Get started
🔒 Legal

Privacy Policy

Last updated: 2 July 2026

This policy explains what we collect when you use SandyWP, why we collect it, and the choices you have. We keep it short because we collect little. It covers the SandyWP website and app, and includes dedicated sections for AI assistant connectors (ChatGPT, Claude, Cursor via MCP/OAuth) and the SandyWP for Slack app.

What we collect

  • Account data. If you sign up, we store your email address and, for password accounts, a securely hashed password. If you sign in with Google, we store the basic profile your provider returns.
  • Sandbox data. Metadata about the sandboxes you create names, WordPress/PHP versions, status, and expiry. Disposable sandboxes and their contents are deleted automatically when they expire.
  • Billing data. If you upgrade, payments are handled by our payment provider. We store a customer reference and subscription status never your card details.
  • Operational data. Limited logs and abuse-prevention signals (such as hashed IP/session identifiers) used to keep the service reliable and stop misuse.

How we use it

To provide and operate the service, authenticate you, enforce plan limits, prevent abuse, process payments, and communicate about your account. We do not sell your personal data.

Demo launch links

If you open a public demo launch link, we provision a throwaway sandbox for you. When the link owner has enabled email capture, the email you enter is shared with that owner as a lead. Anonymous demos are identified only by a short-lived session cookie and expire automatically.

AI assistant connectors

You can connect SandyWP to an AI assistant such as ChatGPT, Claude, or Cursor using the Model Context Protocol (MCP) and OAuth. The connector runs only when you (or an assistant you authorized) call it. We do not receive or store the chat conversations you have with those assistants.

The connector can access and return:

  • Account plan and usage. Plan name, sandbox limit, and how many sandboxes are active.
  • Sandbox metadata. Names, status, WordPress/PHP versions, expiry, and similar account-owned records the tools expose.
  • Files and logs. Sandbox files, debug logs, and similar contents only when you ask the assistant to read or change them.
  • Lead emails on ChatGPT. The ChatGPT/Codex endpoint masks captured demo-lead emails (first character plus domain) and does not return full addresses, lead ids, or IP hashes. Cursor and Claude on the main connector may still see the full lead records you already stored.

OAuth tokens. Approving a connector issues an access token bound to the permissions you grant (and, for ChatGPT/Codex, to https://app.sandywp.com/mcp/openai). Tokens are stored hashed, the same way as other API keys. Revoke a connector at any time from Account → API keys (Disconnect next to the MCP connector). Revoking ends future tool calls immediately.

Retention & deletion. Connector tokens are kept until you revoke them or delete your account. Sandbox contents follow ordinary sandbox expiry. We do not keep a copy of assistant chat transcripts. To delete connector data or your account, revoke the connector as above, or email [email protected]. We do not sell this data, and we do not use it for advertising.

SandyWP for Slack

If your workspace installs the SandyWP for Slack app, we process the following so the bot can deploy to your sandboxes when you mention it:

  • Workspace identity. Your Slack team (workspace) ID and name.
  • Bot token. The per-workspace bot token Slack issues on install, stored encrypted at rest (AES-256-GCM). It is decrypted only in memory to call the Slack API on your behalf.
  • User identity. The Slack user IDs of people who interact with the bot, used to link a Slack user to their SandyWP account and to route replies. Linking a Slack user creates a personal SandyWP API token, also stored encrypted at rest.
  • Message content. The text of messages that mention the bot is processed to understand your command (for example which site to deploy to). Recognized commands are parsed by SandyWP. For less structured requests, the mention text, recent messages in the same thread, and the names of attached ZIP files may be sent to Anthropic (Claude) for structured interpretation and to write the bot's reply. Slack tokens, SandyWP tokens, and ZIP contents are not sent to Anthropic.
  • Uploaded files. Plugin .zip files you attach are downloaded and deployed to your sandbox; they are stored as deploy artifacts on your account. We do not read other files or your message history the bot only scans a thread for a .zip when you ask it to deploy one.

Retention & deletion. When your workspace uninstalls the app (or Slack revokes its token), the stored installation and every account link under it are deleted. You can unlink your own account at any time by mentioning @SandyWP logout, which revokes the API token and removes the mapping. We do not sell any Slack data, and we do not use it for advertising.

For a walkthrough of the app itself, see the Slack app guide.

SandyWP for GitHub

When you connect the GitHub App, we store the GitHub installation, account, and repository identifiers and display names needed to route and configure previews. For commands we retain delivery/comment identifiers, pull request number, exact commit SHA, command actor ID/login, selected settings, run state, and the generated SandyWP site/job relationship. We do not persist installation access tokens.

A Worker temporarily clones repository source and copies the configured code into the generated sandbox volume. The deployed source remains there until ordinary site cleanup. The sandbox URL may be public. If a repository enables wp-admin output, the reusable magic-login URL is disclosed into a GitHub comment and may also appear in GitHub notifications, API responses, and logs. On a public repository, that link is visible to everyone.

Webhook idempotency metadata is retained for the configured support period (normally 30 days). Disconnecting or uninstalling stops future commands and removes repository access; active preview sites expire normally unless the account owner explicitly requests deletion. GitHub may retain its own copies of comments and notifications under its policies.

Data retention

Sandboxes are ephemeral and are removed when they expire. Account and billing records are kept while your account is active and for as long as needed to meet legal and accounting obligations. Slack installation and account-link data is removed on uninstall or unlink, as described above. AI assistant connector tokens are kept until you revoke them or delete your account, as described under AI assistant connectors. You can request deletion of your account at any time.

Subprocessors

SandyWP runs on hosting virtual private servers (VPSs) that store the data described above, and uses a payment provider to process paid subscriptions. Slack Technologies operates the messaging platform the Slack app connects to. Anthropic (Claude) processes Slack mention text when natural-language interpretation is enabled. We do not share your data with third parties for their own purposes.

Your choices

You can access, correct, export, or delete your account data by contacting us. Where required by law, you may also object to or restrict certain processing.

Contact

Questions about privacy, or to exercise any of the rights above? Email [email protected].

Placeholder notice. SandyWP is operated by an individual during beta. The legal entity / data controller and a dedicated support address will be substituted here before general availability. Until then, the contact address above reaches the operator directly.