Privacy Policy

To use the Services you authenticate through our login provider. In doing so:

• Wallet address. Logging in provisions or connects an embedded wallet. We store its public address as your account identifier. We never have custody of your private key, recovery phrase, or seed.
• Email address (optional). If you sign in or receive billing notices by email, we store that address to identify your account and contact you about your account, billing, and security.

Payments and prepaid top-ups are processed by our third-party payment processor (Stripe). Card numbers and similar payment details are submitted directly to the processor and are handled under its privacy policy — we do not receive or store your full card number. We retain a billing email, the processor's customer and payment-method identifiers, and a ledger of your credit balance, top-ups, and metered usage, which we need to operate the prepaid wallet and meet our tax and accounting obligations.

When you use the Services, we collect operational data needed to run and secure them, including IP address, request and authentication logs, sandbox lifecycle events (boot, stop, tear-down), resource-usage metrics used to meter billing, and basic device and browser information. We use this for security, abuse prevention, debugging, billing accuracy, and capacity planning.

Your sandboxes are disposable and private to you. We do not read, inspect, mine, or use the code, commands, files, or data inside your sandboxes to train or improve machine-learning or AI models. Sandbox contents are destroyed when the sandbox is stopped or torn down; we do not back them up. We may access a sandbox only where necessary to operate the infrastructure, respond to a support request you make, comply with law, or investigate a suspected violation of our Terms of Service.

We use the limited information we hold to:

• Authenticate you and provide, maintain, and secure the Services;
• Meter usage, manage your prepaid balance, and process top-ups;
• Send account, billing, and security notices;
• Detect, prevent, and respond to fraud, abuse, and security incidents;
• Comply with legal, tax, and accounting obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

We share information only with:

• Service providers that operate the Services on our behalf — for example our payment processor, login provider, cloud infrastructure, and error and logging tools — under contracts that limit their use of it;
• Legal and safety recipients, where we believe in good faith that disclosure is required by law, legal process, or to protect the rights, property, or safety of Tribes, our users, or the public;
• A successor in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We keep account and billing records (wallet address, email, and the usage and payment ledger) for as long as your account is active and afterward as needed to meet legal, tax, and accounting obligations and to resolve disputes. Operational logs are retained for a limited period and then deleted or aggregated. Sandbox contents are not retained — they are destroyed when the sandbox stops.

We use commercially reasonable technical and organizational measures to protect the information we hold. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. You are responsible for safeguarding your wallet, recovery phrase, and login method; we cannot recover them for you.

Depending on where you live, you may have the right to access, correct, delete, or export the personal information we hold about you, or to object to or restrict certain processing. To make a request, contact us at the address below; we may need to verify your control of the relevant wallet or email. Note that some records must be retained to meet legal and accounting obligations, and that deleting your account does not recover sandbox data, which is already destroyed on stop.

We operate in the United States, and the information we hold may be processed there and in other countries where we or our service providers operate. Those jurisdictions may have different data-protection laws than yours. By using the Services, you understand that your information may be transferred to and processed in those locations.

The Services are not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this Policy from time to time. If we make material changes, we will post the updated Policy and update the "Last updated" date, and where practicable give notice in-product or by email. Your continued use of the Services after changes take effect means you accept the updated Policy.

Questions or privacy requests can be sent to support@tribes.xyz.