Privacy policy

7. Your information and privacy

• The short version: BenchTwin has no ads and no third-party analytics or tracking code, and we don’t sell or rent anyone’s information. Information leaves your device only when you log in, use BenchTwin while logged in (when each visit starts and ends and how long it lasts, see “Running BenchTwin” below), save to your account, start or join a live session, reply to an announcement, send feedback or a part request, join the Pro waitlist, or open a link to another website, plus the small “BenchTwin is open” signal described under “Running BenchTwin” below.
• Without an account, your projects and settings stay in your browser, on your device (see Cookies and local storage below). We can’t see them.
• With an account, your email address and password are handled by Supabase, the service BenchTwin uses for accounts and cloud saves. Supabase stores your password in a hashed form; we never see it. We store your email address, when you signed up and last logged in, when each of your visits while logged in started and ended and how long BenchTwin was in use in it, the projects you save to your account (their names, contents and when they were saved), whether your account has BenchTwin Pro, and the result of the age question asked when the account was made (old enough, and whether a parent or guardian agreed), never your birthday. We use this only to log you in, to open your projects on any device, to turn on what your account includes, and to see how much BenchTwin is used so we can improve it.
• Running BenchTwin: the BenchTwin team has a small admin screen (Dev mode) it uses to post announcements, read feedback and part requests, manage the Pro waitlist and see that the service is working. It shows:
  • how many accounts there are and how many were made this week, with each account’s email address, its nickname if you chose one, when it was made and when it last logged in, and which logged-in accounts used BenchTwin in the last hour. The team can use this to send a private message to one account (for example, to answer your reply, your feedback or your part request); only that account sees it, and it never shows as an announcement;
  • how many people have BenchTwin open right now, and, for people who are logged in, which accounts those are. An open page sends only that it is open, since when, and whether someone is logged in. It is counted under a random code that your browser replaces every day, so one day’s visit can’t be linked to the next; a logged-in page adds a second code that also changes every day, never your email. There is no record of where you go in the app;
  • the number of people with BenchTwin open, saved every 5 minutes (only the number, nothing about who), so the team can see how busy BenchTwin is over a day, a week or a month;
  • for logged-in accounts, each visit: the account’s email, when the visit started (logging in, or opening BenchTwin already logged in), when it ended (logging out or closing the page) and how long BenchTwin was in use in it, counted while the page is in front of you and you’ve used the mouse, keyboard or screen in the last 5 minutes. Only these times are sent, never what you did. Visitors who aren’t logged in aren’t recorded;
  • if you redeem a coupon code: which code, when, and what it gave your account (for example Pro until a date). It is kept with your account, and deleted with it.
  • replies people choose to send to an announcement, with the account email if they were logged in;
  • a copy of the feedback people send: the account’s email and nickname, the category, the message and when it was sent. The team can delete it;
  • the part requests people send: the account’s email and nickname, the part and the details given about it, when it was sent and what the team decided (waiting, planned, added or not planned). The team can delete them;
  • the accounts that can’t send feedback any more, each with the reason, which only the team sees;
  • the Pro waitlist: each account’s email, its nickname and when it joined. The team can copy the emails to write to the people on it, and take an entry off the list.
  It doesn’t show your projects, your code, what you click or what you build, and BenchTwin doesn’t record any of that. Only the BenchTwin team account can open this screen, it needs a separate password as well, and the database itself checks that every list in it is read by that account only. We use it to post updates, read your replies, answer questions and keep BenchTwin running well, never for advertising, and we don’t share it with anyone.
• Logging in with Google, GitHub, Microsoft, Apple or Discord: if you choose one of these, that service tells BenchTwin (through Supabase) your email address, your name and, if you have one, your profile picture. BenchTwin uses them only to create your account, log you in and greet you by name. We don’t get your password for that service, we don’t ask for access to your files, contacts, calendar or anything else in it, and we don’t share what we receive with anyone. Information we receive from Google is used according to the Google API Services User Data Policy, including its Limited Use requirements. You can remove BenchTwin’s access at any time in that service’s account settings, and ask us to delete your BenchTwin account at benchtwin@gmail.com.
• Live sessions (Build together) send the changes you make to the bench, with the name you show in the session, through Supabase to the other people in that session as you make them. BenchTwin doesn’t keep them after the session. Anyone with the session’s link or code can join, so share it only with people you trust.
• Share links hold the whole project inside the link itself. We don’t store a copy, but anyone you give the link to can open the project.
• Feedback needs you to be logged in with a Google account, so we reply to a real address and can keep spam out. When you send it, BenchTwin’s database first checks that the account isn’t blocked from feedback and hasn’t sent 10 messages in the last hour, then keeps a copy (your email, nickname, the category, your message and the time) for the admin screen described above. It also goes to us by email through FormSubmit (formsubmit.co), with your email and nickname. If you tick the box for it, your BenchTwin version, layout, theme, window size and browser go in the email too, so we can reproduce a problem; they aren’t kept in the database. If FormSubmit can’t be reached, Gmail or your own email app opens with the message ready to send instead.
• Private messages: when the team answers you privately (for example your reply, your feedback or your part request), the message is stored so that only your account can read it, and you can write back. Replies you send to an announcement without logging in carry no name; please don’t put personal details in them.
• Part requests (Request a part) work like feedback: you need to be logged in with Google, an account blocked from feedback can’t send them, and there’s a limit of 10 an hour. The request (your email, nickname, the part’s name, and the kind, maker, part number, link and note if you fill them in) is kept in the database so the team can see it in the admin screen and you can see what happened to your own requests. Nobody else can see them.
• Other services: Netlify hosts benchtwin.com and, like any web host, receives your IP address and browser details and keeps short-term server logs for security. BenchTwin’s fonts, icons and 3D engine come from benchtwin.com itself. The code library that connects to Supabase comes from jsDelivr when the page opens, and a few other libraries come from jsDelivr only when you use the feature that needs them (such as opening a 3D or CAD file, the AR view or a 3D export), so jsDelivr receives your IP address and browser details. When you open the Log in window or a form that asks you to sign in with Google, Google’s sign-in button loads from Google, which receives your IP address and can recognise your Google account. Account emails (confirming your email address, resetting your password) are sent by Resend. Translations: announcements and messages from the BenchTwin team come with translations the team makes with the translator built into its own browser, and when one has no translation for your language, your browser can translate it on your device if it has a built-in translator (such as Chrome’s). Either way, the text isn’t sent to any translation service; the browser may download a language pack from its maker the first time. These services may process information in the United States and other countries; where the law requires it, this relies on safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
• Why we can use your information: to give you what you ask for when you use a feature that needs it, such as your account, cloud saves, live sessions, feedback and part requests (to provide the service); to keep BenchTwin secure, stop spam and abuse, and know how many people use it and for how long (our legitimate interest in running BenchTwin); and, only if you tick the box, to put your app details in a feedback email (your consent, which you can withdraw by not ticking it).
• Keeping it safe: everything travels encrypted (HTTPS). The database only lets each account read its own data, only the team account can read the lists described above, and benchtwin.com only runs its own code and the library versions it names. No system is perfectly secure: if you find a security problem, please tell us at benchtwin@gmail.com (without accessing other people’s data or disrupting BenchTwin), and if a breach ever affects your information we will tell you as the law requires.
• Your rights: you can export your projects at any time, delete projects from your account in the app, and delete your whole account yourself (Your account → Account settings → Delete my account). Deleting your account also deletes what it sent: your feedback copies, part requests, replies to announcements, your place on the Pro waitlist, private messages to you and the record of your visits. Email benchtwin@gmail.com from the address on your account to get a copy of, correct or delete your account and everything stored with it. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California) you may have further rights, including to complain to your data protection authority. We answer within 30 days.
• How long we keep things: your account and its projects until you delete them or ask us to delete your account; feedback, and its copy in the database, as long as we need it to answer you and fix what it reports; part requests until the part is added or we decide not to add it, or until you ask us to delete them; replies to announcements and private messages until the team deletes them or you delete your account; the list of accounts blocked from feedback until we lift the block; your place on the Pro waitlist until you leave it, Pro opens, or your account is deleted; the record of your visits while logged in for 12 months, or until your account is deleted; the saved number of people online, which isn’t linked to anyone, for about a year.
• Children: if you believe a child has given us personal information without the consent the law requires, email benchtwin@gmail.com and we will delete it.

8. Cookies and local storage

BenchTwin doesn’t use advertising cookies or third-party analytics or tracking, and doesn’t let other companies put them on benchtwin.com, so there is no cookie banner to click. Instead it uses your browser’s local storage, which works much like a cookie but is never sent to a server by itself, for what the app needs to work the way you set it:

• your projects and their autosave;
• your settings: language, theme, skill level, sound and music, units, snapping, the screen layout and options such as safety mode;
• your progress: lessons and tasks you have finished, and which update notes you have seen;
• your sign-in: when you log in, Supabase keeps your session here so you stay logged in, and logging out removes it;
• which announcements and messages you’ve seen or replied to, and when this browser first opened BenchTwin (so new announcements reach you once);
• the random code, replaced every day, that counts this browser once in “how many people have BenchTwin open”;
• a feedback message or part request you’re still writing, kept only in that tab while you log in with Google to send it.

To remove it all, clear your browser’s site data for benchtwin.com. That also removes the projects saved only in this browser, so export the ones you want to keep first (File → Export). If BenchTwin ever starts using other cookies, we will update these terms first and ask you where the law requires it.

4. Your account

Accounts are optional: you can use BenchTwin without one. Accounts are for people aged 13 or older; in some countries the minimum age is higher (16 in parts of the EU) unless a parent or guardian agrees. Younger students can use BenchTwin without an account, or through an account a parent or teacher manages. Before an account is made, BenchTwin asks for the month and year of birth: under 13, no account can be made in that browser for a day, and from 13 to 15 a parent or guardian has to agree first. Only the result is kept, in that browser and on the account. Use a real email address, keep your password to yourself and tell us at benchtwin@gmail.com if you think someone else is using your account. You are responsible for what happens in your account.