Data controls
Three settings decide what froog keeps. Set them for the whole account under Data & privacy in the dashboard (an API key can read them, froog data-retention, but can't change them: 403 session_required), or per sandbox when you create it.
| Setting | What froog doesn't keep | Can it be started again? |
|---|---|---|
Monitoring off · froog new --no-monitoring | Command history and output, process samples and records, metrics history. exec and live job output still work, but history calls answer 409 monitoring_off. | Yes |
Snapshots off · froog new --no-snapshots | Any copy of the disk: no automatic or saved snapshots, no fork or restore (409 snapshots_off). A stop erases the sandbox. | No |
| Zero data retention (account only) | Anything after a stop: each stop erases the sandbox's disk, snapshots and history, and saved snapshots aren't kept. Turning it on erases every stopped sandbox and saved snapshot right away, so it asks you to type delete stopped sandbox data. Running sandboxes still get automatic snapshots. | No |
Account settings apply to sandboxes created from then on. A fork keeps its source's monitoring setting unless you pass monitoring. With monitoring off on the account, asking for monitoring: true gets 409 monitoring_off_for_account (likewise snapshots_off_for_account). Deleting a sandbox always erases its history. Turning on zero data retention answers with deletion_operation, the id of a deletion operation that follows the erasures until they're done.
Close your account
froog account close, Close account under Data & privacy in the dashboard, or POST /v1/account/close with the header X-Froog-Confirm-Close set to your account's email (without it: 409 confirmation_required). It needs a full-access key or a dashboard session. Closing does all of this at once:
- It cancels your plan now, not at the end of the period, with no refund. Auto top-up and extra starts turn off.
- It stops every running sandbox. Each stop saves the disk.
- It revokes every API key and every other dashboard session. The session you closed from stays signed in.
- It sends you an email with the date your data is erased.
For 30 days a closed account can sign in, read its account, billing and usage, and reopen. Anything else answers 403 account_closed. froog account reopen (after froog login), Reopen in the dashboard or POST /v1/account/reopen brings it all back except the plan: choose one again to start sandboxes, with no second trial. After 30 days froog erases its sandboxes, snapshots and personal data, as froog-server admin delete-account does, and keeps usage and invoice records under the anonymous account id. A wallet that owes money holds the erasure until that's settled.
Deletion operations. Closing answers 202 with {account, operation}. The operation's id starts with dop_. froog deletion status dop_… or GET /v1/deletion-operations/{id} shows it: kind (account_close or zero_data_retention), status (pending, processing, blocked, completed or canceled), stage (waiting_for_reopen_window, removing, retrying, completed or reopened), expected_by (when the erasure is due) and error. blocked is not final: it's retried every minute.