Legal

Privacy policy

The data set you read from us is synthetic, so most of what a normal API privacy policy is about does not exist here. What is left is small enough to list table by table, which is what this page does.

Effective 2026-09-12Last updated 2026-09-12team@sandboxapis.dev

Who processes your data

Driftwork LLC, a company registered in Arizona, United States, is the controller of the data described here. Write to team@sandboxapis.dev about any of it.

What we collect and why

What	Why we have it
Your account email	Sign-in is passwordless: you give an email address, we send a link and a six-digit code to it. The address is the account. It is also how we reach you about a subscription or a change to these terms.
API key records	A one-way hash of each key, a display prefix, its last four characters, the name you gave it, its tier, and the times it was created and last used. Never the key itself — we show it to you once and store only the hash, so a leaked database yields no usable key.
Per-key usage counters	A count per key, per hour, per provider, per endpoint family. This is what your dashboard shows you, and it is how we can tell you that you are near a limit before you hit it.
Traffic telemetry	One row per caller per provider per day, where the caller is a salted hash that includes the date — never an IP address, and not linkable from one day to the next. It answers one question: did anyone we do not already know call today. Your User-Agent is read to classify the caller as an SDK, a bot or unknown, and then discarded; the header itself is never stored.
Aggregate counters with no identifiers	Four daily tallies that carry nothing about who: endpoints asked for that we do not cover, requests refused for being over a limit (by plan), clicks on an upgrade link, and writes attempted against a read-only host (by provider, verb and normalized path). No IP, no key, no account, no request body and no query string reaches any of them.
Feedback you send	Your message, the topic you picked, the provider if you named one, and an email address if you gave us one so we can reply. If you are signed in, the row is linked to your account; deleting your account unlinks it and keeps the report, because the report is how coverage gets prioritized.
Paid-plan interest	If you ask to be told when a plan is available: your email address and which page you asked from. Same account-unlinking rule as feedback.
Stripe customer and subscription	If you subscribe: Stripe's customer id, Stripe's subscription id, the status Stripe reports, the tier you are on and when the current period ends. Card numbers, expiry dates and CVCs never reach us — checkout and the billing portal are Stripe's own pages, and Stripe holds those details. Our webhook logs an account id and a tier name, never an email, a name or an amount.
Founding membership	If you claim a founding slot: your account, your founding number, when you claimed it, when the year started (your first API call) and when it expires.
Error reports	When a page on sandboxapis.dev throws, our error monitor records the error, a stack trace, the URL and a replay of the interaction that led to it. It is sampled only around errors — there is no session recording of ordinary browsing — and we enable none of its options for attaching personal data.

What we do not collect

Request and response bodies. Nothing that measures your API traffic stores a body, a query string or a header. The write-attempt counter is the strictest case, because a refused write is the one request whose body would carry what you meant to change: it records the provider, the verb, the path with ids normalized away, and the plan — and nothing else.
IP addresses, in anything we keep. An address is used in the moment to rate-limit an anonymous caller. What is written down is a salted hash that includes the day, which makes it neither reversible nor linkable across days.
Real third-party data. There is no OAuth into your GitHub, no repository of yours cloned, no ticket of yours read. The sandbox is generated; there is nothing of yours in it to leak.
Advertising or cross-site trackers. No ad network, no data broker, no third-party marketing pixel, no selling or sharing of anything on this page.
Special-category data. We have no reason to ask for any and no field to put it in. Please do not put any in a feedback message.

Cookies and browser storage

A session cookie when you are signed in. Set by Supabase Auth and refreshed as you navigate. It is what keeps you signed in; signing out clears it. There is no cookie for a signed-out visitor.
One localStorage flag when you dismiss the announcement bar, so it stays dismissed. It never leaves your browser.
Page-view analytics. We use Vercel Analytics, which sets no cookie and builds no cross-site profile (that is Vercel’s design, not something we configure). What we do configure is the exclusion: page views on /dashboard, /login and /auth are dropped in your browser before they are sent, so the authenticated part of the site is not measured at all.
Our error monitor’s own storage. The Sentry SDK keeps a short-lived id in your browser so an error can be tied to the clicks that preceded it.

The API hosts (the gh., gl. and other sandbox hostnames) run no analytics script and set no cookie of ours at all. They are a different deployment from this website.

Who else processes it

We use a small number of vendors, each for one job. We do not sell data to anyone, and none of these is an advertising network.

Vercel — hosts this website and the API, and provides the page-view analytics described above.
Supabase — authentication and the database behind everything in the table above.
Stripe — payments, checkout and the billing portal. Stripe holds your card details; we hold its ids.
Cloudflare — DNS for our domains, and R2 object storage for the compiled data-set files the API reads. Those files are the generated universe and contain nothing about you.
Resend — delivers the sign-in and confirmation emails, as the SMTP provider behind Supabase Auth.
Sentry — error monitoring for this website. (We also mirror Sentry’s API as one of our sandbox hosts. The two are unrelated: one is a vendor we use, the other is an API shape we imitate.)

How long we keep it

Plainly: we have no deletion job. What follows is what the code actually does, not a policy we aspire to.

Your account, keys, usage counters, subscription mirror and founding record are kept until you ask us to delete them. Deleting your account deletes all five together — the keys and their usage counters, the subscription record we mirror from Stripe, and the founding row.
Feedback and paid-interest rows outlive the account on purpose: deleting your account removes the link to you and keeps the message, because a bug report that vanishes when someone closes an account is a bug we stop being able to fix. Ask us and we will delete the row itself too.
Traffic telemetry is kept indefinitely and cannot be deleted per person, because there is no per-person key in it to search by — that is the same property that makes it privacy-preserving. It stops being about anyone the day after it is written.
The four aggregate counters are kept indefinitely. They are counts with no identifiers; there is nothing in them to delete.
Error reports are kept for as long as our monitoring plan retains them, which is our vendor’s default rather than a period we have chosen.

Your rights

Email team@sandboxapis.dev and we will do it. There is no self-serve export or delete button yet, and rather than pretend otherwise: a person reads that mailbox and acts on it.

Export — we will send you everything the tables above hold about your account.
Delete — we will delete your account and everything that cascades from it. Say so if you want your feedback rows gone as well.
Correct — there is very little to correct (an email address and a key name), and we will change either.
Object or restrict, and complain to a regulator — where the law where you live gives you those rights, you have them here.

Where you are outside the United States, note that our vendors above process data in the United States.

Children

This is a developer tool, it is not directed at children, and we do not knowingly collect anything from a child under 13. If you believe a child has created an account, tell us and we will delete it.

Changes to this policy

We will update this page when what we store changes, and move the effective date at the top. A change that widens what we collect about you gets an email to account holders, not a quiet edit.

Not legal advice

This page is written by the people who built the service. It describes the code accurately as of the effective date. It is not legal advice.