Privacy Policy

1. Overview

infratmp.dev is designed to be privacy-respecting by default. The Service requires no account creation and sets no cookies. We collect the minimum data necessary to keep the Service available and fair for everyone.

2. Data We Collect

We collect and process the following data when you use the Service:

• Hashed IP address — a one-way SHA-256 hash of your IP address. We never store your raw IP address.
• Country — your approximate country of origin derived locally from your IP address using the MaxMind GeoLite2 country database. No city, region, or precise location data is retained.

Both values are used exclusively for rate limiting and abuse prevention.

3. Data We Do Not Collect

• No cookie of any kind (session, persistent, or third-party)
• No browser fingerprinting
• No analytics (no Google Analytics, Plausible, Mixpanel, or equivalent)
• No advertising identifiers
• No cross-site or cross-session tracking
• No raw IP addresses

4. How We Use Data

The hashed IP address and country are used solely to:

• Enforce per-IP rate limits on sandbox creation
• Detect and block abusive traffic patterns

This data is not shared with any third parties for any purpose, including advertising, analytics, or profiling.

5. Data Storage & Retention

All data is stored on servers operated by Hetzner Online GmbH in Falkenstein, Germany (European Union). The hashed IP and country data are stored in Redis with a rolling 24-hour TTL and are not written to persistent disk or long-term backup storage.

6. Lawful Basis (GDPR)

Our lawful basis for processing is Legitimate Interest under Article 6(1)(f) of the GDPR: protecting the Service from abuse and enforcing fair-use rate limits that allow all users equitable access.

We have conducted a balancing test and concluded that this interest is not overridden by your fundamental rights and freedoms, given that:

• Only a non-reversible hash (not a raw IP) is stored
• Retention is limited to 24 hours
• Data is used only for security purposes, not commercial gain
• The processing is transparent and disclosed in this policy

7. Your Rights

Under the GDPR, you have the right to access, rectify, and erase data held about you. Because we store only a non-reversible SHA-256 hash of your IP address (not the IP itself), we are unable to link stored data back to a specific individual to fulfil an erasure request. This is by design — the hash cannot be reversed to identify you.

If you have questions or concerns about your rights, please reach out via the feedback link.

8. Third-Party Services

• Cloudflare Turnstile — We use Cloudflare Turnstile for bot protection on our feedback and waitlist forms. This involves a limited data exchange with Cloudflare. See Cloudflare's Privacy Policy.
• MaxMind GeoLite2 — A local copy of the GeoLite2 country database is used for IP geolocation. No data is sent to MaxMind servers during request processing.
• Hetzner Online GmbH — Our infrastructure provider in Germany. Hetzner processes data as a data processor under a Data Processing Agreement (DPA).
• Google Fonts — This page loads the Inter typeface from Google Fonts. Visiting this page causes your browser to make a request to Google's CDN. See Google's Privacy Policy for details.

No other third parties receive your data.

10. Changes to This Policy

We may update this Privacy Policy at any time. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this page periodically.

11. Contact

Questions about this Privacy Policy? Use the feedback link in the navigation.