Privacy

What you type into a tool

It stays on your device. Every tool currently on this site does its work in the page, so nothing you type is put into any request. The only requests a page makes beyond this domain are the analytics hosts listed under Analytics, and the build fails if any request carries your input. Turn off your network and the tools keep working.

This is enforced rather than promised: the build fails if a tool page makes an unexpected network request, or if text typed into a tool appears in any request. A press of Helpful is an expected request, like the analytics requests under Analytics, and the test for typed text presses it with text typed in, to check none of it is sent. How we build tools explains the mechanism and how to verify it yourself.

Share links carry their state in the part of the URL after the #, which browsers never send to a server. So a shared palette or configuration reaches the person you sent it to without ever reaching us.

What is stored on your device

Some tools can remember things between visits, such as a class list or a set of previously used campaign names. Where that exists:

• it is off until you switch it on;
• the control says in plain words what is being kept;
• one button clears it;
• it is stored in your browser only and is never transmitted.

One thing is stored differently. When you press Helpful on a tool page, your browser remembers that you pressed it on that page, so the button can show it. It is written only when your press goes through, it holds nothing except that you pressed, and it is never transmitted. Clearing this site's data in your browser removes it.

Clearing your browser's site data removes it. We have no copy, so we cannot restore it and cannot look at it.

Server logs

This site is hosted on Vercel. Like any web host, their servers record requests for the pages and files you load, including your IP address, the time, the page requested and your browser's user-agent string. That is a normal consequence of loading a web page from any server anywhere, and it is how the site gets to your browser at all.

We do not add anything to those logs, do not join them to anything, and do not use them to build a profile. Note the distinction the rest of this page rests on: the host can see that you requested a page. Nobody, including us, can see what you typed into the tool on it.

Our host keeps a record of each request, including your IP address and browser type, for 1 day.

Analytics

This site uses Google Analytics 4 to count visits. The tag went live on 4 October 2026, recorded in the changelog. It measures which pages are visited, how visitors arrived, and roughly where and on what kind of device. It does not receive anything you type into a tool. It does not load at all on the classroom pages under /school/, the homeschool pages under /homeschool/, or the password strength checker.

Where you are decides what it may store. If you are in the European Economic Area or the United Kingdom, Google Analytics 4 sets no cookies at all. It sends only cookieless measurement pings that carry no cookie or lasting identifier, and there is nothing to accept or decline. Everywhere else, it sets its measurement cookies (_ga and _ga_333KHQC4EQ) when a page loads. Event-level and user-level data is kept for 14 months. Aggregated reports built from it are not deleted by that setting. Google signals is off by our choice: we do not use cross-device advertising identity.

Pages contact these hosts for analytics, and no others for that purpose:

• https://www.googletagmanager.com
• https://www.google-analytics.com
• https://region1.google-analytics.com
• https://region1.analytics.google.com

The build enforces that list. A page that contacts any host not on it fails the release, and the control strip on every tool page counts disclosed and undisclosed requests separately, so you can check it in your own browser. You can also open your browser's network panel on any page: apart from this domain, a page reaches only the hosts listed above, and your browser blocks a request to any other host.

The tool promise is untouched by Google Analytics 4. What you type into a tool stays in the page. When a tool does put state in the address, which happens when you use a share or copy-link control rather than automatically as you type, it goes in the part after the hash mark, and browsers never put that fragment into an HTTP request to our servers. The page address and the previous page's address sent to Google are both stripped of the hash and the query string at config time, so tool state is not in what leaves for analytics. That is what we send, not a claim about what the script can read in your tab: a script running on the page can see the full address in JavaScript. Nothing you type into a tool leaves your browser for us, for Google, or for anyone else.

The release is checked with analytics forced on against pages carrying tool state in the address, and it fails if any request carries that state onward. That check runs this site's Google Analytics 4 setup against a stand-in for Google's script. The requests Google's own script sends were also read on a test build before the tag went live.

Helpful button

If you press Helpful on a tool page, your browser sends one request to benchvale.com. The request contains the address of the page you are on and nothing you typed into the tool. Like any request to our site, it also shows our host your IP address and browser type (see Server logs). To stop repeat presses we keep, for no more than 24 hours, a scrambled code made from your IP address and that page's address, using a key that changes every day; the page address is not stored in readable form. Your browser also remembers, on your device only, that you pressed it.

The page counts and the two scrambled codes are stored for us by Upstash, a separate company that runs the database. It receives only what we write to it, never anything you type.

Advertising

There are no ads on the site today. No advertising code loads on any page and no ad request is made.

An application to Google AdSense was submitted on August 19, 2026. That is why the site now serves an ads.txt file naming Google as an authorized seller, and why every page carries a site ownership tag in its source. Both are how a publisher proves it owns a domain. Neither shows you an ad, and neither contacts anyone when you load a page. If the application is approved, the paragraph below starts applying, and this page will be rewritten before a single ad runs.

Stated plainly, because this is the part that genuinely changes: an advertising network is a third party, and when ads are running it will be able to see that your browser loaded a page on this site, and may use cookies or similar technology depending on your consent choices. Visitors in the EEA and the UK will get a consent choice before any of that happens.

What will not change is the tool itself. Your input still never leaves your browser, with ads or without them. Those are two separate questions and it would be dishonest to let a strong answer to the first one imply an answer to the second.

Cookies

Google Analytics 4 sets two measurement cookies, _ga and _ga_333KHQC4EQ, when a page loads. If you are in the EEA or the UK, it sets neither of them, and neither the pages under /school/ or /homeschool/ nor the password strength checker sets them anywhere. You can block or clear them in your browser and every tool still works. No other cookies are set.

Children

Some tools here are built for classroom use and will be used by teachers with students present, and the tools under /homeschool/ are built for parents teaching at home, sometimes with their children beside them. What anyone types into them stays on their device, they require no account, and they store nothing on a server. Google Analytics 4 does not load on the classroom pages under /school/ or the homeschool pages under /homeschool/, so Google Analytics does not measure those pages and they set no analytics cookies. Apart from the scrambled codes a Helpful press creates for up to 24 hours (see Helpful button) and the request logs our host keeps (see Server logs), we do not knowingly collect personal information from anyone, of any age.

Your rights

Data protection law gives you rights to access, correct and delete personal data held about you. We hold no names, email addresses or accounts. The only such data we keep ourselves is two scrambled codes made when you press Helpful (see Helpful button). They are deleted within 24 hours, and once the day's key is deleted they cannot be matched to anyone. Google Analytics 4 keeps visit data tied to the random identifier in its cookie for 14 months, and we cannot connect that identifier to a person. Our host also keeps your IP address and browser type for 1 day (see Server logs). If you believe we hold something about you, write to us and we will look into it.

Changes

When this page changes materially, the date at the bottom moves and the change is noted in the changelog. Adding analytics or advertising counts as material and will be recorded that way.

A note on this document

This is written in plain English by the person who built the site, and it describes the site accurately. It has not been reviewed by a lawyer. If you need a formal data processing agreement or a compliance attestation for your organization, get in touch and say so.

Last updated October 30, 2026. The changelog lists what changed across the site, and when.