← River Sandbox

Privacy policy

Last updated 19 October 2026

River Sandbox (riversandbox.com) is a free river-flow simulator. You can use it without an account. This page says what is stored when you create one.

Using River without an account

The simulation runs in your browser. Scenes you save in This browser stay on your device (in IndexedDB) and are never sent to us. Setting up a map makes your browser contact public data providers directly (for example USGS, Microsoft Planetary Computer, OpenTopoMap and Amazon S3); those providers see your IP address and the area you request, under their own policies.

What we store when you have an account

• Your email address and, if you sign in with Google or GitHub, the display name that provider gives us. We do not receive or store your Google or GitHub password or access token.
• Sign-in records: a hashed session token (kept for 30 days or until you sign out), single-use email-link tokens (hashed, valid 15 minutes) and, for passkeys, the public key, the name you give it and when it was used. Private keys never leave your device.
• Cloud scenes: the scene file, its name and basic details (map name, size, dates) for scenes you choose to save to the cloud.
• Sharing: hashed share-link tokens, and who you have given view or edit access. Reports you file on gallery scenes (your account and your note).
• Abuse limits: short-lived counters keyed by a hash of your IP address or email, used to rate-limit sign-in and sharing requests.
• Cookies:
  • __Host-river_session keeps you signed in. Scripts cannot read it (HttpOnly), and it lasts 30 days or until you sign out.
  • __Host-river_signed_in holds only “1”, so the home page can show “My account”. It carries no identity and ends with the session.
  • __Host-river_oauth exists only during a Google or GitHub sign-in, for at most 10 minutes, to check the provider’s reply.
  All are strictly necessary and not used for tracking. There are no advertising or analytics cookies.

Who can see your scenes

New cloud scenes are private. Anyone with a public link you create can view that scene. People you add by email can view or edit it as you choose. A scene set to gallery is listed publicly with its name, map name and your display name (never your email). You can make a scene private again or revoke a link at any time.

Who processes data for us

• Cloudflare hosts the site, the database and file storage, and handles requests and standard network logs.
• Resend delivers sign-in emails, so it receives your email address.
• Google and GitHub authenticate you only if you choose those options.

We do not sell your data or use it for advertising.

Keeping and deleting data

Data stays until you delete it or ask us to. You can delete cloud scenes, revoke links and remove passkeys in the app. Account → Your data lets you download a copy of your data and delete your account with everything stored in it (scenes, links, grants and sign-in records). You can also email privacy@riversandbox.com from the address on the account and we will do it for you.

Children

River Sandbox is not directed at children under 13, and we do not knowingly collect their data.

Changes and contact

We will update this page and its date if this changes. Questions: privacy@riversandbox.com.