Benchmark
Privacy policy

Your data at the workbench

Last revised 15 September 2026

The short version

  1. No accounts, no passwords and no tracking cookies.
  2. We only store what a room needs: the names people type, their cards, story titles and room settings.
  3. Rooms are deleted automatically 14 days after their last activity.
  4. Your IP address is never stored as-is. A one-way hash is kept for up to an hour to stop abuse.
  5. Nothing is sold or shared, apart from the hosting providers that run the service.
  6. Page analytics are cookieless, and room links are hidden before anything is measured.
  7. Email us to have a room deleted sooner or to ask anything about your data.

What we store

When you use a room, Benchmark stores:

  • The name you type when you take a seat, and whether you’re voting or observing.
  • Your cards for each round, plus story titles, final estimates and who voted what (shown in exports).
  • Room settings such as the deck, timer and who can join. Room passcodes are stored only as a one-way hash.
  • A seat id and a secret seat token that keep you in your seat. Your browser keeps them for the tab (session storage), and remembers your name on your device (local storage) so you don’t retype it.

What’s collected automatically

  • Abuse protection: to rate-limit requests, we keep a short one-way hash of your IP address with a counter. Counters expire within an hour, and the original address isn’t stored.
  • Hosting logs: our host, Vercel, processes technical request details (such as IP address and browser) to deliver the site and keep it secure.
  • Analytics: we use Vercel Web Analytics and Speed Insights to count page views and measure page speed. They don’t use cookies, and room codes are removed from page addresses before anything is sent.

How we use it

Only to run the rooms you use (showing seats, cards, stories and results to the people in the room), to keep the service secure and working, and to understand in aggregate how the site is used so we can improve it. We don’t build profiles, show ads or sell data.

Who processes it

We don’t sell or share your information. It’s processed only by the providers that run Benchmark:

  • Vercel hosts the website and servers.
  • MongoDB Atlas stores room data, on Amazon Web Services in Mumbai, India.

Anyone with a room’s link (and passcode, if set) can see the names, cards and stories in that room.

How long it’s kept

  • A room and everything in it is deleted automatically 14 days after its last activity.
  • People who haven’t been seen in a room for 30 minutes are cleared out of it when someone else joins.
  • Rate-limit counters expire within an hour.
  • Anything stored in your browser stays until you close the tab or clear your site data.

Your choices and rights

You can ask for access to, correction of, or deletion of your data at any time. Because there are no accounts, include the room code (the part after /r/ in the link) and the name you used so we can find it. You can also clear your name from your device by clearing this site’s data in your browser.

Children

Benchmark is built for work teams and isn’t intended for children under 16.

Changes

If this policy changes, we’ll update it here and change the revision date at the top.

Contact

Questions or requests: hello.thimira@gmail.com