Privacy Policy

In short

A benchmark about privacy should not be sloppy with yours. privacybench (the "controller", "we") collects the minimum needed to run accounts and billing. There are no advertising or analytics trackers on privacybench, no third-party fonts or scripts are loaded in your browser, and we do not sell personal data.

What we collect

• Account data. Your email address and, if you sign in with Google, your name and Google account identifier. If you register with a password, only a salted hash of it is stored, never the password itself.
• Sessions. When you sign in we store a hash of your session token, its creation and expiry time. At registration and at each sign-in we also store the IP address, the browser and the language header. Staff can see those on the client page. They are not shown on your own account page.
• API keys. Only a hash of each key, its label, when it was created and last used, and request counts needed to apply rate limits.
• Billing records. If you subscribe: your plan, subscription status, renewal or end date, and Lemon Squeezy's customer and subscription identifiers, plus the webhook messages about your subscription. We do not receive or store full card numbers.
• Server logs. Our web server records standard request logs (IP address, time, page requested, user agent) for security and abuse prevention.
• What you type into Check an app. The app name you search for is sent to Apple's public search endpoint to find the app. It is sent without your account details.
• Where you came from at sign-up. The website that linked you to us (its domain only), any campaign tags in that link (utm), and which of our pages you signed up from. Stored once on your account, read by staff to see which pages bring customers. No tracking cookie is used; only during a Google sign-in is it held for up to ten minutes in a cookie that ends with that sign-in.

We do not collect the content of your Google account, your contacts, or your browsing outside this site.

Why we use it

• To create and secure your account and to sign you in (contract).
• To provide, bill and support paid plans and enforce plan limits (contract).
• To keep the service secure and prevent abuse (legitimate interests).
• To meet tax, accounting and legal obligations (legal obligation).

Cookies

We set only strictly necessary cookies: a session cookie that keeps you signed in, a short-lived cookie that protects the Google sign-in redirect against forgery, your language choice, and small cookies that remember a notice or the tour you closed. There are no analytics, tracking or advertising cookies, so there is nothing to consent to.

Who else handles data

• Google, if you choose to sign in with Google: authenticates you and gives us your basic profile. Governed by Google's privacy policy.
• Lemon Squeezy, our merchant of record, for payments, tax and invoices. It acts as an independent controller for payment data under its own privacy policy.
• Our hosting provider runs the servers and the database.
• Apple, Google Play and Exodus Privacy are queried for app information. No personal data about you is sent to them.

We do not sell your data and do not share it for advertising.

How long we keep it

• Account data: until you delete your account.
• Sessions: until they expire or you log out.
• Billing records: as long as needed for tax and accounting law.
• Server logs: a short rolling period, unless needed to investigate abuse.

Your rights

Depending on where you live, you can ask us to access, correct, export or delete your personal data, and to object to or restrict certain processing. To delete your account, or to exercise any other right, email us from the address on the account. You may also complain to your local data protection authority. [email protected].

Security

Traffic is encrypted with HTTPS. Passwords, session tokens and API keys are stored only as hashes. Access to the database is restricted. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

Children

The service is not for anyone under 16 and we do not knowingly collect their data.

Changes

We will post changes here with a new last-updated date and, for material changes affecting account holders, notify them by email.

Contact

privacybench
[email protected]