Privacy Policy

Labvoya ("we," "us," or "our") helps university students discover research labs and apply to research positions, and helps labs review applicants. It is currently available to students and faculty with a @ufl.edu email address. Labvoya is an independent platform and is not part of, affiliated with, or acting on behalf of the University of Florida.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your choices. By creating an account or using Labvoya, you agree to the practices described here.

Account information

• Name, university email address, and password (hashed with bcrypt - never stored in plain text)
• Role: student, professor, or admin
• Profile details you choose to add: major, graduation year, GPA (optional and hidden by default), bio, skills, interests
• Social links (LinkedIn, GitHub, portfolio) and a LinkedIn data import - only if you provide them
• Profile photo - only if you upload one
• Resume - only if you upload one (private; shared only with labs you apply to)
• Username - optional, publicly visible as part of your profile URL
• Lab roles and lab claims, including information you provide to support a claim

Application data

• Applications you submit: answers to questions, uploaded files, and text extracted from your resume
• Application status history - every status change is logged with a timestamp
• Application materials are visible only to the people who manage that position: the poster and the lab's managers
• AI screening data - only when a poster has turned on AI screening for a post. You are shown a notice before you apply. See Section 11.

Security and technical data

• IP address and browser user-agent (for rate limiting, account security, and session management)
• Records of significant actions (audit logs): posting, applying, sign-ins, username changes
• Profile view counts (you can turn profile-view tracking off in Settings)
• Error reports and performance traces (via Sentry) so we can find and fix bugs. We do not record sessions or screen activity.

Find your fit (optional quiz)

• If you take the Find your fit quiz, we save your answers: up to three interests you type in your own words, the research areas you pick, how you like to work (for example at a bench, outdoors, or on a computer), whether you would work with animals or people, your coding experience, the time you could give a lab, and the courses or experience you list.
• If you say it's OK, the quiz can also read your resume (the one on your profile, or a file you upload just for the quiz) to fill in quiz answers for you to check (such as research areas from your major, interests you list, and your skills and courses) and to find skills and topics that sharpen your matches. It is read by code on our servers. We keep only the short list of skills and topic words it finds, with your answers, and a file you upload just for the quiz is not stored.
• We also record which labs we suggested to you, in what order and with what score, and whether you opened a suggested lab or its tips for reaching out. We use this only to improve how Labvoya suggests labs.
• Your answers are private. Labs and other users cannot see them. We never contact a lab for you.
• You can clear your answers and suggestion history at any time from the quiz results page.

Saved posts

• When you save an opportunity, we store a private link between your account and that post. Other users cannot see your saved list, and you can unsave at any time.

My labs (research tracker)

• If you save a lab, we store it in your private "My labs" list with the status you set (for example emailed or replied), the dates you emailed and heard back, your notes, and any outreach email outline you write on Labvoya.
• You write your own emails and send them from your own email account. We do not send them for you and do not read your mailbox.
• Your list is private. Labs and other users cannot see it. We use the dates you enter to remind you to follow up, and may use them, combined and without names, to show students how long labs usually take to reply.

Courses and research experience

• You can list courses you have taken and research experience you have had (the lab, your role, the dates and a short description) on your profile. You can fill in courses from your resume; this is done by code on our servers, not by an AI model.
• If you mark a research experience as "open to questions", your name, photo, major, class year and that entry appear on that lab's page to signed-in users, with a button to message you. Turn it off at any time. Entries are self-reported, and a lab can hide an entry from its page.

Communications

• Messages and attachments you send to other users through Labvoya
• Notifications we generate (for example, application updates)
• Emails we send you: verification codes, application status updates, and the weekly digest if you leave it on

Payment data

• Labvoya is currently free. If paid features are introduced, payments will be processed by Stripe; we never store card numbers.

To help students find labs, Labvoya builds lab profiles from publicly available information, including for researchers who do not have a Labvoya account:

• Faculty names, departments, and university email addresses from the public university directory
• Faculty-submitted research abstracts from published undergraduate research symposium books, which we summarize in plain language (with AI assistance and human review) and link back to the source
• Public faculty profile photos, credited on the page
• Public lab websites
• Titles and links of researchers' recent published papers from public scholarly databases (such as OpenAlex), each with a one-line plain-language summary written with AI assistance from the paper's public abstract or the lab's own pages
• Descriptions of what the work involves (for example the organisms studied, whether the work is in a lab, outdoors or on a computer, and whether coding is needed), drawn from those abstracts with AI assistance. A lab can correct these at any time.

We do not store student presenter names from abstract books. A lab profile does not mean a lab is recruiting unless it shows an open position.

Lab profile pages can be viewed without an account. A researcher's email address is shown only to signed-in users, never on the public page.

Once a semester we may email a lab's lead researcher at their public university address to ask one question: whether the lab is taking undergraduate researchers that term. Their answer is shown on the lab's page for that term only, and one click in the email stops these emails.

Researchers can claim, correct, or hide their lab profile - no account needed. Email hello@labvoya.com from your university address.

• To run Labvoya: accounts, lab profiles, matching students with labs, delivering applications, messaging, and notifications
• To email a lab's members when a student applies to one of its posted positions, so they can answer from their inbox (they can turn these emails off in Settings)
• To remind you to follow up with labs you emailed, if you track them in My labs
• To suggest labs that fit your Find your fit answers, and to improve those suggestions over time
• To verify accounts (email codes and professor verification)
• To provide AI-assisted features described in Section 11
• To keep Labvoya secure: rate limiting, fraud and abuse prevention, moderation of reported content
• To send service emails, and the weekly digest if you leave it on (turn it off in Settings or with the unsubscribe link)
• To fix bugs and improve reliability
• To comply with legal obligations

We do not sell personal data or use it for advertising.

We share data only as needed to run Labvoya:

• Other signed-in users - your public profile (name, major, skills, bio). Your email is never shown publicly.
• Labs you apply to - your application and profile, seen by the poster and the lab's managers.
• Service providers who process data on our behalf:
  • Vercel - hosting, file storage, and scheduled jobs (United States)
  • Neon - database (United States)
  • Groq - AI processing (see Section 11). Per Groq's published policies, API data is not used to train models.
  • Resend - sending email
  • ImprovMX - receiving email sent to @labvoya.com addresses (and the former @joinlattice.app addresses)
  • Upstash - rate limiting
  • Sentry - error monitoring (personal data is scrubbed from error reports)
  • Google - only if you choose "Sign in with Google"
  • Stripe - payments, only if paid features are introduced
• Legal requirements - only when required by law or court order, and only to the extent required.
• Business transfers - a successor in a merger or acquisition, bound by this policy.

• GPA - hidden by default; you choose whether to show it.
• Public profile URL - your /u/username profile is visible without login only if you set a username.
• Resume - never public. Shared only with labs you apply to.
• Profile views - you can turn profile-view tracking off in Settings.
• Research experience - shown on your profile; shown on a lab's page to signed-in users only if you mark it "open to questions".
• My labs - always private to you.

• Deleting your account is immediate and permanent. Your profile, applications, messages, saved posts, and uploaded files (photo, resume, application files, and message attachments) are deleted right away. Copies may remain in encrypted database backups for a short period until they roll off.
• Material you already sent to a lab may remain in that lab's own records outside Labvoya.
• While your account exists, we keep your data until you delete it or the related post is deleted.
• Audit logs are kept for 12 months, then deleted automatically.
• Find your fit answers are kept until you retake the quiz, clear them, or delete your account. The record of which labs we suggested and which you opened is deleted automatically after 12 months.
• Your My labs list, courses and research experience are kept until you remove them or delete your account.
• Session records are deleted automatically 30 days after their last activity.
• Researcher information from public sources is kept while the lab profile is published, or until it is hidden or removed on request.

• Passwords are hashed using bcrypt (cost factor 12) - we cannot see your password
• All data in transit is encrypted (HTTPS)
• Password sign-in also requires a one-time code sent to your email (two-factor authentication)
• Resumes and application files are stored privately and opened only through short-lived links after a permission check
• Rate limiting protects sign-in, registration, and other sensitive actions
• Uploads are checked by file type and size

No system is perfectly secure. If a security incident affects your data, we will notify you as required by law. To report a vulnerability, email hello@labvoya.com.

• Access and export - download your profile, applications, posts, saved posts, My labs list, research experience, and Find your fit answers from Settings > Security > Export data
• Correction - most fields are editable in your profile, and you can retake or clear the Find your fit quiz
• Deletion - delete your account from Settings > Security
• Email preferences - turn the digest off in Settings or via the unsubscribe link
• Researchers without an account - ask us to correct or hide your lab profile (Section 3)

For anything else, email hello@labvoya.com. We respond within 30 days.

• Session cookie - keeps you signed in. HttpOnly, Secure, SameSite=Lax. Expires after 7 days or on sign-out.
• Security cookies - CSRF protection and the page to return to after sign-in.
• lattice-brand - remembers the site theme.
• Local storage (stays on your device) - light/dark mode, accessibility settings, and which notices you have dismissed.

We do not use advertising cookies, tracking pixels, or session recording. See the Cookie Policy for details.

Labvoya uses AI models hosted by Groq for the features below. AI output can be wrong.

AI applicant screening (opt-in per post)

• Off by default. Only the poster can turn it on for a post, and you see a notice before you apply.
• What is sent: your written answers, text extracted from your resume (up to 20,000 characters), your major and skills, and your GPA only if you have chosen to show it.
• Your name and email are not sent separately, but your resume text may contain them.
• What it produces: a 0-100 fit score, a tier (Strong, Possible, Low), and a one-sentence summary - visible only to the people managing the post, never to you.
• The AI never accepts or rejects anyone. Every decision is made by a person. When a position closes, a poster may choose to decline remaining applicants they have reviewed; that is the poster's decision, and you are notified.
• If you do not want your application AI-processed, you may choose not to apply to that post, or contact us first.

Other AI features

• Lab summaries - public research abstracts are summarized in plain language and reviewed by our team. The same abstracts are used to describe what the work involves (Section 3).
• Find your fit - your quiz answers, including any interests you type and anything taken from your resume, are not sent to an AI model. Labs are ranked by fixed rules on our own servers, and each suggestion shows the reasons it was made.
• Search help - if your search has no results, your search text may be sent to the AI to suggest related research areas.
• Publications - if a professor links their public academic website, it is read to list their publications. No student data is involved.
• Paper summaries - researchers' recent papers are summarized, from their public abstracts or the lab's own pages, in one plain-language line and reviewed by our team. No student data is involved.
• Outreach emails - Labvoya does not write your emails to labs. The outline only gives you blanks to fill in with your own words.

Labvoya is an independent service that students and faculty use directly. We do not receive education records from any university. If we ever enter an agreement with a university that involves its records, we will handle those records as that agreement and applicable law require.

Labvoya is not directed to children under 13, and we do not knowingly collect their data.

We may update this policy as the product evolves. We will notify you of material changes by email or in-app notice before they take effect. The date at the top of this page shows the latest revision.

For privacy questions, requests, or concerns: hello@labvoya.com