Privacy Policy

What personal data critlab handles, why, for how long, who else touches it, and the cookies and browser storage it uses.

Version 2026-11-10 · Effective November 10, 2026

Draft · pending legal review

This policy explains what personal data critlab handles, why, for how long, who else touches it, and what you can do about it. It also lists every cookie and browser-storage entry critlab uses.

Who is responsible

critlab splits the responsibility in two, because it plays two roles.

We are the controller for the data we need to run critlab itself: your account, sign-in and security records, billing contact details, the way the product is used, and the errors it hits. The controller is Supermode d.o.o., Podrebar 3B, 10431 Bestovje, Croatia. Privacy contact: support@critlab.app. Our full details are in the Imprint.

We are the processor for everything inside a workspace: prototypes, comments, replies, voice notes, screenshots, page snapshots, and the names that reviewers give. The workspace that holds it is the controller and decides what is collected and why. That includes comments left by reviewers who have no account. We handle this data only on that workspace's instructions, under the data processing agreement. If you are a reviewer and want to see, correct or delete something you wrote, ask the workspace that shared the prototype with you, or write to us and we will pass it on and help.

We have not appointed a data protection officer. We assessed whether one is required under Article 37 of the GDPR and concluded it is not at this stage. The privacy contact above is the person to write to. The supervisory authority is the Croatian Personal Data Protection Agency (AZOP), and you may complain to it or to the authority where you live.

What we collect and why

What	Examples	Why	Legal basis
Account	Name, email address, profile picture from Google or Microsoft if you use them, the workspaces you belong to and your role	To create your account and run the service for you	Contract
Sign-in and sessions	Emailed one-time codes (stored only as a hash, valid for 10 minutes), session records with the IP address and browser details, how you signed in	To let you in and keep your account safe	Contract; legitimate interest in security
Security and audit records	Who did what in a workspace, when, from which IP address and browser	To keep workspaces accountable and investigate abuse	Legitimate interest in security; contract
Billing	Plan, subscription status, billing contact. Card details go to Paddle, never to us. Nothing is billed during the free beta	To sell and administer paid plans	Contract; legal obligation
Emails	Your address and the message. Notification emails can quote up to 300 characters of a comment	To send sign-in codes, invitations and the notifications you have not turned off	Contract; legitimate interest
Newsletter (only if you subscribe)	Your email address, and whether and when you confirmed or unsubscribed	To send you critlab news you asked for	Consent, which you can withdraw at any time
Product use	An event name, the time, the workspace id and an opaque user id (or, for an action taken through an API key, that key's id) for about ten actions such as publishing a prototype or resolving a comment	To learn what works and fix what does not	Legitimate interest
Errors	The kind of error, where in the code, which page, which software release and an opaque user id	To find and fix faults	Legitimate interest
Workspace content	What a workspace puts into critlab, listed next	To provide the service to that workspace	Set by the workspace (we are the processor)

Workspace content

Prototypes: the files a workspace uploads, and thumbnails we render from them.
Comments: text, replies, reactions, images attached to a comment, the people a comment mentions, which comments you have read, the element a comment points at, and the page, version and screen size it was left on.
Voice notes: the recording. On critlab's hosted service voice notes are not transcribed, and no recording is sent to a transcription service.
Screenshots and snapshots: the first comment on a thread carries a screenshot, a crop of the element and a snapshot of the page structure, with the browser, operating system, window size and pixel density, so the person fixing it can see what the reviewer saw.
Folder context: the links a workspace attaches to a folder (we may fetch a linked page's title, see below), and the documents it uploads there. For documents, that is the PDF and Markdown files, every version of each, and the text we read out of them so the workspace can search them and its own coding agents can read them. They are visible to the workspace's members and to guests it lets see context, never to reviewers without an account.
Reviewers: an optional display name, and a random id kept in the reviewer's own browser that ties their comments together without an account.
Live presence: who is viewing a prototype and where their cursor is, shared between the people viewing it while they are there. It is not stored.

What we do not do

We do not sell personal data and we do not show advertising. We do not use workspace content to train AI models, and critlab does not send workspace content to any AI model provider or transcription service. We never identify reviewers in our own product analytics or error reports: there are no viewer-side analytics events, no reviewer id and no IP address in them. We do not put analytics, advertising or error-reporting code on the sandbox where prototypes run, inside prototypes, or in the staging snippet.

Product analytics and error reporting

Product analytics are first-party: a small, fixed set of events about how members and their agents use critlab, such as a prototype being published or a comment resolved, recorded on our own servers with an opaque user id (or, for an action taken through an API key, that key's id) and the workspace id, and no content. They do not involve reviewers at all (no viewer-side events, no reviewer id, no IP address) and they set no cookies. We keep the raw events for 13 months, then only daily totals that name no one. If you delete your account, your user id is removed from your events; if a workspace is deleted, its id is removed from them. We rely on our legitimate interest in understanding how critlab is used, and there will be no in-product opt-out at first. You can object to this processing at any time by writing to support@critlab.app. We will then stop using your data for product analytics, unless we have compelling legitimate grounds that override your interests, rights and freedoms.

Error reporting uses Sentry, in its EU region, through a connection that runs via critlab's own servers. It covers critlab's own application pages, including the viewer's own code, and critlab's own servers (the web application, the sandbox service and the realtime service). It never runs inside a prototype, in a page the sandbox serves or in the staging snippet. A report carries the type of error, where in the code it happened, the page route, the software release, the browser and operating system name and version and, for a signed-in member using the application's own pages, an opaque user id. It never carries message text, page content, screenshots, comment text or IP addresses, and a report from the viewer, from a reviewer or from a server carries no name or id at all. Sentry is listed on the subprocessors page.

Public pages. The landing page, pricing, docs, legal pages and the newsletter page set no cookies and load nothing from other companies. We may count visits to them on our own servers, by page, referring site and day, with no identifier.

If you sign up on the newsletter page, or on the "Coming soon" page that stands in for sign-in while critlab is not open yet, we use your email address to send you critlab news. We rely on your consent. Signing up is a double opt-in: we first email you a link to confirm, and we add you to the list only when you open it. The link works for 24 hours. If you never open it we do not add you to the list; our email provider keeps the delivery record of that one email, as it does for every email critlab sends. We do not use your address for anything else.

Every newsletter has a link to unsubscribe, and you can also write to support@critlab.app. We keep your address on the list until you unsubscribe. After that we keep only the address and the fact that you unsubscribed, so that we do not write to you again; ask us and we will delete that as well. The list and the emails are handled by Resend. While critlab's public website is a preview on Cloudflare Pages, the sign-up form itself runs on Cloudflare, which receives your email address and your IP address; our code there uses the IP address only to limit abuse and stores neither. Both are listed on the subprocessors page.

Cookies and browser storage

critlab uses only essential cookies: the ones needed to sign you in and to remember your settings. There is no advertising, analytics or other tracking cookie, and no cookie from another company. The sandbox where uploaded prototypes run sets no cookie at all. We do not show a cookie banner because there is nothing to consent to. If we ever add something that is not essential, we will ask first.

Everything critlab stores in your browser is listed here. If you clear site data, critlab forgets these settings and, for a reviewer, the random id and the name they chose.

Cookies and browser storage critlab sets
Name	What it is for	Set when, kept for
`better-auth.session_token`Cookie	Keeps you signed in (HttpOnly, SameSite=Lax; carries a __Secure- prefix over HTTPS).	When you sign in. 7 days from your last activity; each active day pushes it forward.
`better-auth.state`Cookie	Protects a sign-in through Google or Microsoft against forged requests (HttpOnly, signed; carries a __Secure- prefix over HTTPS).	Only while you sign in with Google or Microsoft. 5 minutes.
`better-auth.relay_state`Cookie	Protects a sign-in through your company's single sign-on (SAML) against forged requests (HttpOnly, signed; carries a __Secure- prefix over HTTPS).	Only while you sign in with your company's single sign-on. 5 minutes.
`critlab_ws`Cookie	Remembers which of your workspaces you are working in (HttpOnly). It never grants access by itself.	When you switch workspace or accept an invitation. 1 year.
`critlab_sidebar`Cookie	Remembers whether the sidebar is collapsed, so the page loads in the right shape.	When you collapse or expand the sidebar. 1 year.
`critlab-browser-prefs`Cookie	Remembers your prototype list view: status filter, sort order and grid or list.	When you change one of those on the dashboard. 1 year.
`critlab_sso_grace`Cookie	Lets a workspace owner finish fixing single sign-on settings right after turning enforcement on (HttpOnly, signed).	Only when an owner turns single sign-on enforcement on. 10 minutes by default.
`critlab_unlock_<prototype id>`Cookie	Remembers that you entered the right password for one password-protected prototype (HttpOnly, signed). No account involved.	When a reviewer unlocks a password-protected prototype. 7 days.
`critlab:dashboard-sidebar:v1`Local storage	Whether the sidebar is collapsed.	When you collapse or expand the sidebar. Until you clear site data.
`critlab:dashboard-sidebar:starred-expanded:v1`Local storage	Whether the Starred list in the sidebar is open.	When you open or close it. Until you clear site data.
`critlab:dashboard-browser:v2`Local storage	Your prototype list view: status filter, sort order and grid or list.	When you change one of those on the dashboard. Until you clear site data.
`critlab:folder-sort:v1`Local storage	How you sort folders.	When you change the folder sort. Until you clear site data.
`critlab:reviewer-id:<prototype id>`Local storage	A random id, one per prototype and browser, so your comments, reactions and read marks stay yours without an account. It is not your name and is never shared across prototypes.	The first time you open a prototype's viewer. Until you clear site data.
`critlab:authorName`Local storage	The name you chose to comment under, so you are not asked again.	When you enter a name with a comment. Until you clear site data.
`critlab:name-asked`Local storage	That this browser has been offered the optional name field.	After your first comment. Until you clear site data.
`critlab:lastMode`Local storage	Whether you last left the viewer in browse or comment mode.	When you switch mode. Until you clear site data.
`critlab:comments-panel-collapsed`Local storage	Whether the comments panel is collapsed.	When you collapse or expand it. Until you clear site data.
`critlab:comment-hint-seen`Local storage	That you have seen the first-time hint about commenting.	When the hint is dismissed. Until you clear site data.
`critlab:presentation:stream-notice-seen`Local storage	That you have seen the notice about streaming in a presentation.	When the notice is dismissed. Until you clear site data.
`critlab.inspect.checkoutRoot.<prototype id>`Local storage	The folder on your computer that holds this prototype's code, as you typed it in the Inspect tab (View code, in the viewer), so Open in VS Code and Open in Cursor can open the right file. A folder path can contain your computer's user name. It stays in this browser: critlab uses it only to build the editor link on your own screen and never sends it anywhere.	When you enter a local checkout folder in the Inspect tab for a prototype. Only people who may see that prototype's code have the tab. Until you clear the folder in the Inspect tab or clear site data.
`critlab:viewer-arrival:<path>`Session storage	Whether you reached the viewer from inside critlab, so the back arrow only shows when it leads somewhere useful.	When the viewer opens. Until you close the tab.
`critlab:terms-update-later:v1`Session storage	That you chose Later on the notice about an updated Terms of Service or Privacy Policy, so it does not come back during this browser session. It holds only which documents and versions the notice was about.	When you choose Later on that notice. Until you close the tab.
`critlab:canvasHintDismissed`Session storage	That you have already panned or zoomed the canvas view, so its first-time hint (how to pan, zoom and open a screen) does not come back.	The first time you pan or zoom the canvas view of a prototype. Until you close the tab.

If a workspace installs the critlab staging snippet on its own site, the snippet writes the author name, the reviewer id and the viewer settings above into that site's own browser storage. That workspace controls the site and tells its own visitors about it.

Who receives data

People in the workspace. Members see what their role allows, and anyone with a share link sees that prototype and its comments.
Subprocessors. The companies that help us run critlab are listed, with what each does, on the subprocessors page. We tell workspace owners 30 days before a new one starts.
Services a workspace connects. If a workspace connects Slack or a coding agent, the data it chooses to send goes there. We are not responsible for those services.
Authorities, when a law or a valid order requires it. We tell the people affected where we may.

Links pasted into comments: our servers may fetch the page to show its title. That page's owner sees a request from critlab's servers, not from you. We keep what we fetch for 7 days.

Transfers outside the EEA

Some of the companies that help us are based in the United States, run their services from there, or belong to a US company: Cloudflare, Inc. (storage, backups and, while it is a preview, the public website), Resend, Inc. (email), Functional Software, Inc. (Sentry, error reporting, which keeps the reports in its EU region) and, only if you sign in with them, Google LLC and Microsoft Corporation. Where personal data goes outside the European Economic Area, it is protected by the EU–US Data Privacy Framework where the recipient is certified, or otherwise by the European Commission's standard contractual clauses. Ask us at support@critlab.app for a copy of the safeguards that apply. The data processing agreement covers this for workspace content.

How long we keep data

These are the periods we commit to.

Data	How long
Account	Until you delete your account, in Settings or by asking us. Deleting it is immediate; backup copies disappear within 30 days
Workspace content (prototypes, comments, folder context and its documents, files)	Until the workspace deletes it. A replaced document keeps its earlier versions until the document itself is removed. A deletion is permanent: the content stops being available at once, stored files are cleaned up shortly after, and backup copies disappear within 30 days
Comments of a deleted account, with the voice notes, screenshots and images attached to them	Kept in the workspace, with the author's name removed
Sessions (IP address and browser details)	30 days after the session ends (it expires; signing out deletes it at once)
Audit records	13 months (calendar months)
Product analytics events	13 months, then daily totals only
Error reports	Sentry's default retention
Fetched link titles	7 days (6 hours for a failed fetch)
Read marks of a reviewer without an account (which comment threads they have read, kept on our servers under the random id in their browser; no account, no IP address)	180 days after they were last used. Reading again keeps them
Newsletter list	Until you unsubscribe; then only the address and the fact that you unsubscribed
Billing records	As long as accounting and tax law requires

Your rights

You can ask us for access to your personal data, to correct it, to erase it, to restrict how we use it, to receive it in a portable form, and to object to processing based on our legitimate interest. Where we rely on your consent you can withdraw it.

The two most common requests you can do yourself, at once, in Settings → Account → Profile:

Export your data. You get a ZIP with a JSON file of everything we hold about you (your profile, workspaces, the comments you wrote, what you uploaded, the names of your API keys, your sessions, notifications and settings, the audit entries about what you did, and the product analytics events recorded under your user id or your API keys) plus your own voice notes, screenshots and uploaded files. A file larger than 25 MiB, a prototype version larger than 50 MiB, and anything past 150 MiB in all are left out of the ZIP and named in its file list instead; write to support@critlab.app and we will send those another way. It never contains a password, a session token, an API key or anything of another person's. If you work with a coding agent, crit account export and the critlab_export_my_data tool give it the same file.
Delete your account. A workspace of which you are the only member is deleted with you. If you are the only owner of a workspace that has other people in it, hand it to someone else first (or remove them): the page tells you which workspaces are in the way. The comments you wrote in workspaces you leave stay, shown as “Deleted user”, because they belong to the workspace (see above). We remove the details stored with them that describe you or your device (the full browser identification string, your language, time zone and device model) and keep what the bug report needs: the browser and operating system with their versions, the window and screen size, and display settings such as zoom and colour scheme. In audit records we keep what happened but replace your name, email address, IP address and browser with a pseudonym. We delete your sessions, API keys, invitations, stars, read state, notifications and reactions, and email you once to say it is done. Only a person in a signed-in browser can delete an account: an API key cannot.

For anything else, or if you cannot use the settings page, write to support@critlab.app; we answer within 30 days.

Security

critlab runs prototypes in an isolated sandbox, signs you in without passwords, checks access on the server for every request, and limits what its servers will reach out to. The security overview describes how, without overstating it.

Children

critlab is a professional service and is not meant for anyone under 16.

Changes to this policy

When we change this policy in a way that matters, we update the version and date at the top and tell account holders before it takes effect. Smaller corrections just update the page.

Contact

support@critlab.app · Supermode d.o.o., Podrebar 3B, 10431 Bestovje, Croatia.