Privacy
Draft: this page is published with the launch pull request.
Every sandbox is deleted every night at 10:00 UTC, and Proof of Concept Bakery never asks for or stores your name, email, address or card.
Cloudflare keeps deleted storage restorable for 30 days, so the account owner could bring rows back for a month. The bakery never restores a sandbox, and nothing in its code calls the restore.
What sign-in gives the bakery
- Google: the bakery asks for
openidonly and receives an opaque identifier,sub. It keeps that only as a keyed hash. It receives no email, name or picture. Google’s consent screen still says the bakery will “Associate you with your personal info on Google”. That is Google’s fixed wording for theopenidscope; we observed it on 2026-11-05 and the scope returns the identifier and nothing more. - GitHub: the bakery reads the numeric user id from GitHub’s answer and discards the rest and the access token. It keeps the id only as a keyed hash.
- A demo account: a generated username and a hash of the password you chose. There is no email, so there is no password reset: a forgotten password means a new account.
- A guest: nothing but a cookie.
What is kept, and for how long
| What | Kept for | Why |
|---|---|---|
| Session cookie | 24 hours, or until you sign out | It lets you into your sandbox. The browser keeps it; page scripts cannot read it. |
| Sign-in transaction cookie | 10 minutes | It holds the one-time values that make Google or GitHub sign-in safe. |
| Account id (a keyed hash), and for a demo account the username and password hash | Deleted 30 days after your last sign-in | One sandbox across your devices. |
| Sandbox contents | Until 10:00 UTC. A backstop deletes anything left after 36 hours. | The demo itself. Its few free-text fields say they are wiped tonight. |
| Your IP address, as a hash with a salt that changes daily | In logs for 7 days. The address itself is never stored or logged. | Rate limits, daily caps and abuse review. |
| Country and continent | In logs for 7 days | Capacity and abuse review. Never a city, region or coordinates. |
| Turnstile’s signals | Under Cloudflare’s policy | It checks that you are a person when you make a sandbox or an account. |
| Stripe sandbox objects, from the payments pull request (PR 5) | Customers and drafts until the wipe; the rest until Stripe’s sandbox is reset | Test payments. The details are synthetic. |
What “Wipe now” does
It runs the night’s wipe for your sandbox alone, right away: the sandbox and everything it holds are deleted, and the bakery reports that to its own counter. The same 30 days of Cloudflare’s restore window apply, and the same promise: nobody restores it.
Cookies and consent
The session cookie is what lets the service you asked for work, so there is no consent banner. The bakery sets no cookie to track you and loads no third-party script, except Turnstile on the sign-in page.
As of 2026-11-05. The detail is in thesecurity document.