Privacy.

Two sites, two roles

This notice covers the Ergo project’s information site at www.ergosandbox.com and the hosted sandbox at ergosandbox.com. The project is maintained by ngrislain on GitHub.

The information site is static and hosted on GitHub Pages. Its fonts, scripts, and shared Rust/WASM brick renderer are served with the site. It does not run advertising or analytics scripts, set application cookies, or store your token. Interactions with the brick illustration stay in browser memory. The lighting uses the illustration's world coordinates and current UTC time; it does not request your device's location.

Authentication and construction tools run on the separate sandbox origin. Links to Google, GitHub, or the sandbox take you to those services.

Your account

When you choose Google sign-in, the sandbox verifies your Google identity and receives a stable account identifier, verified email address, display name, and an optional profile-picture URL. It stores an application identifier derived from the Google identifier, those profile fields, creation time, and last sign-in time.

These fields support sign-in, ownership, access decisions, and your account display. Hashing the Google identifier does not make the stored profile anonymous. The server does not persist Google access or refresh tokens, and it does not receive your Google password.

Your constructions and activity

The sandbox stores constructions you publish, accepted revisions, ownership and sharing rules, user profiles, and edit-allowance records in Scaleway Object Storage. Requests also expose ordinary connection information, such as an IP address and user agent, to the hosting providers; operational logs may contain request metadata.

Local MCP drafts stay in the workspace you choose until you publish them. Shared-world access follows the world’s current policy. New MCP-created worlds allow other signed-in identities to read and edit by default; an owner/grant-only world can be created with authenticated_editing: false. Do not use shared constructions to store secrets or information you are not entitled to share.

Constructions, immutable revisions, and permission records are separate from your sign-in profile. Removing a local file or logging out does not remove previously published data.

Cookies, caching, and agent tokens

The sandbox uses necessary, signed, HttpOnly cookies for the Google sign-in flow and application sessions. On HTTPS these cookies are Secure and SameSite=Lax. Current sessions expire after seven days. The static information site does not need access to these cookies.

The sandbox can cache downloaded model assets on your device for performance. Its logout flow clears the application’s model caches and browser cache/storage state. Authentication responses and profile/world-list responses are not put in the service-worker cache.

Agent delegations are created only after an explicit request from a signed-in user. A delegation normally lasts one hour, cannot exceed 24 hours or the issuing session’s expiry, and is bound to the sandbox origin. The token is held in the setup page’s memory until you copy or download it; it is not saved in local or session storage by that page.

A downloaded token file is a credential you manage. Give it only to an agent you trust. Logging out does not individually revoke an existing delegation; expiry or a server signing-key rotation invalidates it. Individual token revocation is not currently implemented.

Service providers

GitHub serves this information site and processes connection data according to its privacy statement. Scaleway hosts the sandbox and its object storage in the Paris region. Google handles the sign-in you initiate.

The sandbox may request satellite imagery from Esri, part assets from the LDraw library, and profile images from the URL provided by Google. The sandbox interface also loads its typography from Google Fonts. Those services receive the requests made to them. These are sandbox features; the static brick illustration does not request map tiles, part-library assets, or account information.

Retention, requests, and updates

Profiles and published construction records are retained to operate the sandbox and its versioned worlds. There is no automatic account-deletion workflow or fixed deletion schedule promised by this experimental service. Immutable history, shared ownership, retention rules, and operational copies may affect what can be removed.

To ask about your information, request a correction or removal, or report a privacy concern, contact the project maintainer and ask for a private channel. Do not put credentials, private account details, or the data you want removed into a public issue.

This notice will be updated as the service changes. The effective date above identifies the current version. See also the terms of use and the technical identity documentation.