Privacy statement

What we do not collect

• No account. No username. No password. No email.
• No name, address, phone number, or any identifying information.
• No tracking cookies, no analytics, no advertising identifiers.

What we transiently see

Your IP address reaches this server when you submit a file. It is immediately hashed with a server-side secret that is never exposed, and the hash is used only for rate-limiting and to associate your submission with your browser session. The raw IP address is never stored on disk, never logged in identifiable form, and never leaves this server. The hash expires within 90 minutes.

What happens to your file

• Uploaded file: deleted immediately after the sandbox finishes analyzing it. Typically within 5–25 minutes of submission.
• Sandbox artifacts: kept only so you can view the reports and optionally purchase the raw export. Deleted within 90 minutes of analysis completing, on an automatic timer.
• PDF reports: available for the same 90-minute window, then deleted. If you want a permanent copy, download it before the window expires.
• Raw Sandbox export: only generated if you pay $1. The zip is served to you once and not stored after the 90-minute window closes. IPs and secrets inside the artifact are redacted before delivery.

What we never do

• We never sell, rent, share, or expose your submission or analysis to third parties.
• We never train models on your submission.
• We never associate your submission with your identity — we cannot, because we do not have it.

Third parties

Two external services are used purely as infrastructure:

• Cloudflare terminates TLS and proxies traffic to this server. Cloudflare may see your IP address as part of normal content delivery, under their own privacy terms.
• Stripe processes the $1 payment if you choose to buy the raw export. Stripe sees your payment method, not your submission contents. We do not receive or store your card details.

Your rights

Because we do not hold personal data, there is nothing to access, export, or delete upon request. The data you submit is automatically deleted on the schedule above. If you have a concern, contact [email protected].

Compliance posture

The service is designed to minimize data collection to the point where most privacy regulations (GDPR, CCPA) have limited applicability: no personal data is stored, no consent is required for analysis, and no data is transferred to third parties for processing beyond the operational necessities above.