Privacy and your data

This instance runs on one self-hosted machine. No third-party analytics, no CDN and no external service sits between your test data and you. Below is exactly what is stored, for how long, and how you remove it.

What	Kept for	What it means
Account	until you delete it	Name, e-mail, interface language, timezone, a bcrypt password hash and - if you turn it on - the encrypted two-factor secret.
Inbox SMTP credentials	until you delete the inbox	The password is stored only as a hash; the plain value is shown once, when the inbox is created.
Captured emails	30 days	The whole message the sandbox received: envelope, headers, text and HTML bodies, attachment metadata and the raw MIME source.
Captured webhook requests	30 days	Method, URL, query string, headers, body, the originating IP address and the time. That IP is part of what the tool shows you.
Stored attachment files	1 h	Small files on disk, served through a short-lived signed link and deleted automatically.
Visit log (page views)	180 days	Used for the owner statistics. The IP address is stored only as a one-way keyed hash; there are no tracking cookies.
Share links	24 h by default	Read-only, expiring and revocable at any time by their owner.
Service e-mail (address confirmation, password reset)	sent through the configured relay	With the default "log" mailer nothing leaves the server. If the owner configured a relay, only these few account messages pass through it.

The short version

Your test data lives on this one server and nowhere else. There is no analytics service, no CDN and no external queue in the loop. Captured emails are never relayed to real recipients, and nothing you put into this sandbox is sold, shared or used to train anything.

Where your data lives

This instance is self-hosted: a single machine, its own database and its own disk. The application code, styles, scripts and images are all served from that machine - these pages do not load a font, a script or a tracking pixel from anywhere else. The only account that can see everything is the administrator of this instance (see "Who can see what").

What we do not do

No third-party analytics, advertising networks or tracking pixels.
No CDN and no external asset host.
No sharing or selling of captured content.
No relaying of captured mail: any recipient address is accepted and then discarded.
No behavioural profiling: the visit log is first-party, cookie-less, and IP addresses are stored only as a one-way keyed hash.

Cookies

Only what the application needs to work:

a session cookie, so you stay signed in;
a tz cookie that remembers the timezone your browser reported;
a "remember me" cookie, if you tick that box when signing in.

There are no tracking or advertising cookies, so no cookie banner is needed.

Who can see what

You see your own inboxes, webhooks and captured data.
A read-only share link shows only what you shared, for as long as you chose.
The administrator of this instance can see and moderate every account and its data. On this instance that is the owner, who also operates the machine.

How you remove data

Delete a single message or request, or a whole inbox/webhook, from its page.
Revoke a share link at any time; expired and revoked links answer "gone".
Delete your account: profile -> "Delete my account". That removes the account, its inboxes, webhooks, captured emails, requests, share links and any stored attachment files. The visit log keeps its page-view rows but clears the account they were attributed to, so the history becomes anonymous.
The rest disappears on its own: captured mail and requests are pruned after the retention window, and attachment files after their short lifetime.

Outgoing mail

The sandbox never sends the mail you capture. The only messages this instance can send are account messages: address confirmation and password reset. If the mailer is left as log, nothing leaves the server at all; if the owner configured a relay, only those few messages pass through it - the relay therefore sees the recipient address and the body of that message.

If the owner enabled it, you can sign in with Google. Google then handles the login step; this instance receives your Google id, name and e-mail address and stores them with your account. If you prefer not to involve Google, use the e-mail and password form.

Security

Passwords are stored as bcrypt hashes; inbox SMTP passwords are hashed too.
Optional two-factor authentication (TOTP) with one-time recovery codes.
Everything is served over HTTPS; nothing is published on an unencrypted port.
Private pages, share links and captured content answer noindex, nofollow, noarchive, so search engines do not store your test data.

Before you send anything real

This is a sandbox: whatever you send it is stored - real customer addresses, order details, password-reset links and access tokens included. Use test data, and if you must use production data, keep the retention window short and delete it yourself afterwards.

Changes

This page describes how the instance actually works, so it is updated together with the code that changes that behaviour.

Last updated: 2026-09-11.