Last updated 2026-08-30. Benchnotes is run by one developer, Nathan, reachable at hello@benchnotes.io.
The short version
The free tools send nothing anywhere. Two forms on this site store what you type in them. Your IP address is never stored. There are no cookies, no analytics and no advertising anywhere on this site.
The free tools store nothing
The appendix builder and the notes sanitizer run entirely in your browser. What you paste into them is never uploaded, never logged and never seen by me. Neither page makes a network request of any kind after it loads, which you can verify by opening the network tab or by loading the page and then disconnecting from the internet. Nothing is written to your device either: closing the tab discards everything, including the mapping table the sanitizer produces unless you download it yourself.
The two forms that do store something
The beta access form, on the home page
When you submit it, the following is written to a database:
| Stored | Why |
|---|---|
| Your email address | To reply to you and to tell you when there is something to try. |
| The role you selected | It decides which templates get built first. |
| A two-letter country code | Supplied by Cloudflare as a header. Used to understand where interest is coming from. |
| Your browser's user agent string, first 256 characters | To spot automated submissions. |
| The date and time | To sequence responses. |
The reporting study, at benchnotes.io/survey
Your answers, your email address only if you choose to give one, whether you ticked the box asking for a call, the same two-letter country code, the same truncated user agent, and the date and time. Most responses are anonymous and the survey is built to stay useful that way. There is no pricing question in it and there will not be one.
Your IP address is not stored
Cloudflare gives the server a two-letter country code with each request. That code is what gets written down. The IP address itself is not recorded in the database, on either form.
Where it goes and who else sees it
- Cloudflare hosts this site and stores the database. As the host, Cloudflare processes requests to the site and handles standard network data such as IP addresses in order to serve pages and block abuse. Their handling is covered by their own privacy terms.
- Discord receives a message in a private channel when someone submits the beta form or asks for a call. That message contains the email address, the role and the country code. It exists so a person waiting on a reply does not sit unread.
- Migadu hosts email for benchnotes.io, so if you write to hello@benchnotes.io your message passes through and is stored on their service.
Nothing is sold, rented, or shared with anyone else. There are no advertising or data-broker relationships to disclose, because there are none.
Fonts, and the one third-party request on this site
The home page at benchnotes.io loads the IBM Plex typeface from Google Fonts. That is a request to Google, and Google receives your IP address and user agent as part of it, as it would for any site that loads a font that way.
No other page does this. The two tools, the survey, this page and the terms page all use typefaces already on your device and make no third-party request at all. That is a deliberate split: the pages where you type something are the pages that talk to nobody.
Cookies, analytics and tracking
There are none. No cookies are set by this site, no analytics product is installed, no tracking pixel is embedded, no session is recorded and no third-party script runs on any page. Nothing is stored in your browser's local storage. This is verifiable from the page source, which is served unminified for exactly that reason.
The study, and what gets published
Results from the reporting study will be published. They will be published in aggregate. Nothing you write is attributed to you, your employer or your client without your written permission first, and if you gave an email address you will be sent the results whether or not you are quoted.
How long it is kept, and how to have it removed
Signup and study records are kept while the beta is running, because the whole point is to come back to you. There is no automatic deletion schedule yet, and I would rather say that plainly than invent one.
Email hello@benchnotes.io from the address you signed up with and I will send you everything held about you, correct it, or delete it. There is no form and no process to go through. Deleting a study response is possible if you can identify it, which means it needs an email address attached; a genuinely anonymous response cannot be found in order to be removed, and that is the trade-off of allowing anonymous answers.
Children
This site is aimed at working incident responders and is not directed at children.
Changes
If this changes, the date at the top changes with it and the previous version stays in the public git history of the site. If a change affects what is collected rather than how it is described, anyone who gave an email address gets told.
How these claims are kept honest
Everything above is a statement about how the code works, which means it stays true only
until the code changes. So the site's source carries a script,
scripts/check-privacy-claims.mjs, that reads the server code, the database
schema and every page, and fails if any of four things stops being true: that no IP address
is stored, that no cookie or analytics or browser storage appears anywhere, that no page
except the home page makes a third-party request, and that every page still links here.
It is a small thing, and I recommend treating it as the reason to believe the rest of this page rather than as a feature. A privacy notice nobody can check is just prose.
Questions
hello@benchnotes.io. A real person reads it, and the answer to "what exactly do you have on me" is a short email away.