Privacy

Effective September 11, 2026

Information collected

Sandboxed stores your email address, membership status, selected plan, payment provider, registered device names, playback-session activity, and payment status. To understand which promotions lead to signups and paid memberships, Sandboxed also records campaign tags, the referring website’s hostname, the landing-page path, and a randomly generated browser identifier that is converted to a protected server-side hash. To limit repeated trials and account sharing, Sandboxed creates separate protected hashes derived from device characteristics and IP addresses. Raw passwords are handled by the authentication provider and are not stored by Sandboxed.

Payments

Card information is processed by Stripe. Cryptocurrency payments are processed by NOWPayments. Sandboxed receives transaction identifiers and payment status, but does not receive complete card numbers or wallet recovery phrases.

How information is used

Information is used to authenticate accounts, provide trials and memberships, enforce device and playback limits, process payments, measure campaign and signup performance, prevent abuse, and provide support. Sandboxed may send pseudonymous campaign and conversion events to PostHog for aggregate product analytics. Sandboxed does not send PostHog email addresses, raw account identifiers, IP addresses, search terms entered on Sandboxed, movie or series titles, or session recordings.

Retention and security

Active account records are retained while needed to operate the membership. Completed playback-session records are deleted after 30 days, revoked-device records after 90 days, and payment and marketing-event records after 400 days, subject to any longer legal requirement. Unlinked marketing-attribution records are also deleted after 400 days. Protected trial-abuse hashes may be retained after account deletion so deleting an account does not create another free trial. Technical server errors may be reported to Sentry after email addresses, account identifiers, and secret-like values are removed. Administrative credentials remain server-side, database tables use restricted access rules, and payment notifications are signature-verified.

Your choices

You may request account-data access or deletion through the support contact shown in your account. Some payment records and non-reversible abuse-prevention hashes may need to be retained for fraud prevention, accounting, or legal compliance.