Privacy Policy

Effective 21 October 2026.

Who we are

benchturn is operated by benchturn, Inc. (“benchturn”, “we”, “us”). This policy covers benchturn.com, the benchturn command-line tool (“the CLI”), the account portal, and the emails and messages we send. For the purposes of EU and UK data-protection law, benchturn, Inc. is the controller of the personal data described here. Our Terms of Service describe the rest of the arrangement.

What we collect

What we hold about you depends on what you do. Each situation below lists everything we keep.

Visiting the site

• Ordinary page views are served by Cloudflare, which processes your IP address and request details to deliver and protect the site. We do not run analytics or advertising trackers.
• Fonts are loaded from Google Fonts on every page, so Google receives your IP address and browser details when a page loads.
• Install links. When you fetch an install script that carries an invite code (install.sh?r=<code>), we store the invite code, your user agent, your IP address, the approximate city, region and country Cloudflare derives from it, and the time.
• Messages you send us through the site are stored with your IP address and approximate location. Emails you send to hello@benchturn.com are kept in our mailbox.

Signing in with GitHub

We ask GitHub for read access to your profile and email addresses (the read:user and user:email scopes). We keep your GitHub numeric ID, login, name, primary verified email address, avatar URL, and the times you sign in. We do not get access to your repositories or your GitHub password.

Using the CLI

For each machine you connect, we keep a hash of the machine’s access token (never the token itself), the platform (for example “macOS arm64”), the CLI version, when the machine was last seen, your GitHub login, and the invite code you used, if any. If you sign up by email (benchturn init --email), we keep that email address; we do not verify it.

Recorded work

This is the core of the service. Once installed, the CLI records sessions in the coding agents you connected. For each prompt you send inside a git repository, it uploads:

• the prompt, the agent’s reply, and the transcript of that turn, including the tools the agent called and their output, which can include file contents and command output;
• the model and effort setting;
• the repository’s remote URL, branch and commit;
• a snapshot of the working tree, tracked and untracked files up to 5 MB each, packaged as a git bundle. The bundle includes the history reachable from the current commit, which contains the names and email addresses of that history’s commit authors;
• timestamps, the working directory, command-line arguments, your time zone, and the versions of the tools involved.

At the end of a session the CLI also uploads the full session transcript. Today that includes sessions run outside a git repository; those have a transcript but no tree snapshot.

What is left out. Files whose names match secret patterns (such as .env, .env.*, *.pem, *.key, *.p12, id_rsa* and id_ed25519*) are never included in a snapshot. Nothing is recorded in a repository with a .gen-ignore file at its root, or while recording is paused. The CLI does not scan the text of your prompts or transcripts for secrets before upload, so anything you type, or an agent reads or prints, is uploaded as it is. We redact secrets and personal data we find during review.

Private repositories are recorded too, so you can see that work on your account page, but only sessions on public repositories become environments.

Past sessions

When you use benchturn past, benchturn scan or benchturn submit, or accept the offer at the end of benchturn init, we receive the session files you approve, together with any summary, notes or outcome you write. Nothing from your earlier sessions is uploaded unless you approve it.

The contribute form

If you send a session through the contribute form, we keep your name, email address, profile URL, repository URL, the agent you used, your task summary, outcome and notes, your consent choice, the files you upload (up to 5 files, 25 MB in total), your IP address, approximate location and user agent. As the form says, we use these submissions only to review whether a session is a fit; any further use needs a separate agreement with you.

Payouts

Payouts go through Stripe. When you set them up, you give your identity, tax and bank details to Stripe directly, on Stripe’s own pages, under Stripe’s privacy policy; we never see your bank account number or tax ID. We keep your Stripe account ID, its country, whether payouts are enabled, your bank’s name and the last four digits of the account (to show you where your money goes), and a ledger of the amounts owed and paid to you. If you are paid through PayPal, Wise or GitHub Sponsors instead, we keep that payout method, its handle (an email address or GitHub login), your legal name and country; those providers process the payment under their own privacy policies.

People we contact who have not signed up

We invite engineers who work on open source to join. If we contacted you before you signed up, this is where your information came from:

• Public GitHub data, from GH Archive and the GitHub API: your login, name, the email address on your public commits, company, location, bio, website, social links, organization memberships, and your public commits.
• A LinkedIn profile URL, if we found one linked from your own pages or through a search with Exa.

We use AI models (Anthropic’s Claude) to assess your public commits to judge whether benchturn is a good fit for you. We use this information only to invite you, by email (sent through Google Workspace) or on LinkedIn (sent through HeyReach). We do not sell it or use it for anything else.

To opt out, reply to the message or write to hello@benchturn.com. We will stop contacting you and delete the outreach record we hold about you. To make sure you are not contacted again, we may keep only your email address or GitHub login on a do-not-contact list.

How we use it

• To run the service: sign you in, connect your machines, receive and store your sessions, show them on your account page, and email you when a session changes state.
• To review sessions: we read sessions, process them with AI models (Anthropic’s Claude), and run them in isolated sandboxes (Modal) to judge whether they can become environments, and to find and redact secrets and personal data.
• To build and license environments: we turn accepted sessions on public repositories into training and evaluation environments and license them to AI labs.
• To pay you and keep the payment and tax records the law requires.
• To invite people who have not signed up, as described above.
• To keep the service secure, prevent fraud and abuse, fix problems, and comply with the law.

We do not use your data for advertising, and we do not sell personal information to data brokers or advertisers.

What AI labs receive

When a lab licenses an environment built from your session, it receives the public repository, the prompts and the transcript. No account information is attached: not your name, email address, GitHub login, account ID or payment details.

Be aware of what that material can contain on its own. A public repository’s history includes its commit authors’ names and email addresses, as it does on GitHub. A prompt or transcript contains whatever you or the agent wrote, which can include a username in a file path or a name in a comment. We redact what we find in review, but the most reliable protection is to keep personal and secret material out of your prompts.

Labs may use licensed environments to train and evaluate AI models. Once an environment has been licensed, we cannot recall it from that lab.

Service providers

These companies process personal data on our behalf to run benchturn:

Apart from these providers and the AI labs described above, we share personal data only when the law requires it, to protect people’s safety or our rights, or as part of a merger, acquisition or sale of our business, in which case this policy continues to apply to the data transferred.

Cookies

We set two cookies, both HttpOnly and Secure, and only when you sign in:

• bt_session keeps you signed in, for 30 days.
• bt_oauth holds sign-in state while you are sent to GitHub and back, for 10 minutes.

Both are strictly necessary for signing in, so we do not show a cookie banner. We use no analytics, advertising or tracking cookies.

How long we keep it

• Account data and recorded sessions are kept while your account is active.
• Past sessions we decline are deleted.
• When you ask us to delete your account or your data, we delete it within 30 days. Payment records are the exception: we keep them as long as tax and accounting law requires, typically seven years.
• Environments already licensed to a lab before you asked cannot be recalled from that lab.
• Outreach records are kept while we may still invite you, and deleted when you opt out.
• For other records, such as contact messages, contribute-form submissions and install-link records, we have not set fixed periods yet. We delete them on request.

Your choices and rights

Controls in the CLI, available any time:

• benchturn pause and benchturn resume stop and restart recording.
• benchturn ignore writes a .gen-ignore file so a repository is never recorded.
• benchturn delete <capture> removes a capture from your machine and deletes its record and repository bundle on our side. Other copies, such as the end-of-session transcript, are removed when you ask us by email.
• benchturn logout signs a machine out; recording stops.
• benchturn uninstall removes benchturn’s hooks from your agents.

Everything else is by email for now, as there is no self-serve button yet. Write to hello@benchturn.com from the email address on your account to:

• get a copy of the personal data we hold about you;
• correct it;
• delete specific sessions, or your whole account and everything in it;
• stop outreach.

We may need to confirm it is you before acting, and we answer within 30 days. We will not treat you differently for exercising any of these rights.

California residents

If you live in California, the California Consumer Privacy Act, as amended by the CPRA, gives you these rights:

• To know what personal information we collect, use and disclose, and to get a copy of it.
• To delete personal information we collected from you, subject to legal exceptions such as payment records.
• To correct inaccurate personal information.
• To opt out of the sale or sharing of personal information.
• To limit the use of sensitive personal information. We do not use sensitive personal information for purposes that would give rise to this right.
• Not to be discriminated against for exercising these rights.

Is licensing environments a “sale”? In our view, no. The environments we license carry no account information and are not meant to identify you, and we do not sell personal information for money or share it for cross-context behavioral advertising. We recognize, though, that a transcript can contain personal information, so you can opt out in the way that actually works: stop recording (benchturn pause, .gen-ignore, benchturn logout or benchturn uninstall), and ask us to delete sessions that have not yet been licensed. We do not knowingly sell or share the personal information of anyone under 16.

What we collected in the last 12 months, by CCPA category: identifiers (name, email, GitHub login and ID, IP address); internet or network activity (install-link fetches, sign-ins, CLI activity); approximate geolocation (city, region, country from IP); professional information (public GitHub profile and commits, for outreach); commercial and financial information (payout method, legal name, country, amounts owed and paid); and the content of your recorded sessions. Sources are you, your devices through the CLI, GitHub, and public sources such as GH Archive and Exa. The purposes are those in How we use it; the recipients are those in Service providers and What AI labs receive.

To exercise a right, email hello@benchturn.com. We will verify the request by matching it to the email on your account, and respond within 45 days. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to confirm your identity.

EU and UK residents

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the service you signed up for, including recording, reviewing and licensing your sessions and paying you.
• Legitimate interests: to invite engineers who have not signed up, based on their public open-source work; to secure the service and prevent fraud; and to improve it. Our interest is in reaching people whose public work fits benchturn; we limit outreach to public professional information and stop as soon as you object.
• Consent: for contribute-form submissions and each past session you choose to submit. You can withdraw consent at any time; it does not affect processing that already happened.
• Legal obligation: to keep payment and tax records.

You have the right to access, correct, delete, restrict or port your personal data, and to object to processing based on legitimate interests. Your right to object to outreach is absolute: tell us and we stop. To exercise these rights, email hello@benchturn.com. You can also complain to your local data-protection authority.

International transfers

benchturn is based in the United States, and your data is stored and processed in the United States and wherever our service providers operate. Where data about people in the EEA or UK is transferred, we rely on the safeguards our providers offer for such transfers, such as the European Commission’s Standard Contractual Clauses.

Security

All traffic to benchturn uses HTTPS. Machine tokens are stored only as hashes, sign-in cookies are HttpOnly and Secure, and sessions are reviewed in isolated sandboxes. Access to personal data is limited to the people who operate benchturn. No system is perfectly secure; if a breach affects your personal data, we will tell you as the law requires.

Children

benchturn is not for anyone under 18, and we do not knowingly collect personal data from them. If you believe someone under 18 has given us personal data, tell us and we will delete it.

Changes to this policy

We will update this policy when what we collect or how we use it changes, and change the effective date above. If a change is material, we will tell account holders by email before it takes effect.

Contact

benchturn, Inc.
hello@benchturn.com