SandboxAPI is operated by Omnimarkt, a Netherlands sole proprietorship (eenmanszaak), KVK 78150728, at Schoener 6, 1132 GK Volendam, Netherlands. This notice explains information processed when you visit our website, sign in, execute code or use direct billing.
For privacy requests, contact hello@sandboxapi.dev. For security reports, use security@sandboxapi.dev.
- Account history stores execution metadata, not your code, stdin or output.
- Async jobs and stateful sessions need temporary execution storage.
- Google/GitHub authenticate you; Stripe hosts card entry.
- You can revoke keys and request account deletion in Settings.
1. Who is responsible
Omnimarkt determines how account, billing, support and service-security information is used to operate SandboxAPI. Where we process personal data inside customer-submitted code, inputs or results on a customer’s instructions, the respective data-protection roles and processing terms must reflect that relationship.
Before publication: assign monitoring of the contact inbox, which is not yet monitored; review customer-data processing terms and whether an additional data-protection contact is required.
2. Information we process
Sign-in and account information
Google sign-in requests your provider identifier, profile and email through the openid, email and profile scopes. GitHub sign-in requests read:user and user:email. We do not request Google mail/files or GitHub repository access. Provider tokens are used for sign-in and are not retained in the account database. Linking providers is an explicit authenticated action; identical email addresses alone do not merge accounts.
We store profile and workspace information, preferences, hashed session credentials and API keys, masked key identifiers, key names and last-used timestamps. New API-key secrets are shown once and cannot be recovered from the account database.
Execution content and metadata
We process submitted code and standard input to run your requests and return output. Synchronous content is processed inline. Async requests store the request and result in Redis for execution, polling and crash recovery. Stateful session files and installed packages persist during that session’s lifecycle.
Account execution history stores language, outcome, duration, timestamp, request identifier, execution source and structured diagnostics. It does not store source code, stdin, stdout or stderr. Direct requests bypass the optional full-text execution audit logger. Standard application logs exclude that execution content.
Usage, security, billing and support
We process usage counters, quota reservations, subscription state and limited account-activation events. Activation events include event names, timestamps and workspace references without execution content or API-key secrets. Operational logs can include IP addresses and request metadata. Managed HTTPS egress logs include connection destinations, outcomes, duration and transfer counts.
We send account contact information and a workspace reference to Stripe to create the billing customer. We retain customer/subscription identifiers and billing status. You enter card information on Stripe’s pages; card details are not stored in our account database. If you email support or submit a dashboard request, we receive your contact details, message, request type and submission time. Dashboard requests and queued confirmations are stored in our account database. Support email is copied through Cloudflare to the operator mailbox and Resend for the administrator inbox. Replies and delivery events are processed through Resend; open and click tracking are disabled.
3. Why we process information
We use this information to authenticate you, provide execution, enforce allowances, manage subscriptions, answer support requests, protect the service and understand its use. We do not sell user data or use submitted code, inputs or outputs to train machine-learning models.
| Purpose | Proposed basis where GDPR applies |
|---|---|
| Provide the account, execution and direct subscription | Perform our contract with you or take steps at your request; for business contacts, legitimate interests in providing the business service where appropriate. |
| Secure the service, prevent abuse and resolve operational faults | Legitimate interests in protecting users and operating a reliable service, balanced against your rights. |
| Required accounting and legal records | Compliance with applicable legal obligations. |
| Website measurement and optional communications | Review the applicable basis and cookie/storage requirements before activation; use consent where required. |
These bases, the legitimate-interest assessment and the optional-communication/storage consent requirements must be confirmed before this notice becomes effective. A privacy notice itself is not consent.
4. Cookies, browser storage and website measurement
Session cookies keep you signed in. Short-lived OAuth cookies protect the sign-in flow. The editor can save code, stdin and the selected language in this tab’s session storage for up to 24 hours; clearing browser storage removes that draft. API-key secrets are not saved in that draft.
The website’s first-party measurement records page paths, interactions, campaign tags and a per-tab identifier. The tab identifier and campaign attribution use session storage. The proposed website update excludes raw query strings and URL fragments from automatically recorded page, referrer and link URLs. Referrer measurement keeps only the referring origin. Do not put secrets or personal information in campaign tags or URLs.
Google Analytics, PostHog and Plausible integrations are currently disabled. If additional analytics or marketing storage is introduced, we will update the notice and obtain consent where required. Google-hosted fonts cause your browser to request font resources from Google, which receives the connection information needed to serve them.
5. Service providers and international processing
| Provider | Purpose |
|---|---|
| Google and GitHub | Authentication and identity information during sign-in. |
| Stripe | Direct Checkout, subscription management, payment methods and invoices. |
| Hetzner | Execution infrastructure, including account and execution processing. |
| Cloudflare | Website delivery, DNS and routing support email. |
| Hosted fonts and support email handling. | |
| Resend | Transactional acknowledgements, support email, administrator replies and delivery events. |
| RapidAPI | Marketplace requests, customer authentication and marketplace billing for that channel. |
Marketplace access and direct accounts are separate. Requests sent through RapidAPI also pass through its systems and are covered by its notices and terms. Some providers act independently for parts of their processing, such as their own account or payment obligations.
Providers may process information in countries different from yours. The operator must confirm the contracted entities, actual service regions and applicable transfer safeguards before publication; we do not claim all processing stays in the EU.
We may disclose information where required by law, to respond to a valid legal request, or to protect the service and others’ rights, subject to applicable safeguards.
6. How long information is kept
| Information | Retention |
|---|---|
| Synchronous code, stdin and output | Processed during the request; not persisted in account history. |
| Async request and result | Default job expiry of 24 hours, including queue, polling and recovery needs. |
| Stateful session data | Session lifecycle and configured idle timeout; removed by session cleanup. |
| Editor draft | Up to 24 hours in this browser tab. |
| Execution metadata | 30 days by default. |
| Quota reservations and retry identifiers | At least 35 days, or the longer configured history window. |
| Detailed account events and processed billing webhook identifiers | 90 days. |
| Account records, key records, milestones and usage aggregates | Until account deletion. |
| Session and OAuth records | Until expiry and scheduled cleanup; sign-out invalidates the current session. |
| Encrypted backups | 30-day policy approved. Enforcement and verification must be completed before publication. |
| Routine access/application logs | Up to 14 days, applied at scheduled rotation/cleanup. Staging is configured; production rollout remains pending. |
| Support requests, queued email content and email delivery events | Local expiry is not yet implemented. These records survive account deletion where needed to preserve a request. The operator must approve and implement a bounded support-evidence policy before publication. |
| Provider email copies and legally required billing records | Provider and operator mailbox policies apply separately. Confirm applicable periods and record locations before publication. |
Verified application settings must match the final published periods. Incident evidence or information subject to a legal obligation may require a documented exception; such data should be restricted and reviewed when the reason ends.
Account deletion disables direct access, waits for active reservations, removes owned runtime sessions, cancels the direct subscription and removes active account records. A provider failure can leave deletion pending. Support requests and associated mail records are retained separately so account deletion does not silently discard an outstanding privacy, withdrawal or refund request. Older copies may remain in encrypted backups until expiry. Stripe retains its own records under its policies; deleting a direct account does not cancel a RapidAPI subscription.
7. Your choices and rights
You can update available profile/workspace settings, revoke keys, sign out and request deletion in the dashboard. Contact hello@sandboxapi.dev to request access, correction, deletion, restriction or portability, or to object to processing. Where processing relies on consent, you can withdraw it without affecting processing that was lawful before withdrawal.
Where GDPR applies, rights depend on the processing and legal basis. We will respond within the applicable legal deadline, normally one month, and explain any permitted extension. We may need proportionate information to verify a request. You can also complain to your competent data-protection authority. In the Netherlands, you can contact the Autoriteit Persoonsgegevens.
Providing identity information is necessary to create a direct account. Without it you can use the restricted anonymous playground. Billing information is required for a paid subscription. We use automated quota and security controls; this notice does not describe them as decisions with legal or similarly significant effects.
8. Changes and contact
We will date the effective notice and communicate material changes as required. Contact Omnimarkt about privacy at hello@sandboxapi.dev. This review draft has no effective date.