diff --git a/tests/sandbox.py b/tests/sandbox.py
new file mode 100644
index 0000000..5d2a3f0
--- /dev/null
+++ b/tests/sandbox.py
@@ -0,0 +1,16 @@
+"""Imported first by every test module: nothing a test does reaches this person's
+app data, their telemetry, or the shared compatibility database.
+
+Must run before any ui module is imported, since those read these at import time.
+"""
+import atexit
+import os
+import shutil
+import tempfile
+
+_dir = tempfile.mkdtemp(prefix="frame-control-tests-")
+atexit.register(shutil.rmtree, _dir, ignore_errors=True)
+os.environ["FRAME_CONTROL_DATA_DIR"] = _dir
+os.environ["FRAME_CONTROL_TELEMETRY"] = "0"
+# A maintainer's machine holds the database key; send anything that slips through nowhere.
+os.environ["FRAME_COMPAT_DB_URL"] = "http://127.0.0.1:9"
diff --git a/tests/test_compat_db.py b/tests/test_compat_db.py
index 7081d79..37208d5 100644
--- a/tests/test_compat_db.py
+++ b/tests/test_compat_db.py
@@ -2,6 +2,7 @@
 
 Run: python3 -m unittest discover -s tests
 """
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import os
 import sys
 import tempfile
diff --git a/tests/test_connect.py b/tests/test_connect.py
index b3366bd..0e8972a 100644
--- a/tests/test_connect.py
+++ b/tests/test_connect.py
@@ -3,6 +3,7 @@ steamos-devkit-service, the ~/.ssh/config block, and the mDNS output parsers.
 
 Run: python3 -m unittest discover -s tests
 """
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import json
 import socket
 import sys
diff --git a/tests/test_frame_apk.py b/tests/test_frame_apk.py
index 1af14f9..ebe7b0b 100644
--- a/tests/test_frame_apk.py
+++ b/tests/test_frame_apk.py
@@ -1,4 +1,5 @@
 """frame_apk against a small APK built here: binary manifest plus resource table."""
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import io
 import os
 import struct
diff --git a/tests/test_frame_apk_versions.py b/tests/test_frame_apk_versions.py
index 508ddcf..ea70373 100644
--- a/tests/test_frame_apk_versions.py
+++ b/tests/test_frame_apk_versions.py
@@ -1,4 +1,5 @@
 """Offline version lookup with small index-v2 fixtures."""
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import io
 import json
 import os
diff --git a/tests/test_frame_titles.py b/tests/test_frame_titles.py
index 55d080d..acb9454 100644
--- a/tests/test_frame_titles.py
+++ b/tests/test_frame_titles.py
@@ -1,4 +1,5 @@
 """frame_titles without a headset: executable headers, launch targets, zips, runtimes."""
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import json
 import os
 import shutil
diff --git a/tests/test_server.py b/tests/test_server.py
index ec389bd..1bb565d 100644
--- a/tests/test_server.py
+++ b/tests/test_server.py
@@ -5,6 +5,7 @@ request guards and input validation, which all run before any SSH call.
 
 Run: python3 -m unittest discover -s tests
 """
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import http.client
 import io
 import json
diff --git a/tests/test_steam.py b/tests/test_steam.py
index d29d975..615bf1e 100644
--- a/tests/test_steam.py
+++ b/tests/test_steam.py
@@ -2,6 +2,7 @@
 
 Run: python3 -m unittest discover -s tests
 """
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import json
 import subprocess
 import sys
diff --git a/tests/test_telemetry.py b/tests/test_telemetry.py
index 6a033c7..4b400c6 100644
--- a/tests/test_telemetry.py
+++ b/tests/test_telemetry.py
@@ -3,6 +3,7 @@ what's scrubbed, and that nothing is sent without a key, the notice, or consent.
 
 Run: python3 -m unittest discover -s tests
 """
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import json
 import os
 import sys
diff --git a/tests/test_webinstall.py b/tests/test_webinstall.py
index 1858297..e197b49 100644
--- a/tests/test_webinstall.py
+++ b/tests/test_webinstall.py
@@ -4,6 +4,7 @@ the localhost-testing rule allows.
 
 Run: python3 -m unittest discover -s tests
 """
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import hashlib
 import json
 import os
diff --git a/ui/frame_host.py b/ui/frame_host.py
index a60b82c..a3842f3 100644
--- a/ui/frame_host.py
+++ b/ui/frame_host.py
@@ -33,8 +33,11 @@ class HostError(RuntimeError):
 
 
 def data_dir(*parts):
-    """Per-user app data: ~/Library/Application Support, %APPDATA% or $XDG_DATA_HOME."""
-    if MAC:
+    """Per-user app data: ~/Library/Application Support, %APPDATA% or $XDG_DATA_HOME
+    (or $FRAME_CONTROL_DATA_DIR, which the tests point at a throwaway directory)."""
+    if os.environ.get("FRAME_CONTROL_DATA_DIR"):
+        base = Path(os.environ["FRAME_CONTROL_DATA_DIR"])
+    elif MAC:
         base = Path.home() / "Library" / "Application Support" / "Frame Control"
     elif WINDOWS:
         base = Path(os.environ.get("APPDATA") or Path.home() / "AppData" / "Roaming") / "Frame Control"