Sand Pit Online

Privacy Policy

Last updated: June 18, 2026

Sand Pit Online ("Sand Pit Online", "we", "us", or "our") operates the website https://sand-pit.io (the "Service"), a free, creative web application in which users design and share simulated "substances" and "pits". Sand Pit Online is operated by an individual independent developer. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have. By using the Service, you agree to the practices described here.

1. Information We Collect

Information you provide

  • Account information. When you create an account, we collect your email address and a display name (username) of your choosing. If you create a native (non-Google) account, we collect a password, which we store only as a salted cryptographic hash — we never store your password in readable form.
  • User-generated content. The substances, pits, interactions, names, and descriptions you create. Content you choose to upload or share is publicly visible to other users along with your display name.

Information collected automatically

  • Authentication cookie. When you sign in, we set a single secure, HTTP-only session cookie containing a signed token (JWT) so the Service can keep you logged in. This cookie is strictly necessary for the Service to function and is not used for advertising or tracking.
  • Anonymous download counts. To count downloads of shared content without identifying anonymous visitors, we store a one-way SHA-256 hash of the downloader's IP address. We do not store the raw IP address for this purpose, and the hash is not used to build a profile of you.

2. How We Use Your Information

  • To create and maintain your account and keep you signed in.
  • To store, display, and share the content you create.
  • To send you transactional emails only — specifically account verification and password-reset messages. We do not send marketing email.
  • To protect the Service against spam and abuse (see reCAPTCHA below).
  • To measure aggregate, non-identifying download activity for shared content.

3. Legal Bases for Processing (EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases under the GDPR: performance of a contract (to provide the Service you request), legitimate interests (to secure the Service, prevent abuse, and measure usage in a privacy-preserving way), consent (where required, such as for advertising cookies set by our advertising partner), and compliance with legal obligations.

4. Cookies and Advertising

We use a strictly necessary authentication cookie as described above. In addition, the Service displays advertising provided by Google AdSense.

  • Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites.
  • Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and/or other sites on the internet.
  • You can learn how Google uses information from sites or apps that use its services at policies.google.com/technologies/partner-sites, and how Google uses cookies in advertising at policies.google.com/technologies/ads.
  • You may opt out of personalized advertising by visiting Google's Ads Settings. You can also opt out of some third-party vendors' use of cookies for personalized advertising at aboutads.info/choices or youronlinechoices.eu.

5. Third-Party Services

We rely on the following third parties to operate the Service. Each handles your data under its own privacy policy:

  • Google AdSense — advertising (see Section 4). Google Privacy Policy.
  • Sign in with Google (Google OAuth) — if you choose to sign in with Google, Google shares a limited set of profile information (such as your email address) with us to create or access your account. We use this information only to authenticate you and operate your account. Your use of Google sign-in is subject to the Google Privacy Policy.
  • Google reCAPTCHA — we use reCAPTCHA to protect account signup from automated abuse. reCAPTCHA collects hardware and software information and sends it to Google for analysis. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.
  • Amazon Web Services (AWS) — we use AWS to host the Service and to send transactional email via Amazon Simple Email Service (SES). AWS Privacy Notice.

6. How We Share Information

We do not sell your personal information. We share information only as needed to operate the Service: with the third-party service providers listed above, with other users for the content and display name you choose to make public, and where required by law or to protect the rights, safety, or property of Sand Pit Online or others.

7. Data Retention

We retain your account information and content for as long as your account is active. If you delete your account or specific content, the associated data is deleted, except that content others have downloaded may persist in their own libraries, and aggregate, non-identifying download counts may remain. Hashed IP values used for download counting are retained only as long as needed for that purpose.

8. Your Privacy Rights

EEA/UK (GDPR)

You have the right to access, correct, delete, restrict, or object to our processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA)

California residents have the right to know what personal information we collect and how we use it, the right to request deletion or correction of their personal information, and the right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money. Certain uses of advertising cookies may be considered "sharing" under California law; you can limit this through the advertising opt-out controls in Section 4. We will not discriminate against you for exercising any of your rights.

To exercise any of these rights, contact us at support@sand-pit.io. We may need to verify your identity before acting on a request.

9. Children's Privacy

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us so we can remove it.

10. International Data Transfers

The Service is hosted on AWS infrastructure and may process and store data in the United States and other countries. By using the Service, you understand that your information may be transferred to and processed in countries whose data-protection laws may differ from those of your country.

11. Security

We use reasonable technical measures to protect your information, including hashing passwords and serving the Service over HTTPS. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be reflected on this page; your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or your data, contact us at support@sand-pit.io.