Privacy Policy

Last updated: 17 October 2026

1. Summary

• Your files and pasted content never leave your device. Hushbench processes them locally, in your browser or the desktop app. They are not uploaded to us.
• No analytics or tracking scripts. The only thing the web app records about visitors is a random ID used to count unique visitors.
• No advertising, and we do not sell or rent personal data.
• No passwords. If you create an account (only needed to buy Pro or Team), you sign in with Google or GitHub.
• Licenses are checked offline. The app checks a license on your device. When a subscription license is close to expiring, the app may contact our server to renew it (section 6.3).
• Payments are handled by Paddle. Your card details never reach us.

The rest of this policy gives the details.

2. Who is responsible

The controller of personal data described in this policy is SweBYS, Oman ("we", "us", "our").

Contact for privacy questions and requests: hushbench.support@gmail.com

This policy covers the Hushbench web app and website at https://hushbench.msweelam.dev (and the old address fvp-web.msweelam.dev), the online account at https://hushbench.msweelam.dev/account, the desktop app for macOS, Windows and Linux, and the downloadable copy that runs from disk.

3. Your content stays on your device

All processing of your data (formatting, validating and converting files, spreadsheets, SQL, diagrams, logs, PII & secrets detection, and so on) happens locally in your browser or in the desktop app. Files you open and content you paste are never uploaded to us. We cannot see them.

4. Data stored on your device

The app stores the following on your device only:

• app settings and preferences;
• workspace state (for example, open documents and layout);
• your license, if you have one. It contains the licensee name, license type, seat count, unlocked features, and issue and expiry dates. A license file downloaded from your account also contains a private renewal code (section 6.3).

In the browser this is kept in browser storage for the Hushbench website; in the desktop app it is kept in the app's data folder. We cannot access it. You can remove it by clearing your browser's site data or deleting the desktop app's data folder.

5. Data we process when you use the website

5.1 Visitor counter (web app only)

When you open the web app, it sends a request to /api/visitors on our website. This:

• sets a cookie named vid that contains a random ID (a UUID). The cookie is HttpOnly and Secure, is only sent to /api paths on our website, and lasts 1 year;
• stores that random ID with a "first seen" timestamp in a database hosted by Cloudflare (Cloudflare D1).

We use this only to count unique visitors. The ID is random and is not linked to your name, email, account, files or anything else you do in the app. We keep the IDs for as long as we show the visitor count. You can delete or block the cookie in your browser at any time.

• Legal basis: our legitimate interest in knowing how many people use the site.

5.2 Website hosting (Cloudflare)

The website is served by Cloudflare (Cloudflare Workers and static assets). Like any web host, Cloudflare processes standard request data, such as your IP address, browser user agent, the page requested and the time, in order to deliver the site and protect it. We do not keep our own request logs.

• Legal basis: our legitimate interest in operating and securing the website.
• Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

5.3 Optional AI PII detection model (web app only)

If you use the optional AI-based PII detection feature in the web app, the app downloads the model files from our website. This is an ordinary file download, processed by Cloudflare as described in 5.2. The text you scan stays on your device; it is never sent to us.

5.4 Issue reports (GitHub)

"Report an issue" opens our public issue tracker on GitHub (https://github.com/sweelam/fvp-issues/issues). Anything you post there is public and is handled by GitHub under GitHub's own privacy policy. Please do not include personal data, secrets or confidential content in an issue.

5.5 Emails you send us

If you email us (for example, for support or licensing), we receive your email address, name and anything you include. We use it to reply and to keep a record of our correspondence, for up to 3 years after our last exchange. Our email is provided by Google (Gmail).

• Legal basis: our legitimate interest in answering you, or taking steps you ask for before a contract.

5.6 Enterprise sales

When an organization buys Pro by purchase order or invoice, we exchange contact and billing details by email and invoice (for example, contact names, business email addresses, company name, billing address and purchase order numbers), and we issue a license file naming the organization. We keep these records for as long as tax and accounting law requires.

• Legal basis: performance of a contract, and our legal obligations for accounting records.

6. Online accounts and purchases

You only need an account to buy Pro or Team online and to get your license. The workbench itself needs no account.

6.1 What we keep about your account

• Sign-in details. When you sign in with Google or GitHub, we receive your name, email address and profile picture link from that provider, and an identifier for your account there. We store these, which method you last signed in with, and an encrypted copy of the access tokens the provider issues at sign-in. We do not use passwords.

• Sessions. When you are signed in, we keep a session record with the IP address and browser (user agent) it was created from. It lasts up to 30 days, and is deleted when you sign out or delete your account. A session cookie keeps you signed in; a second cookie remembers which sign-in method you last used.

• Sign-in protection. To stop abuse, we keep a counter of recent sign-in requests for each IP address.

• Subscription status. From Paddle we receive your subscription's plan, number of seats, status, renewal and cancellation dates, and Paddle's customer and subscription identifiers.

• License records. The licenses we issue to your account, and the hashed form of the renewal codes in license files you download (we keep up to 10).

• Legal basis: performance of our contract with you (providing the account and your license), and our legitimate interest in keeping accounts secure.

• Hosting: Cloudflare (Workers and D1 database).

• Retention: until you delete your account. Deleting it (on your account page, or by emailing us) removes your account, sessions, sign-in details, license records and renewal codes from our database. Paddle keeps its own records of your purchases as the seller, as tax law requires.

6.2 Payments

Paddle acts as Merchant of Record: it is the seller, and handles payment, tax and invoices. Your card and payment details go to Paddle and never reach us. Paddle's privacy policy governs payment data: https://www.paddle.com/legal/privacy

6.3 Automatic license renewal

When a subscription license is within 7 days of expiring, the app may renew it, at most twice a day:

• in the browser, on the Hushbench website, by sending your session cookie to our server;
• in the desktop app, by sending only the private renewal code from your license file.

No other data is sent. If your subscription is no longer active, the request is refused and nothing changes on your device.

7. Desktop app and downloadable copy

The desktop app and the downloadable copy make no network requests of their own, other than automatic license renewal (section 6.3) for subscription licenses and links you choose to open. The visitor counter and the AI model download described above apply to the web app only.

8. What we do not do

• We do not upload, read or store your files or pasted content.
• We do not use analytics or tracking scripts (other than the visitor counter in 5.1).
• We do not sell or rent personal data.
• We do not use advertising.

9. Who we share data with

We share personal data only with service providers that help us run Hushbench, and only as described above:

We may also disclose data if required by law, to protect our rights, or as part of a sale or transfer of the Hushbench business.

10. International transfers

Our service providers may process data outside your country, including in the United States. We rely on the safeguards these providers offer for international transfers, such as standard contractual clauses.

11. Security

Your content stays on your device, which limits what could be exposed. For the data we do process: connections to our website are encrypted (HTTPS); sign-in tokens from Google and GitHub are stored encrypted; renewal codes are stored only as hashes; and licenses are signed so they cannot be forged. We also rely on the security of our providers. No system is perfectly secure.

12. Your rights

Depending on where you live (for example, under the EU or UK GDPR, or California law), you may have the right to access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent where we rely on it.

To make a request, email hushbench.support@gmail.com. We will respond within one month. You can delete your account yourself at any time on your account page.

Because the visitor ID is random and not linked to you, we may not be able to identify which record is yours unless you give us the vid value from your browser.

You can also complain to the data protection authority where you live.

13. Children

Hushbench is not directed at children under 16. We do not knowingly collect personal data from them.

14. Changes to this policy

We may update this policy. We will post the new version here with a new "Last updated" date and, for material changes, tell account holders by email at least 30 days before they take effect.

15. Contact

SweBYS, Oman
Email: hushbench.support@gmail.com
Website: https://hushbench.msweelam.dev