Your data at the workbench

When you use a room, Benchmark stores:

• The name you type when you take a seat, and whether you’re voting or observing.
• Your cards for each round, plus story titles, final estimates and who voted what (shown in exports).
• Room settings such as the deck, timer and who can join. Room passcodes are stored only as a one-way hash.
• A seat id and a secret seat token that keep you in your seat. Your browser keeps them on your device for each room you join (local storage, up to 3 days), so you return to the same seat and your votes, along with your name, your seat tool and the rooms you recently used, so you don’t retype them and can rejoin from the home page. The recent-rooms list never leaves your browser; remove rooms from it on the home page.

• Abuse protection: to rate-limit requests, we keep a short one-way hash of your IP address with a counter. Counters expire within an hour, and the original address isn’t stored.
• Hosting logs: our host, Vercel, processes technical request details (such as IP address and browser) to deliver the site and keep it secure.
• Analytics: we use Vercel Web Analytics and Speed Insights to count page views and measure page speed. They don’t use cookies, and room codes are removed from page addresses before anything is sent.
• Usage insights: we use Microsoft Clarity to understand how people use Benchmark and to fix what’s confusing. It records clicks, scrolling and mouse movement as heatmaps and session replays, along with page addresses, device and browser details. Inside rooms, all text (names, story titles, cards and notes) is masked before anything is sent, and summary pages aren’t recorded at all. Clarity sets cookies (_clck and _clsk) to recognise repeat visits. If you’re in the EU/EEA, the UK or Switzerland, Clarity only runs after you accept it in the cookie bar, and you can change your answer any time with “Cookie settings” at the bottom of the page; saying no also removes its cookies. Microsoft processes this under the Microsoft Privacy Statement (opens in a new tab).

Only to run the rooms you use (showing seats, cards, stories and results to the people in the room), to keep the service secure and working, and to understand in aggregate how the site is used so we can improve it. We don’t build profiles, show ads or sell data.

We don’t sell or share your information. It’s processed only by the providers that run Benchmark:

• Vercel hosts the website and servers.
• MongoDB Atlas stores room data, on Amazon Web Services in Mumbai, India.
• Microsoft Clarity provides usage insights (see above).

Anyone with a room’s link (and passcode, if set) can see the names, cards and stories in that room.

• A room and everything in it is deleted automatically 3 days after its last activity.
• People who haven’t been seen in a room for 30 minutes are cleared out of it when someone else joins.
• Rate-limit counters expire within an hour.
• Seats and the recent-rooms list in your browser are dropped after 3 days; your name and seat tool stay until you clear your site data.

You can ask for access to, correction of, or deletion of your data at any time. Because there are no accounts, include the room code (the part after /r/ in the link) and the name you used so we can find it. You can also clear your name from your device by clearing this site’s data in your browser.

Benchmark is built for work teams and isn’t intended for children under 16.

If this policy changes, we’ll update it here and change the revision date at the top.

Questions or requests: hello.thimira@gmail.com (or use the contact page)