Privacy Policy

This policy describes what personal data Sandbox as a Service collects when you use sandbox-as-a-service.com, why we collect it, how long we keep it, and what you can ask us to do with it. It is written to match what the service actually does rather than to cover every hypothetical.

Last updated: 22 August 2026

Who is responsible

The controller within the meaning of Art. 4(7) GDPR is:

Full provider identification is on the imprint. We have not appointed a data protection officer, as we are not required to under Art. 37 GDPR. You may lodge a complaint with a supervisory authority; ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach, Germany.

What we collect, and why

Account data

The only way to create an account is to sign in with Google. From that sign-in we receive and store your Google account identifier, your email address, your display name and the URL of your Google profile picture. We request the openid, email and profile scopes and nothing else — we have no access to your Gmail, Drive, contacts or calendar. Legal basis: performance of the contract you enter into when you create an account (Art. 6(1)(b) GDPR).

Sessions

Signing in creates a session record holding a random session id, your account id and an expiry date, and sets a cookie containing that session id plus an HMAC signature. The cookie is httpOnly, SameSite=Lax and, in production, Secure; it expires after 30 days. It is strictly necessary — we use no cookies for analytics, advertising or cross-site tracking, and there are no third-party trackers, ad pixels or analytics scripts on this site.

API keys

When you create an API key we store its name, the first 16 characters of the key (so you can tell your keys apart), a scrypt hash of the full key, and the creation, last-used and revocation timestamps. We never store the key in plaintext. It is shown to you exactly once, at creation time; if you lose it, the only remedy is to revoke it and create a new one. Legal basis: performance of the contract.

Sandbox metadata

For every sandbox we store its id, the optional name you give it, the size, status, requested timeout, the created / ready / expiry / deleted timestamps, and internal references to the underlying machine that are never exposed through the API. We also keep a small lifecycle event log — "create requested", "ready", "extended", "destroyed" — used for support and for reconciling our records against the machines that actually exist. Legal basis: performance of the contract, and legitimate interest in operating the service reliably (Art. 6(1)(f) GDPR).

Commands and their output

This is the part most worth reading carefully. When you execute a command, we store in our database:

• the command text you submitted (up to 10,000 characters);
• its standard output and standard error (up to 1 MiB per stream, after which the record is flagged as truncated);
• the exit code, status, start and finish timestamps and duration.

In other words, whatever your code prints is written to our database along with the command that produced it. We keep this so you can retrieve results after the fact, so support can help when something fails, and so we can investigate abuse reports. Do not pass secrets as command-line arguments, and be deliberate about what you print. Legal basis: performance of the contract, and legitimate interest in preventing abuse.

We do not copy files out of your sandbox and we do not index or scan its filesystem. Everything inside the sandbox lives on that machine's disk, and the disk is destroyed with the machine. Our control plane does hold a root SSH key for every sandbox host, because that is how machines are provisioned, reset and torn down; it is used for those lifecycle operations, not for reading your files.

Billing records

We store a credit ledger: for each balance change, the amount, the reason (signup bonus, top-up, usage, adjustment), a reference such as a Stripe checkout session id or a sandbox id, a description and a timestamp, plus the Stripe customer id for your account. We do not receive or store your card number, expiry date or security code. Payment details are collected and held by Stripe on their own systems; we only see the outcome of a payment. Legal basis: performance of the contract, and compliance with accounting and tax obligations (Art. 6(1)(c) GDPR).

Server logs

Our application log records, per request, a request id, the HTTP method and path, the response status, the duration and — where the request was authenticated — the account id. Authorization headers, cookies and anything that looks like a token or password are redacted before a log line is written. IP addresses are processed to enforce rate limits and appear in the request logs kept by our hosting and database providers. Legal basis: legitimate interest in keeping the service available and secure.

Website statistics

We count visits to the public pages ourselves, and it is worth being precise about what that does and does not involve. No cookie is set, no IP address is stored, and nothing is sent to a third party. For each page view we record the path, the referring site's hostname, any campaign parameters in the URL, a two-letter country from our CDN, whether the device is a phone, tablet or desktop, and — reported once by the page as you leave it — how many seconds the page was actually visible and how far you scrolled.

To count the same person twice in a day without identifying them, we store a truncated SHA-256 digest of your IP address, your browser's user-agent string and a secret that is regenerated every day. Because the secret changes, two visits on different days cannot be linked, and the digest cannot be turned back into an address by us or by anyone who obtained the table. That is a deliberate ceiling: it lets us count people and makes following them impossible. Requests identifying themselves as crawlers are not recorded at all.

Legal basis: legitimate interest in understanding whether the service is useful and where visitors come from (Art. 6(1)(f) GDPR). Because the data is not linked to a person and no information is stored on or read from your device, this needs no consent banner under § 25 TDDDG. Statistics are kept for 24 months and then deleted.

Retention

Account data, API key records, sandbox metadata, execution records and the credit ledger are kept for as long as your account exists. There is no automatic expiry on execution history today; if that changes we will say so here. Session records are removed when you sign out, and expired sessions are rejected. Infrastructure logs are kept for the short window our providers apply. Records we need for accounting are retained for the periods German commercial and tax law require, even after an account is closed.

Deleting your account is self-service. Open the account page and use "Delete account". This destroys any running sandboxes, then deletes your user record together with your API keys, sandbox records, execution history (commands and output) and credit ledger. Any remaining credit is forfeited, and the action cannot be undone. A residual entry in the sandbox lifecycle event log, and any records Stripe holds independently as the payment processor, are not removed by this action.

Who else processes your data

The list of sub-processors is short and functional:

• Stripe — payments, checkout, receipts and invoices. Receives your email address, name and the payment details you enter directly with them.
• Google — sign-in. The sign-in event happens on their side and they tell us who you are.
• A cloud infrastructure provider — hosts the control plane and the sandbox virtual machines.
• A managed database provider — stores the records described above.

We do not sell personal data and we do not share it with advertisers or data brokers. We disclose data to authorities only where legally obliged to.

Where your data is processed

The control plane and the sandbox machines currently run in a data centre in Germany. Stripe and Google are US-headquartered companies that process data internationally; those transfers rely on the European Commission's standard contractual clauses and the transfer frameworks each provider maintains.

Your rights

Under the GDPR you can ask us for a copy of the personal data we hold about you, correct it, delete it, restrict or object to processing, or export it in a portable format. Deletion is available immediately, without asking us, in the dashboard. For anything else, write to info@productivity-boost.com from the address on your account. You may also lodge a complaint with your local data protection supervisory authority.

Children

Sandbox as a Service is a developer tool sold to businesses and individual developers. It is not directed at children, and we do not knowingly create accounts for anyone under 16. If you believe a child has created an account, tell us at info@productivity-boost.com and we will delete it.

Security and changes

The technical measures protecting this data — VM-level isolation, hashed API keys, signed session cookies, transport security, tenant scoping in the control plane — are described without marketing claims on the security page. If we change what we collect or who processes it, we will update this page and move the "last updated" date, and announce material changes to account holders by email before they take effect.