Back to home

Privacy Policy

Last updated July 10, 2026

This Privacy Policy explains how joey ELM (“joey,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use the joey electronic lab management platform (the “Service”). It should be read together with our Terms of Service. By using the Service, you agree to the practices described here.

joey ELM is the controller responsible for your personal information in connection with the Service. You can reach us at privacy@joeyelm.com or by post at 319 College Ave, Floor 2, Suite 1, Ithaca, NY 14850, United States.

  • Account information. When you sign up we collect your name, email address, and authentication data. If you sign in with Google, we receive basic profile information (such as your name, email, and account identifier) from Google. Passwords are handled by our authentication provider and are stored only in hashed form — we never see your plain- text password.
  • Your Content. The research records you create or upload — notebook entries, protocols, results, literature references, inventory and equipment records, tasks, images, and files — and the metadata associated with them (such as timestamps and the Lab or author a record belongs to).
  • AI interactions. The prompts you submit to AI features and the content from your workspace that is needed to answer them, along with the generated responses.
  • Lab information. The Labs you create or join, your role and position, and contact details you choose to add to your Lab profile (such as a phone number).
  • Usage and device data. Basic technical information generated when you use the Service, such as log data, IP address, browser and device type, and interactions needed to operate, secure, and debug the Service.
  • to provide, maintain, and operate the Service and your account;
  • to power the features you invoke, including AI assistance, literature search, digitization, and Lab-based sharing;
  • to secure the Service, prevent abuse, and troubleshoot problems;
  • to communicate with you about the Service, including confirmations, security alerts, and administrative messages;
  • to comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use Your Content to train our own machine-learning models or to serve third-party advertising.

Where the GDPR or UK GDPR applies, we process personal information on the following bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain, and improve the Service) balanced against your rights; your consent (where required, such as for optional features); and compliance with legal obligations.

When you use an AI feature, the relevant prompt and content are sent to our AI provider, Anthropic, to generate a response. We use these providers under agreements that restrict their use of your data to providing the service to us, and our AI provider does not use content submitted through its API to train its models by default. AI output is generated automatically and may be inaccurate; see our Terms of Service for important limitations.

When you use literature search, your search query is sent to public scholarly databases — OpenAlex and Semantic Scholar — to return results. Avoid including confidential or personal information in search queries.

  • Within your Lab. Content you choose to share is visible to other members and administrators of that Lab.
  • Service providers (sub-processors). We share information with vendors who process it on our behalf to run the Service:
    • Supabase — database, authentication, and file storage;
    • Vercel — application hosting and delivery;
    • Anthropic — AI processing for the assistant and digitizer;
    • Google — optional sign-in;
    • OpenAlex and Semantic Scholar — literature search results.
  • Legal and safety. We may disclose information if required by law or to protect the rights, safety, and security of joey, our users, or the public.
  • Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

Your information is stored in databases and object storage operated by our infrastructure providers. We apply access controls that scope data to its owner and Lab, encrypt data in transit, and take reasonable technical and organizational measures to protect it. No system is perfectly secure, however, and we cannot guarantee absolute security. You are responsible for keeping your credentials safe and for maintaining your own backups of critical data.

We retain your information for as long as your account is active or as needed to provide the Service. When you delete content or your account, we delete or de-identify the associated personal information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Residual copies may persist in backups for a limited time before being overwritten.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. If you are in the EEA/UK you may also lodge a complaint with your data- protection authority; if you are a California resident you have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. To exercise any right, contact us at privacy@joeyelm.com. You can also update your profile and delete content directly in the Service. We will verify your request and respond as required by applicable law.

We and our providers may process information in countries other than yours, including the United States, which may have different data-protection laws. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for such transfers.

We use strictly necessary cookies and local browser storage to keep you signed in, remember your preferences (such as theme), and secure the Service. We do not use advertising or cross- site tracking cookies. You can control cookies through your browser settings, though the Service may not function properly without the essential ones.

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated Policy with a new date and, where appropriate, notify you in the Service. Your continued use after the changes take effect constitutes acceptance.

For privacy questions or to exercise your rights, contact us at privacy@joeyelm.com, or by post at joey ELM, 319 College Ave, Floor 2, Suite 1, Ithaca, NY 14850, United States.