Privacy policy — HWBench
Last updated: October 16, 2026
Who we are
HWBench (gethwbench.com) is a free, non-commercial website operated by Michael Pechorsky, Israel ("we"), who is responsible for the processing described here. Contact: [email protected].
We have not appointed a representative in the EU (GDPR Art. 27) or in the UK. HWBench does not target or monitor people in the EU or the UK. It is a free English-language site, and it does no tracking or profiling. We will appoint one if this changes.
Summary
No cookies, no ads, no third-party analytics and no accounts. We store the minimum we need for each feature, as described below. Our application never stores raw IP addresses.
What we process, why, and for how long
| Activity | Data | Purpose | Legal basis (GDPR / UK GDPR) | Recipients / subprocessors | Retention |
|---|---|---|---|---|---|
Search & test-request log (/find, /find.json, "Request a test") | Hour (UTC), search parameters, referrer without ?/#, browser or crawler family. No IP, no full user-agent | Learn which hardware and workloads people want | Legitimate interests, Art. 6(1)(f) | Cloudflare (hosting, database) | 12 months, then deleted |
| Newsletter (double opt-in; not active yet, applies once it launches) | Your email address (lowercased), status (pending or confirmed), a one-way hash of your confirmation token and its expiry, the hour you signed up and confirmed. No open or click tracking | Send you the HWBench newsletter you asked for | Consent, Art. 6(1)(a) | Cloudflare (hosting, database); an email-sending provider, which will be named in this policy before any address is collected | Until you unsubscribe or ask us to forget you, when the row is deleted. Unconfirmed sign-ups are deleted when the confirmation link expires after 48 hours |
| Submitted results ("Submit your result") | What you enter: platform, task, model, precision, software stack, metric, value, unit, batch, power, source link and notes. Plus a consent record: that you ticked the consent box, the version (date) of the contributor terms you accepted, and the time of consent (UTC). We do not ask for your name or email. Please do not put personal details in the notes, because notes may be published with an accepted result | Review the result and, if it is accepted, publish it as benchmark data. The consent record proves what you agreed to | Consent (Art. 6(1)(a)) to submit and publish; legitimate interests (Art. 6(1)(f)) in reviewing, checking and keeping an accurate dataset, and in keeping proof of consent | Cloudflare (hosting, database). Reviewed by Michael Pechorsky / HWBench | Rejected submissions are deleted 90 days after review. Submissions never reviewed are deleted 90 days after receipt. Accepted results are kept and published under the HWBench data licence (see the Terms of use), with our internal review notes removed. The consent record is kept for as long as the submission itself |
| Abuse protection (rate limits) | A per-day counter keyed on HMAC-SHA256(a random salt created each day, your IP address). The raw IP is never stored | Stop spam and abuse of the forms (for example, 5 submissions or 3 sign-ups a day per visitor) | Legitimate interests in security, Art. 6(1)(f) | Cloudflare (hosting, database) | The daily salt and counters are deleted after 2 days. After that, no one, including us, can link a hash to an IP |
IP hashes are salted daily. Each UTC day we generate a new random secret salt. Your IP address is combined with that day's salt using HMAC-SHA256, and only the result is stored. The salt is never reused across days, and it is deleted together with its counters after 2 days.
Hashed IPs are still personal data. While the daily salt exists (up to about 48 hours), a hashed IP could in principle be matched to a known IP address. So we treat these counters as pseudonymous personal data, not anonymous data, and delete them quickly.
How the retention periods fit together. The 12-month limit on the search and test-request log is unchanged. Every other record is deleted sooner: rate-limit data after 2 days, unconfirmed sign-ups after 48 hours, and rejected or never-reviewed submissions after 90 days. The only exceptions are the ones you choose: once the newsletter launches, a confirmed newsletter address is kept until you unsubscribe, and an accepted result is published together with its consent record, which is kept for as long as the result.
Report fields on the home page ("Name, title", "Customer / project") stay in your browser and are never sent to us.
Newsletter: confirming, unsubscribing and withdrawing consent
The newsletter is not active yet. When it launches, the email provider used to send it will be listed here before any address is collected. The rest of this section describes how it will work once it launches.
- When you sign up, we send one confirmation email. You are added only if you click the link within 48 hours.
- Every newsletter contains a personal unsubscribe link. Opening the link does not unsubscribe you by itself: it shows a confirmation page, and your address is deleted only when you press the confirm button. Email apps that support one-click unsubscribe do the same confirmed step for you. This means a link-scanning program cannot remove you by accident.
- You can withdraw consent at any time, by unsubscribing or by writing to [email protected]. You can also use "Delete my data" to erase everything stored for your email address. To protect you, we first email a confirmation link to that address. The link works once and expires after 1 hour. Opening it shows a confirmation page, and the data is deleted only when you confirm there. We give the same reply whether or not the address is stored, so no one can use the form to find out who is subscribed. Withdrawing consent does not affect processing that took place before you withdrew.
- To withdraw consent to a submission, email us before it is published. After publication, we will remove or anonymise the entry on request where we can.
Our hosting provider and international transfers
The site runs on Cloudflare (Cloudflare Pages, Workers and D1), which acts as our processor under its Data Processing Addendum (https://www.cloudflare.com/cloudflare-customer-dpa/). To deliver pages and protect against abuse, Cloudflare necessarily processes your IP address and request metadata in transit. Its privacy policy is at https://www.cloudflare.com/privacypolicy/. We do not use Cloudflare Web Analytics or export Cloudflare logs. The newsletter is not active yet. When it launches, the email provider used to send it will be listed here before any address is collected. That provider will act as our processor under its data processing terms.
These providers may process data outside your country, including in the United States. Those transfers rely on the providers' data processing terms, which include the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. We are based in Israel, which the European Commission recognises as providing adequate protection for personal data (Decision 2011/61/EU).
Sharing
We do not sell or "share" (as the CCPA defines it) personal information, and we do not use it for targeted advertising. We never give the newsletter list to anyone except our email-sending provider. We may publish aggregated statistics, and accepted results as described above.
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of personal data, and to data portability. These include rights under the GDPR and UK GDPR, the Israeli Privacy Protection Law, 5741-1981, Brazil's LGPD, Canada's PIPEDA and California's CCPA/CPRA (to know, delete and correct, to opt out of sale or sharing, and freedom from discrimination for exercising your rights). For the newsletter, use the unsubscribe link or "Delete my data". Both delete only after you confirm on a confirmation page, and "Delete my data" is verified by a single-use emailed link that expires after 1 hour. You can also write to us. Search logs, submissions and rate-limit counters hold no direct identifiers, so we usually cannot link them to you, but write to [email protected] and we will help. We reply within 30 days.
You may also complain to a supervisory authority: the Israeli Privacy Protection Authority (https://www.gov.il/en/departments/the_privacy_protection_authority), your EU or EEA data protection authority, the UK Information Commissioner's Office (https://ico.org.uk) or Brazil's ANPD.
Do Not Track / Global Privacy Control
We do not track visitors across sites or over time, so we treat every visitor as if Do Not Track or Global Privacy Control were switched on.
Children
The site is not directed at children under 16, and we do not knowingly collect their information.
Changes
If we change this policy, we will update the date at the top and describe material changes on this page.