Privacy policy
Effective 15 October 2026.
This policy covers Bench: the website at bench.porous.systems and the Bench app for iPhone, iPad and Mac. Bench collects as little as it can. There are no accounts, no advertising, no tracking across apps or sites, and no cookies. Below is everything that leaves your device, why, who handles it, and what you can ask of us.
Who is responsible
Vitgranen AB, Sweden, makes Bench and is the controller of the personal data described here. Write to bench@porous.systems about anything in this policy.
The apps for iPhone, iPad and Mac
- The apps collect no data. There are no analytics, accounts or tracking. Your desk, each app's stored values and your settings stay on your device until you delete the app.
- The relay. Only when you press Connect does a device join the Resident relay, under a random ID (sim-…). The apps pushed to that device and the events it sends then pass between the app and the relay, which is run by Inanimate (resident.inanimate.tech), or by whoever runs the relay you set in Settings. We don't receive that traffic. Inanimate's handling of it is theirs: see inanimate.tech.
The website
| What | Why, and on what basis | Kept |
|---|---|---|
| Your bench, its apps and your code | Stored in your browser so your bench is there next time. It doesn't reach us. | In your browser, until you clear it |
| Page views (the page's address without its query, hash or a share link's ID; the referring site; browser, operating system, device type and country) | To see how much Bench is used, in aggregate, through Vercel Web Analytics, which sets no cookies and doesn't identify you. Our legitimate interest in knowing the site is used. | Aggregated; Vercel keeps the counts for the analytics period of our plan |
| A setup you share with a short link (bench.porous.systems/s/…): the displays, parts and settings, and the app's code if you include it | So that anyone with the link can open it, because you asked for the link. A long link carries the setup in the link itself and stores nothing. | With no end date, until you ask us to delete it |
| Your IP address, when you make a short link | To limit how many links one address makes (30 an hour), so the service isn't abused. Our legitimate interest in keeping it working. It isn't stored with the setup. | Up to an hour |
| An app you mirror to a device, and the state of your bench's controls | Sent, because you started mirroring, through the site to the Resident relay run by Inanimate and on to the device. We don't keep it. | Not kept by us |
As any web host does, Vercel processes the requests your browser makes (including your IP address) to deliver the site and keep it secure.
Who handles data for us
- Vercel hosts the site and counts page views (Vercel Web Analytics).
- Upstash, through Vercel, stores short share links and the hour-long rate limit.
They act on our instructions. Both are US companies, so data may be processed outside the EU/EEA, including in the United States, under the safeguards they provide, such as the EU's Standard Contractual Clauses. Inanimate, which runs the Resident relay, handles relay traffic as its own service, not on our behalf. We don't sell data or share it with anyone else.
Your rights
Under the GDPR you can ask us for access to personal data we hold about you, to correct or delete it, to limit or object to its use, and to receive it in a portable form. Since Bench has no accounts, we usually can't tell whose data is whose: to delete a short link, send us the link. Write to bench@porous.systems. You can also complain to the Swedish Authority for Privacy Protection (IMY) or the authority where you live.
Children
Bench isn't directed at children and collects nothing that identifies anyone, of any age.
Changes
If what Bench does with data changes, this page changes with it, and the date at the top moves. Bench is open source, so every change is in its history: github.com/sjunnesson/porous-bench.