Privacy Policy
This policy explains what sandstack collects, why, and how long we keep it. Short version: we keep the bare minimum needed to run the service.
What we collect
- Account data: your email address and a bcrypt hash of your password.
- Session data: the metadata of browser sessions you create (id, timestamps, user binding) and a single auth-session cookie value.
- Server logs: request method, path, status code, source IP, and timestamp — kept for up to 30 days for debugging and abuse response.
What we don't collect
- The contents of pages you visit in your sandbox sessions.
- Screenshots, video, or HAR archives of your browsing.
- Network traffic flowing through your sandbox containers.
- Analytics from third-party trackers — there are no third-party scripts loaded on this site.
Cookies
We set exactly one cookie: sid, used to remember your sign-in. It is
HTTP-only, marked Secure, and expires after 30 days. No tracking cookies, no advertising
cookies.
Sub-processors
The service runs on:
- Amazon Web Services (AWS) — hosting, DNS (Route 53), and managed parameter storage. Region: us-east-1.
- Zoho Mail — outbound transactional email (verification, password reset).
- Let's Encrypt — TLS certificate issuance for sandstack.site and subdomains.
Data retention
- Account records: kept until you delete your account.
- Browser session metadata: deleted when the session ends (typically minutes).
- Auth-session records: deleted on logout or after 30-day expiry.
- Server logs: rotated out after 30 days.
Your rights
You can request export or deletion of your account data by emailing admin@sandstack.site. We'll comply within 30 days.
Security
Passwords are hashed with bcrypt (cost 12). All traffic is TLS 1.3. See the Security page for more.
Changes
We'll update the date at the top when this policy changes. Material changes will also be noted in the Changelog.