BenchLedger

Privacy Policy

Last updated: September 24, 2026

BenchLedger helps you keep a tool and workshop inventory. This policy explains what the service at https://benchledger.app uses, what you can choose to share, and its current limitations.

Google sign-in and your account

BenchLedger uses Google to authenticate you, requesting only the openid and email permissions. Google handles your password; BenchLedger does not receive it or request access to your Gmail, Drive or contacts. We store Google's account identifier and email address, linked to an opaque internal user ID, plus a local profile display name and creation/update timestamps. V1 uses a default display name; it does not request your Google profile photo. Accounts are not automatically linked by matching email addresses.

Google tokens are used to validate sign-in and are not retained as account credentials. An essential session cookie keeps you signed in, with a hashed token stored on the server. Sessions expire after seven days. Temporary sign-in state expires after ten minutes. Expiry prevents further use; scheduled, bounded cleanup removes expired records and can take longer to finish. Signing out ends that session, but does not delete your account or inventory. Your browser also stores your selected theme locally.

Information you choose to enter

We store your garages, owned inventory, quantities, storage locations, wishlist and catalog references. You may also enter notes, serial numbers and purchase information such as price, date and seller, or upload photos and receipts. These optional details can be sensitive. Enter only what you need and have permission to store; avoid unnecessary information about other people. We use this information to provide your inventory, editing, export, attachment and sharing features.

Private and shared garages

Each new garage starts PRIVATE. You control whether to change its visibility:

  • PRIVATE: anonymous visitors cannot view the garage.
  • UNLISTED: anyone with its sharing URL can view the limited shared inventory. The page asks search engines not to index or archive it. This is not password protection: a recipient can pass the URL or copy the information to someone else.
  • PUBLIC: visitors can view the limited inventory at its public URL. Search engines and other people may discover, index or copy it.

Shared views show item names, brands, models, categories and quantities. They exclude your account email, purchase details, serial numbers and private notes. Photos and receipts remain private to the signed-in owner, even when a garage is UNLISTED or PUBLIC. They are not publicly shareable in V1. Do not put private information in an item name or another field included in a shared view.

Changing a garage back to PRIVATE stops anonymous access through BenchLedger's sharing URLs. It cannot recall copies or screenshots already made by visitors or search engines.

Infrastructure and operational monitoring

Cloudflare runs the application (Workers), database (D1), private attachment storage (R2) and aggregate operational telemetry (Analytics Engine). Google provides authentication. These providers process information needed to deliver their services, including network connection information. Requests use HTTPS. Application authorization restricts private inventory and attachments to their owner; the service administrator may need to access stored information to provide support, investigate security issues or meet legal obligations.

Security controls use IP addresses and internal account identifiers to limit abusive requests. Our application telemetry records aggregate operation categories, outcomes, status classes, counts and durations. It does not record user IDs, emails, raw IP addresses, private request URLs, inventory content, attachment metadata or contents, filenames, serials, notes, OAuth codes or session tokens. We do not enable broad application request logging.

UptimeRobot checks public availability. Healthchecks.io receives operational heartbeats and failure/recovery signals, without private application data. These services alert the owner/admin; heartbeat history is limited and is not a long-term activity log. This monitoring is for reliability and security, not advertising or profiling your inventory.

Retention, deletion and recovery limitations

Inventory and account records remain stored while you use the service until you remove supported records or arrange deletion with the owner/admin. You can edit and delete inventory through the application and export your garage. Failed attachment deletions can leave pending records or objects that require follow-up; deletion is not a promise that every recovery copy disappears immediately.

V1 has no self-service account deletion. To request account deletion, access or correction beyond the available controls, contact the owner/admin below. Requests are reviewed manually and may require proof that you control the account. Do not send passwords, sign-in codes or session cookies.

Cloudflare D1 Time Travel provides a rolling recovery window of up to 30 days, so deleted database information can remain in that provider's recovery history. Independent encrypted off-provider backup coverage is currently DEGRADED/DEFERRED and is not active. Attachment storage has no verified point-in-time recovery or undelete guarantee. Keep your own originals and exports; BenchLedger cannot promise recovery of lost or deleted information.

Contact and policy changes

Contact the BenchLedger owner/admin at lott.kyle@gmail.com for privacy questions or requests. Include only the minimum information needed. This policy may change as the service changes; the date above identifies the current version.