Privacy Policy

Information we handle

Accounts

If you create an account, we store your email address, username, password hash or Google account identifier, avatar, verification and password-reset records, notification preferences, account role, and moderation records.

Benchmarks and hardware

Benchmark uploads can include app and operating-system versions, system model, CPU and GPU details, drivers, settings, scores, timestamps, game and recipe information, and frametimes. Game results also include a keyed, rotating installation hash used to detect duplicate or invalid submissions. The server does not store the raw installation identifier.

Local discovery

The Windows app reads supported game-store metadata and system information to find installed games and compatible tests. It uses installation paths locally and does not include them in benchmark uploads.

Recipes and reviews

We store recipe configurations, uploaded files and file metadata, review comments, safety decisions, associated games, timestamps, and authorship. Private drafts are limited to their author and authorized operators. Approved recipes and their attached files are public.

Analytics and diagnostics

The website uses cookieless measurements for general page activity. If you allow product analytics, PostHog Cloud EU also receives a random browser identifier and can remember sessions and associate activity with your account after sign-in. Global Privacy Control keeps optional browser analytics disabled.

Windows analytics is disabled until you allow it. If enabled, it can include a random analytics ID, device and app details, benchmark events and diagnostics, and, after sign-in, your account ID and public username. It does not send your email or local file paths. Neither client records session replays.

Service records

Infrastructure and service providers process network and security data such as IP address, request time, URL, status, user agent, and error events. Resend processes recipient addresses, message content, and delivery metadata for account and notification email.

What becomes public

Benchmark results become publicly accessible and enumerable when you upload them. This is the contribution required to use the free benchmark service. A signed-in upload is attached to your account; a logged-out upload is not. If you upload while logged out, the app saves a credential that can link the run to your account when you sign in later. It does not let you delete the run. Public results can show system and OS details, hardware, drivers, scores, game measurements, frametimes, time, and run ID.

Uploaded runs remain in the public benchmark dataset and cannot be deleted. A run can be unlinked from an account, including when that account is deleted, but the benchmark measurements remain public. Public recipes can show their configuration, files, game, reviews, and author. Public information can also be copied, indexed, or redistributed by others. We do not publicly display email addresses, authentication data, analytics IDs, installation hashes, or private recipe drafts.

Why we use information

We use information to provide and secure accounts, operate benchmark and recipe workflows, publish contributed results, compare hardware, calculate rankings and predictions, detect abuse and duplicate or invalid submissions, send requested messages, review submitted scripts for security risks, diagnose failures, and improve the service.

Who receives information

• Google Cloud hosts the app, database, files, logs, and compute workloads.
• PostHog Cloud EU processes website measurements and allowed analytics and diagnostics.
• Resend delivers account and notification email.
• OpenRouter and a selected model provider inspect recipes that users affirmatively submit for public security review. Price checks sent through OpenRouter do not contain user data.
• Authorized moderators review submissions and investigate abuse.
• Other people receive information that is published as described above.

We may also disclose information when required by law, to protect the service or others, to professional advisers, or as part of a merger, financing, reorganization, or sale. We do not sell personal information or share it for cross-context behavioral advertising.

Choices and account controls

You can change analytics choices in the website or Windows privacy settings. Account settings let you update profile and email choices, export account data as JSON, and delete your account after confirming your password. Logged-out contributors receive a credential that the app uses to attach their earlier runs when they sign in. Whoever has this credential can claim the unlinked run, so keep it private.

Account deletion removes account and private data and requests deletion of linked PostHog data. It unlinks public benchmark runs from the deleted account, but it does not delete those runs or their measurements. PostHog deletion is asynchronous and can take additional time to verify.

Retention

We keep account and private content while the account or draft is active and delete it when the applicable account or content is deleted. Uploaded benchmark runs and derived performance summaries remain in the public dataset indefinitely. Removing an account link does not remove the run. Raw frametimes expire after 12 months, and rotating installation hashes expire after 35 days. Public recipes remain until the author or weBench removes them under the community rules.

Our current PostHog plan retains analytics events for one year. Error diagnostics follow PostHog's event-retention rules; they do not currently have a separate 30-day expiry. Ordinary cloud application logs and Resend email content and delivery logs are retained for 30 days. Google's required audit logs are retained for 400 days. Completed privacy-request records expire after three years. Our cleanup job checks expired database records and backups twice a day. Database backups are limited to a 35-day window, except when a documented hold or a backup failure requires us to preserve recovery data. Deleted data can remain in restricted recovery copies until those copies expire.

Your privacy rights

Depending on where you live, you may have rights to access, correct, export, or delete information; object to or restrict some uses; withdraw consent; appeal a decision; or complain to a regulator. Use the self-service controls in Privacy & account or contact us. We may need to verify that a request concerns you. We will not discriminate against you for exercising a privacy right. When an account or identity link is deleted, its uploaded benchmark runs remain as public records without that account link. We will consider requests required by applicable law, including any legal exceptions that permit us to retain information.

International processing and security

weBench operates from the United States. Google Cloud resources are hosted in the United States, PostHog analytics is hosted in the European Union, and other providers may process data where they or their subprocessors operate. We use contractual or other transfer safeguards where required.

We use HTTPS, password hashing, restricted service identities, secret management, private database networking, rate limits, and encryption at rest and in transit. No system is perfectly secure.

Changes and contact

We will update the date above when this policy changes and provide additional notice when a change materially affects your choices. For privacy questions or requests, email privacy@webench.io.