.com/labrat (/labrat/r/, /d/, /i/, /v/ and /labrat/reply). ### The launch list If you join the Lab Rat launch list, we keep your email address, the store you picked (App Store or Google Play), the button you used, the plan you were looking at if there was one, the country your visit came from as Cloudflare reports it, and the time you joined. We never store your IP address. We use it for one thing: to email you when Lab Rat is published, with a link to download it. We never sell it, give it to anyone else or use it for ads, and every email has an unsubscribe link. The list is stored in a Cloudflare D1 database in our own Cloudflare account. We delete it 12 months after Lab Rat launches, or sooner if you ask. To keep bots off the list, the form uses Cloudflare Turnstile, which checks your browser when you open it, and we count sign ups per network for an hour. That count uses a scrambled code made from your IP address with a key that changes every day, never the address itself, and it is deleted the next day. ### Play counts The Lab Rat pages count how they are used, so we can see how many people play, how long they stay and whether they come back. Your browser keeps a random ID in its local storage (not a cookie), plus a second one that lasts while the tab is open. With them we count things like screens and links opened, runs started and finished with their score and length, the effect that ended a run, taps on the share, store and buy buttons, the country your visit came from and whether you are on a phone or a computer. We also note the website, campaign link or app (for example Instagram or TikTok) that sent you; when you come from an app's own browser, we keep only the app's name, not the rest of what your browser says about itself. No IP address and no name are stored. If you join the launch list, the count notes that this ID joined, but your email stays on the list only. Play counts are stored in the same Cloudflare D1 database and deleted after 13 months. Nothing is counted when your browser sends Do Not Track or Global Privacy Control. You can also switch it off for this browser: [Don't count my visit](#web) ### Deletion To leave the list, use the unsubscribe link in any email, or email underbehavior@gmail.com from the address you joined with and we will delete it. To have your play counts deleted, email us your Lab Rat ID: none in this browser. ## What we do not collect - No name, email address or phone number in the app (unless you type a display name). - No contacts, camera, microphone or photos. - No precise location. Analytics only sees an approximate region. - No sale of your data, and no advertising profiles of our own. ## Why we use it We use this data to run the game and keep your progress, deliver challenges and invite rewards, stop cheating, give you what you bought, show the ads you chose to watch, fix crashes and learn which parts of the game work. Where data protection law (such as the GDPR or UK GDPR) asks for a legal basis, we rely on: providing the game you asked for (progress, challenges, purchases); our legitimate interests (analytics, crash reports, preventing abuse of invites); your consent where the law requires it (ad consent in the EEA and the UK, notifications, the web launch list); and legal duties (for example tax records kept by the stores). ## Who else sees it These providers process data for us under their own terms and privacy policies: - **Google**: Firebase Authentication, Cloud Firestore, Cloud Functions, Hosting, Analytics, Crashlytics, Remote Config and Cloud Messaging; AdMob; User Messaging Platform; Google Analytics on the older challenge links on Firebase (web.app). [policies.google.com/privacy](https://policies.google.com/privacy), [firebase.google.com/support/privacy](https://firebase.google.com/support/privacy), and how Google uses data from apps that use its services: [policies.google.com/technologies/partner-sites](https://policies.google.com/technologies/partner-sites). - **Adapty** (checks purchases and keeps purchase history): [adapty.io/privacy-policy](https://adapty.io/privacy-policy/). - **Apple** (App Store downloads, purchases and payment): [apple.com/legal/privacy](https://www.apple.com/legal/privacy/). - **Google Play** (downloads, purchases and payment, Install Referrer): [policies.google.com/privacy](https://policies.google.com/privacy). - **Cloudflare** (hosting of underthebehavior.com, the launch list and play counts, Turnstile): [cloudflare.com/privacypolicy](https://www.cloudflare.com/privacypolicy/). We may also disclose information if the law requires it, or to protect players and the game from fraud or abuse. Our providers may process data in the United States and other countries, under the safeguards their own terms describe. ## How long we keep it - Data on your device is removed when you uninstall the app. - Your cloud backup, invite code and challenge replies stay under your anonymous ID until you ask us to delete them, or until they have been inactive for a long time. - Purchase records stay with Apple or Google under their own rules, and Adapty keeps your purchase history for as long as we use it to check purchases. - Analytics data is kept by Google for the retention period set in our Firebase settings. Crash reports are kept by Crashlytics for about 90 days. - The web launch list is deleted 12 months after Lab Rat launches, and web play counts after 13 months (see above). ## Delete your data There is no account to close. You can clear your game yourself in the app, and ask us by email to delete everything we hold under your anonymous ID. ### In the app 1. Open Settings and tap **Reset progress**, then **Reset**. Your cards, cheese, lab, streak and missions go back to zero on this phone, the cloud backup is replaced with the empty game, and you get a new invite code. This also deletes cheese you bought, and it cannot be undone. 2. Uninstall the app to remove everything stored on the phone. 3. To change ad consent, use **Privacy choices** in Settings (shown where consent is needed, such as the EEA and the UK). To reset or delete your advertising ID, use your device settings. ### By email 1. Before you reset or uninstall, note your invite code (shown in the app where you invite friends). It is how we find your anonymous ID, because we hold no name or email for you. 2. Email [underbehavior@gmail.com](mailto:underbehavior@gmail.com) with the subject "Delete my Lab Rat data" and your invite code. You can use the Contact row in the app's Settings. 3. We delete your cloud backup, your invite codes, your invite records, and the challenge replies and display names stored under your anonymous ID. Analytics and crash data are not linked to your invite code; they expire on the schedule in "How long we keep it". 4. We do this within 30 days and reply to confirm. What stays: challenge links you already sent are links in other people's messages, and a name typed into one is part of that link. Purchases and their receipts stay with Apple or Google, and deleting your data does not cancel a Lab Pass (manage that in your App Store or Google Play account) or refund cheese you bought. For the launch list or web play counts on this site, use the unsubscribe link in any launch email, or the deletion steps in the "Lab Rat on underthebehavior.com" section above. ## Your rights **EEA, UK and Switzerland.** You can ask for access to your data, a copy of it, correction, deletion, or restriction of its use, object to how we use it, and withdraw consent at any time. You can also complain to your local data protection authority. **California and other US states.** You can ask what personal information we hold about you, and ask us to correct or delete it. We do not sell personal information, and we do not pass it to others for cross context behavioral advertising. We will not treat you differently for using these rights. To use any of these rights, email [underbehavior@gmail.com](mailto:underbehavior@gmail.com). We answer within 30 days (45 days where California law allows). ## Children Lab Rat is not directed to children under 13, or the higher age of digital consent in your country. On Google Play it is listed for ages 13 and up. We do not knowingly collect personal data from children. If you think a child has given us data, email [underbehavior@gmail.com](mailto:underbehavior@gmail.com) and we will delete it. ## Security Data is sent over encrypted connections and stored with Google Cloud and Cloudflare. Players never touch the database directly; every request goes through our server code. No system is perfectly secure, but we collect little, so there is little to lose. ## Changes If we change this policy, we update the date at the top. For bigger changes we will also tell you in the app. ## Contact Under the Behavior, [underbehavior@gmail.com](mailto:underbehavior@gmail.com) See also the [Lab Rat Terms of Service](https://underthebehavior.com/labrat/terms). [Lab Rat Privacy Policy](https://underthebehavior.com/labrat/privacy) · [Lab Rat Terms of Service](https://underthebehavior.com/labrat/terms) · [Lab Rat](https://underthebehavior.com/labrat) · [All legal pages](https://underthebehavior.com/legal/)