Our privacy model, honestly

"We take your privacy seriously."

Every app says this. It's the corporate equivalent of "I'm a good person" — technically possible, but suspiciously vague. What does it mean? What's encrypted? Where's the data? Who can read it? Under what conditions?

Most apps stop at the tagline. Here's the full picture for Benchpad, including the parts that aren't perfect yet.

---

What's actually private

Your notes stay on your device by default. Benchpad is offline-first. The source of truth is the on-device database (IndexedDB). You can use the app indefinitely with no network connection — write, edit, search, switch pads. Sync is a background convenience, not a requirement.

This is the strongest privacy guarantee we can offer: data that never leaves your device can't be intercepted, subpoenaed, or leaked from a server breach. If you use Benchpad offline-only, your notes exist in exactly one place — your device.

No ads. No trackers. No analytics SDK reading content. There is no third-party analytics pixel in the app. No Google Analytics, no Mixpanel, no Amplitude, no Segment. Your note content is never processed by any third party for any reason.

No AI. Your notes are never used to train models, generate suggestions, or power "smart features." There is no AI assistant, no summarizer, no auto-tagger. The app doesn't read your content for any purpose other than storing and displaying it.

Account deletion is real. When you delete your account, the server cascades the deletion: your user row, all pad data, all uploaded images (purged from Cloudflare R2), all session records. This isn't a "deactivation" that keeps your data — it's a delete.

---

What's encrypted

Notes are encrypted in transit (TLS) and at rest on the server. Each user gets a per-user content key that encrypts pad content before it's stored.

The server stores encrypted blobs. A database dump would return ciphertext, not your notes.

---

The honest caveat

Here's where we stop and tell you what we don't do, because most apps would leave this part out.

Benchpad is not zero-knowledge end-to-end encrypted. The per-user content key is derived and carried in your authentication token. This means, technically, the server infrastructure has the information needed to decrypt your content.

In practice: we don't access your notes, we have no reason to, and the architecture is designed so the server mostly handles encrypted blobs it can't read during normal operation. But "we choose not to" is a weaker guarantee than "we can't."

If your threat model requires that the service operator be mathematically unable to read your data — the standard set by tools like Signal — Benchpad doesn't meet that bar today. We'd rather be clear about that than let you assume it.

---

Why not full E2EE?

Honest answer: it's hard to do correctly, and doing it wrong is worse than not doing it.

Full zero-knowledge E2EE means the encryption key exists only on your devices. The server never sees it. This is technically achievable, but it creates real problems:

Key management. If your key only exists on your device and you lose that device, your data is gone. Permanently. No recovery. This is the correct trade-off for some users (and those users know who they are), but for a general-audience notes app, "lose your phone and lose all your notes forever" is a support nightmare and a data-loss vector.

Multi-device sync. Getting the key to your other devices without the server seeing it requires either manual key transfer (poor UX) or a key-exchange protocol (complex, easy to get wrong).

CRDT merge. Benchpad uses Yjs for conflict-free merging across devices. In the current architecture, the server handles encrypted update logs without needing to read them — but some sync operations benefit from the server being able to verify integrity.

We're working toward a model where the key is device-derived and the server is a dumber relay. But we won't ship it until it's correct, and we won't claim we have it until we do.

---

What the server sees

Let's be specific:

Data	Server sees?
Your email address	Yes — it's how you log in
Your pad names	Encrypted at rest
Your pad content	Encrypted at rest
Your uploaded images	Stored in Cloudflare R2, associated with your user ID
When you sync	Yes — timestamps on sync requests
Your IP address	Yes — standard server logs
What you write	No — content is encrypted before storage
Your subscription status	Yes — needed for payment processing

We don't sell, share, or monetize any of this data. The business model is a subscription: you pay us, we store your encrypted notes. That's the entire transaction.

---

The privacy model we're actually optimizing for

Full zero-knowledge E2EE is one end of the spectrum. Google Docs (where Google can read everything, and does, for features and ads) is the other end.

Benchpad sits closer to the E2EE end, but not all the way there:

• Your data is encrypted at rest. A database breach returns ciphertext.
• Your data stays local by default. Offline-first means most usage generates zero server traffic.
• No third party ever sees your content. No analytics, no AI, no ad network.
• We can't read your content during normal operation. But we haven't made it mathematically impossible.

For most users — people who want their notes private from advertisers, employers, hackers, and nosy third parties — this model is strong. For users with state-level threat models, it's insufficient, and we won't pretend otherwise.

---

What you should demand from any notes app

Regardless of which app you use, here's what "we take privacy seriously" should actually mean:

1. Specifics about encryption. In transit? At rest? End-to-end? Who holds the keys?
2. A clear data-access policy. Can the company read your notes? Under what circumstances?
3. Real account deletion. Not deactivation. Deletion.
4. No content processing. Is your data used for AI training, ad targeting, or analytics?
5. Offline capability. Can you use the app without sending data to a server?

If the app can't answer these questions clearly, "we take privacy seriously" is a tagline, not a commitment.

---

Benchpad is three scratchpads. Offline-first. Encrypted at rest. Honest about the limits. $10/year. Start writing free →

---

Benchpad Interface