Who we are
Spawn ("we", "us") provides the Spawn website, dashboard, API and sandbox infrastructure (together, the "Service"). We are the controller of the personal data described in this policy. For data inside your sandboxes, we act on your behalf as a processor.
What we collect
Account information
You sign in with GitHub or Google, which share your name, email address, profile picture and account ID with us. We do not receive your password. To connect repositories, you also link a GitHub account.
GitHub App and repository data
If you install our GitHub App, we store the installation ID, the account or organization it belongs to, the permissions you granted, and metadata about the repositories you make available (such as name, visibility, default branch and the commits you pin to a project). We never store the short-lived access tokens GitHub issues for the installation. Repository contents are only fetched into a sandbox when you run a project.
Content you run
The code, commands, files and environment variables you send to a sandbox, and the output it produces (stdout, stderr and exit codes), which we keep as execution logs.
Usage and billing
Sandbox runs, execution time, resource usage and your credit balance, so we can meter usage per second and show it in your dashboard.
API keys
We show an API key only once, when you create it. We store a one-way hash of it, never the key itself.
Security and audit logs
Actions taken on your account (for example creating a key or starting a sandbox), with the time, IP address, user agent and request ID.
Things you send us
Feedback, support requests and any other messages you choose to send.
How we use it
- To provide the Service: authenticate you, run your sandboxes and return their results.
- To meter usage, apply credits and show you what ran and what it cost.
- To keep the Service and other users safe: detect abuse, investigate incidents and enforce our Terms of Service.
- To debug problems and improve reliability and performance.
- To contact you about your account, the beta and important changes.
We process data because it is necessary to provide the Service you asked for, for our legitimate interest in operating it securely, and where required by law.
Your code and sandbox data
Your code is yours. Each run executes in its own Firecracker microVM, and the VM is destroyed when the run ends unless you keep it alive as a persistent session.
We do not read your code, files or output except when necessary to operate the Service, investigate abuse or a security incident, help you when you ask us to, or comply with the law. We do not use your code or sandbox data to train machine-learning models.
How long we keep it
We keep account data for as long as your account exists. Execution logs, usage records and audit logs are kept for as long as needed to operate the Service, resolve disputes, prevent abuse and meet legal obligations, then deleted or anonymized. When you delete your account, we delete or anonymize your personal data unless we must keep it by law.
Security
Sandboxes are isolated with hardware virtualization, API keys are stored only as hashes, and access to production systems is restricted. No system is perfectly secure; if you find a vulnerability, please report it to [contact email].
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we process it. You can delete API keys and disconnect the GitHub App at any time from your dashboard or from GitHub. For anything else, email [contact email] and we will respond within 30 days. You may also complain to your local data protection authority.
Children
The Service is not directed to children, and you must be at least 16 years old to use it. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
The Service is in private beta and this policy will evolve with it. We will update the effective date above when it changes, and notify you by email or in the dashboard before material changes take effect.
Contact
Questions about this policy or your data: [contact email].