← Back to home

Privacy Policy

Last updated: May 2026

1. Data We Collect

When you use API Sandbox, we may collect:

  • Account data: email address, name (optional), password hash
  • Progress data: quiz scores, phase completion, XP earned
  • Payment data: processed securely by Stripe — we never store card details
  • Usage data: pages visited, features used (via Vercel Analytics)
  • Technical data: IP address, browser type, device (for security and rate limiting)

2. How We Use Your Data

  • Provide and maintain the learning platform
  • Track your progress across phases and exercises
  • Process payments and manage subscriptions
  • Send transactional emails (verification, subscription updates)
  • Protect against abuse (rate limiting, fraud prevention)
  • Improve the platform based on aggregate usage patterns

3. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Vercel infrastructure. Passwords are hashed with bcrypt and never stored in plain text. All connections use TLS encryption. Payment processing is handled entirely by Stripe (PCI DSS Level 1 compliant).

4. Third-Party Services

5. Data Retention

We retain your account and progress data for as long as your account is active. If you delete your account, we remove your personal data within 30 days. Anonymised, aggregate analytics data may be retained indefinitely.

6. Your Rights (GDPR)

If you are in the UK or EU, you have the right to:

  • Access: request a copy of all data we hold about you
  • Rectification: correct inaccurate personal data
  • Erasure: request deletion of your personal data
  • Portability: receive your data in a structured, machine-readable format
  • Objection: object to processing based on legitimate interests
  • Restriction: request we limit how we use your data

To exercise any of these rights, email privacy@apisandbox.dev. We will respond within 30 days.

7. Cookies

We use:

  • Essential cookies: session authentication (required for the app to function)
  • Analytics cookies: Vercel Analytics for page view tracking (only with your consent)

We do not use advertising or tracking cookies. You can manage cookie preferences via the consent banner shown on your first visit.

8. Children

API Sandbox is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us to have it removed.

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. Material changes will be communicated via email.

Contact

Data protection enquiries: privacy@apisandbox.dev