Privacy Policy

test.sushii.dev is a public sandbox for testing UI components, form controls, and cybersecurity workflows.

When you use the password testing feature and click "Check against Postgres database," your submitted password is:

• Transmitted over HTTPS to our server for the purpose of the check
• Hashed with SHA-256 on the server before being compared against a Postgres database of known weak and commonly compromised password hashes
• Not stored in plaintext and not logged after the request completes
• Never associated with any identity

The Postgres database contains only pre-computed hashes of publicly known weak passwords. It exists solely to help security researchers, developers, and testers evaluate password hygiene in a controlled environment.

The IP Logger lab lets you generate unique links (for example /log/xxxxxxxx) for authorized security testing and developer education. When someone opens a link you created:

• They see a disclosure page explaining that the visit was logged
• We record IP address, approximate location (via a third-party geo lookup), browser user agent, referrer, and timestamp
• Data is stored in Postgres and retained for up to 30 days, or until you delete the link
• Only the browser that created the link can view visit logs, verified via an HttpOnly cookie

You must accept our Terms of Service and this Privacy Policy before creating a link. Do not use IP logger links for deceptive tracking, harassment, or unlawful purposes.

• No email addresses unless you voluntarily type them into form test fields (not submitted to our servers)
• No file uploads — file inputs are processed entirely in your browser

Like most web services, our hosting provider (Vercel) may process standard request metadata such as IP address, user agent, and timestamps for security, rate limiting, and operational purposes. Password check requests are rate-limited to 20 per minute per IP address.

Most UI state lives in your browser session only. The IP Logger feature sets an HttpOnly cookie (iplog_access) so only your browser can access stats for links you created. This cookie does not identify you personally and is not used for advertising.

We use Vercel for hosting and a Postgres-compatible database provider for the known-password hash lookup table. No advertising or analytics trackers are intentionally embedded.

This is a testing environment. Do not submit real production passwords you actively use elsewhere. Use synthetic or rotated test passwords only.

Questions about this policy can be directed to privacy@test.sushii.dev.