CodeSandbox
- The policy allows AI training; it does not describe an opt-out.
- Your data is used for personalized ads, including by third-party ad companies.
- They say they do not sell or share your data.
- The documents do not say who can read your content.
They collect account, payment, cookies and support data, keep some for years, and do not sell it except if the company is sold.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
Collected
Account and login info, payments, emails, cookies, IP and mouse data for reCAPTCHA.
Read the exact line
Privacy policy
“In order for Google reCAPTCHA to work, the IP address of a website visitor, mouse movements and possibly other data are collected.”
Training
They use it to run the service, bill you, send newsletters, and may train on support messages.
Read the exact line
Privacy policy
“In this context, we may also use this data – where possible in form – to improve and train our services ().”
Sharing
They say they do not sell your data except if they sell the company; providers and Google get some.
Read the exact line
Privacy policy
“We will not sell, rent or lease your personal data to anyone, except in case we sell our business or part thereof to another company.”
Kept
Account data until you close it; some records up to 5 or 7 years; app data up to 2 years unused.
Read the exact line
Privacy policy
“We keep some data longer if we are legally obligated to do so (e.g., because of the 7-year tax retention obligation).”
Controls
Email them to see or control your data; unsubscribe from the newsletter in each email.
Read the exact line
Privacy policy
“If you wish to exercise any of your rights, you can do so by sending an email to [email protected].”
Fine print
The policy is undated and says you should check it yourself when things change.
Read the exact line
Privacy policy
“Please consult this privacy and cookie statement regularly for the most up-to-date information.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Email to exercise
Send an email to [email protected] as stated in the privacy statement
Unsubscribe from the newsletter
Unsubscribe link in every newsletter
Close your account to stop most storage
Policy says account data is stored until you close your account
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Support emails and similar contact can be used to train and improve their services, with no opt-out described.
Read the exact line
Privacy policy
“In this context, we may also use this data – where possible in form – to improve and train our services ().”
For example, a bug report you send by email could be used to train their tools even after the ticket is closed.
Support conversations can be kept for five years after you first asked for help.
Read the exact line
Privacy policy
“We store your data for up to 5 years after you initiated the support request to ensure that we have reasonably complete conversation histories with users”
For example, a chat about a billing error from 2021 could still be on file in 2026.
They do not promise to email you when the privacy rules change; you have to re-read the page.
Read the exact line
Privacy policy
“Please consult this privacy and cookie statement regularly for the most up-to-date information.”
For example, they could add new sharing and you would only notice if you checked the policy again.
Google gets your IP and how you move the mouse when the site checks you are not a bot.
Read the exact line
Privacy policy
“In order for Google reCAPTCHA to work, the IP address of a website visitor, mouse movements and possibly other data are collected.”
For example, visiting the login page can send your IP and mouse movements to Google.
Social buttons can lead to ads on those platforms based on your visit.
Read the exact line
Privacy policy
“You will also see advertisements on your social media page.”
For example, after clicking a GitHub or X button you may see CodeSandbox ads there.
If you choose the public option, your project and anything inside it goes on the open internet.
Read the exact line
Privacy policy
“Anything you create using our services may be made public by selecting the relevant option.”
For example, a public sandbox could expose API keys you pasted into the code.
They say they do not sell your data in the usual sense, unless the company itself is sold.
Read the exact line
Privacy policy
“We will not sell, rent or lease your personal data to anyone, except in case we sell our business or part thereof to another company.”
For example, a buyer of CodeSandbox could receive the customer list as part of the deal.
They say they use security measures against loss and unauthorized access, without naming audits.
Read the exact line
Privacy policy
“CodeSandbox takes appropriate technical and organizational measures with regard to the processing of personal data to be carried out, against loss or any form of unlawful processing”
For example, they claim to protect your account data but do not list encryption or a bug-bounty program.
You can stop marketing emails with a link in each newsletter.
Read the exact line
Privacy policy
“If you no longer wish to receive the newsletter, you can unsubscribe at any time. There is an unsubscribe link in every newsletter.”
For example, you can click unsubscribe in the next CodeSandbox newsletter and they should stop sending it.
Most account data stays until you close the account, not just when you stop using the site.
Read the exact line
Privacy policy
“We store this information until you close your account.”
For example, an unused login can remain stored until you actually close the account.
Words to know
Legal words from the lines above, in plain English.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- legitimate interest
- A legal reason that lets a company use your data without asking, when it decides its own need outweighs your privacy. For example, an app may analyse how you use it to improve the product, without ever asking you.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
How we got here · grade F · score 33/100 · 15 of 15 policy answers backed by a verified quote · 8 not stated
What does the app collect beyond what it needs to work?
They collect account and login data, payments, emails, cookies, IP address and mouse movements for reCAPTCHA, not just what you type into a sandbox.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Support contact data may be used, often anonymized, to improve and train their services, with no opt-out described.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use third-party cookies and social buttons, and say you will see ads on social media pages.
Do they sell or share your data, and can you opt out?
They say they will not sell, rent or lease personal data except if they sell the business.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
Account data lasts until you close the account; support can be kept 5 years and tax data 7 years. Deletion is by email request.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they take technical and organizational measures against loss and unlawful processing.
Is there a real age gate, and are teens protected?
Not stated in the documents.
Will they tell you when the rules change, and is the policy specific?
The statement has no date and tells you to consult it regularly for updates.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 2,038 words at a fairly hard level (Flesch reading ease 55.1).
