Last updated: 25 July 2026

Privacy Policy

This Privacy Policy explains how [PillDrops legal entity] ("PillDrops", "we", "us") collects, uses, shares and protects information when you use pilldrops.com, our sandboxes, SDKs, API, CLI, MCP server and related services (the "Service"). It also covers the code, files and data you run inside sandboxes ("Sandbox Content"), which we treat with particular care.

1. Who we are & scope

PillDrops provides isolated cloud sandboxes — dedicated microVMs — in which developers and AI agents run code. This policy applies to everyone who visits our website, creates an account, or uses the Service via the dashboard, SDK, API, CLI or MCP server. If you self-host PillDrops on your own infrastructure, you are the controller of the data processed by your deployment and this policy does not apply to it.

2. Information we collect

Account & identity

When you create an account we collect your email address and, depending on your sign-in method, your name and profile identifier from our authentication provider.

API keys & credentials

We generate and store API keys tied to your account so the SDK, API, CLI and MCP server can authenticate. Treat these as secrets; anyone with your key can act as you.

Sandbox Content

To run the Service we necessarily process the code, commands, files and data you upload to, generate in, or execute inside a sandbox. See Your code & sandbox data for how this is isolated and retained.

Usage & operational data

We record operational metadata about your sandboxes: template used, resource shape (vCPU, memory, storage), status, timestamps, runtime, resource-second consumption, per-sandbox cost, and process/exec logs and metrics needed to run, meter and secure the Service.

Billing information

Paid plans and credits are handled by a third-party payment processor. We receive billing metadata (plan, transaction status, the last digits/brand of a card) but we do not store full card numbers on our systems.

Cookies

We use a single, strictly-necessary HttpOnly session cookie to keep you signed in to the dashboard after login. We do not use advertising cookies.

Technical data

Like most services, our servers log IP address, request metadata, and basic device/browser information for security, abuse prevention and debugging.

3. How we use it

• Provide, operate and maintain the Service — create and run your sandboxes, expose preview URLs, stream logs and metrics.
• Meter usage and bill you accurately (per-second compute, storage, invocations).
• Authenticate you and secure your account and API keys.
• Detect, prevent and respond to abuse, fraud, security incidents and violations of our Terms.
• Provide support and send service-related communications.
• Maintain and improve reliability, performance and features.
• Comply with legal obligations and enforce our agreements.

We do not sell your personal data, and we do not use your Sandbox Content to train machine-learning models.

4. Your code & sandbox data

Each sandbox is an isolated microVM with its own kernel, filesystem and network identity. Your Sandbox Content is processed solely to run the Service for you:

• Ephemeral by default. A sandbox's filesystem is destroyed when the sandbox is destroyed or its session ends. Paused sandboxes retain their filesystem until resumed or torn down.
• Not mined for content. We do not read, analyze or repurpose the contents of your code and files except as strictly necessary to operate and secure the Service, or where required by law.
• History records. After a sandbox is destroyed we retain operational records about the run — template, runtime, resource-seconds, cost, and logs — so you can audit usage and we can bill and investigate abuse. These records describe the run; they are not a copy of your source files.

You are responsible for the code and data you place in a sandbox and for having the rights to process it. Do not upload personal data of others, or regulated/sensitive data, unless your own agreements and applicable law permit it.

5. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you request); legitimate interests (to secure, debug, prevent abuse and improve the Service); consent (where specifically requested, e.g. optional communications); and legal obligation (to meet accounting, tax and legal requirements).

6. How we share

We share information only as needed to run the Service:

Recipient category	Purpose
Cloud infrastructure providers	Host the platform and run sandbox compute, storage and networking.
Payment processor	Process payments and manage subscriptions and credits.
Authentication provider	Sign-in and identity verification.
Communications tools	Send transactional and support email.
Professional advisers & authorities	Where required by law, legal process, or to protect rights, safety and the Service.

These providers act as our processors under contract and may only use the data to provide their services to us. We may also disclose information in connection with a merger, acquisition or asset sale, subject to this policy. We do not sell personal information and do not share it for cross-context behavioral advertising.

7. Retention

• Sandbox filesystems: destroyed when the sandbox is destroyed or its session ends.
• Sandbox history & logs: retained for [retention period, e.g. 12 months] for auditing, billing and abuse investigation, then deleted or anonymized.
• Account & billing records: retained while your account is active and for as long as needed to meet legal, tax and accounting obligations.

8. Security

We protect data with isolated sandboxes (microVMs on KVM nodes), encryption of traffic in transit (TLS), server-enforced access controls and plan limits, and API keys that are never embedded in served pages. No method of transmission or storage is 100% secure; you are responsible for keeping your API keys and account credentials confidential and for notifying us promptly of any suspected compromise.

9. International transfers

We and our providers may process information in countries other than yours. Where we transfer personal data out of the EEA, UK or other regulated regions, we rely on appropriate safeguards such as Standard Contractual Clauses. Contact us for more information about the safeguards in place.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. If the GDPR/UK GDPR applies, you may also lodge a complaint with your supervisory authority. If the CCPA/CPRA applies, you may request to know, delete or correct your personal information and are entitled to non-discrimination for exercising these rights; because we do not sell or share personal information for advertising, there is no such activity to opt out of.

To exercise any right, email support@pilldrops.com. We may need to verify your identity before acting.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance.

13. Contact