Privacy notice: signing in
Effective 12 October 2026. Applies to this sign-in and every Progression Labs service that uses it.
Who is responsible
Progression Labs is the controller. Contact Jon Duffy with any question or request.
What we collect, and why
- When you sign in: your name, email address, profile picture and Google account ID, from Google. We use them to check that you have a Progression Labs account and to show who is signed in.
- Your session: an encrypted cookie in your browser. It ends at most 8 hours after you sign in.
- A security record: each sign-in, and each refused attempt, with the Google account ID, the time and the reason for a refusal. No names or email addresses. We keep it so we can investigate misuse of our systems.
- Technical logs: errors and timings, with no names or email addresses.
The legal basis is our legitimate interest in giving staff access to our services and keeping them secure.
How long we keep it
- Session cookie: at most 8 hours.
- Technical logs: 30 days.
- Security record: 3 years, in a separate account that people working on the tools cannot change.
Who can see it
- You, for your own session.
- Security auditors, for the security record.
- The people who build a tool, for its technical logs.
We use Amazon Web Services (hosting, in London) and Google (sign-in) to process it on our behalf. We do not sell it or use it for anything else.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or object to how we use it. We may keep the security record for its full 3 years where we need it to protect our systems. You can also complain to the Information Commissioner's Office (ico.org.uk).