Privacy Policy

If you create an account we store your email address and a password hash. If you sign in with Google we store the email address Google gives us. We do not store your Google password, and we do not receive it.

We use your email to sign you in and to contact you about the service.

When your agent calls a FetchSandbox tool, we record one event. That event contains: a session id, the tool name, whether it succeeded, how long it took, which API spec was involved, the spec URL, your IP address and your user agent.

The session id is a random identifier generated on your machine and stored at ~/.fetchsandbox/session.json. It is not derived from anything about you.

We do not record spec contents and we do not record request bodies. We record spec URLs so we can see which APIs people bring to the platform.

To turn this off entirely, set FETCHSANDBOX_TELEMETRY=0. The client then sends no session id and the event is recorded as anonymous.

Two tools read your source code: one that looks for bugs in a repository, and one that proposes a fix. When you call them, the code you point them at is sent to our analysis service and read by a large language model.

We do not train any model on your code. We keep the working copy only for as long as the job runs, and delete it when the job finishes. Findings and diffs we return to you are retained with your run history so you can re-read them.

These tools are never invoked on their own. They run only when your agent calls them, on the path you give it.

A sandbox holds the records your test traffic creates. That data is yours, lives in the sandbox, and is discarded when the sandbox is removed.

A receipt is a page describing what a run did. Receipts are reachable by anyone who has the link, so treat a receipt URL as shareable.

We use PostHog to understand how the site and the tools are used, and Sentry to collect errors so we can fix them. Both receive an IP address and browser details. Neither receives your source code.

We share data with the services that make the product run, and with nobody else:

• Anthropic — processes code and text for the analysis and fix tools
• PostHog — product analytics
• Sentry — error reporting
• Google — sign-in, only if you use it
• Amazon Web Services and Cloudflare — hosting and delivery

We do not sell your data, and we do not share it for advertising.

Account data is kept until you ask us to delete it. Usage events and run history are kept while the account is active. Working copies of your code are deleted when the job that used them finishes.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and its data. Email [email protected] and we will action it.

You can stop telemetry at any time without an account change, using the environment variable above.

FetchSandbox is a tool for software developers. It is not directed at children.

If this policy changes in a way that affects what we collect, we will update the date at the top of this page.

FetchSandbox — [email protected]