Privacy Policy

In short

A benchmark about privacy should not be sloppy with yours. privacybench (the "controller", "we") collects the minimum needed to run accounts and billing. There are no advertising or analytics trackers on privacybench, no third-party fonts or scripts are loaded in your browser, and we do not sell personal data.

What we collect

• Account data. Your email address and, if you sign in with Google, your name and Google account identifier. If you register with a password, only a salted hash of it is stored, never the password itself.
• Sessions. When you sign in we store a hash of your session token, its creation and expiry time.
• API keys. Only a hash of each key, its label, when it was created and last used, and request counts needed to apply rate limits.
• Billing records. If you subscribe: your plan, subscription status, renewal or end date, and Lemon Squeezy's customer and subscription identifiers, plus the webhook messages Lemon Squeezy sends us about your subscription (which include your email address). We do not receive or store full card numbers.
• Server logs. Our web server records standard request logs (IP address, time, page requested, user agent) for security and abuse prevention.
• What you type into "Check your app". The app name you search for is sent to Apple's public search endpoint to find the app. It is sent without your account details.

We do not collect the content of your Google account, your contacts, or your browsing outside this site.

Why we use it

• To create and secure your account and to sign you in (contract).
• To provide, bill and support paid plans and enforce plan limits (contract).
• To keep the service secure and prevent abuse (legitimate interests).
• To meet tax, accounting and legal obligations (legal obligation).

Cookies

We set only strictly necessary cookies: a session cookie that keeps you signed in (HTTP-only, and marked Secure over HTTPS) and a short-lived cookie that protects the Google sign-in redirect against forgery. There are no analytics or advertising cookies, so there is no cookie banner to accept.

Who else handles data

• Google, if you choose "Continue with Google": authenticates you and gives us your basic profile. Governed by Google's privacy policy.
• Lemon Squeezy, our merchant of record, for payments, tax and invoices. It acts as an independent controller for payment data under its own privacy policy.
• Our hosting provider (Hetzner) runs the servers and database.
• Apple, Google Play and Exodus Privacy are queried for app information. No personal data about you is sent to them.

We do not sell your data and do not share it for advertising.

How long we keep it

• Account data: until you delete your account.
• Sessions: until they expire (30 days) or you log out.
• Billing records: as long as needed for tax and accounting law, typically several years.
• Server logs: a short rolling period, unless needed to investigate abuse.

Your rights

Depending on where you live (including under the GDPR), you can ask us to access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw consent where we rely on it. To delete your account, or to exercise any other right, email [email protected] from the address on the account. You may also complain to your local data protection authority.

Security

Traffic is encrypted with HTTPS. Passwords, session tokens and API keys are stored only as hashes. Access to the database is restricted. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

Children

The service is not for anyone under 16 and we do not knowingly collect their data.

Changes

We will post changes here with a new "last updated" date and, for material changes affecting account holders, notify them by email.

Contact

privacybench
[email protected]