Privacy Policy

This policy explains what personal data we process when you use Katabench, why, and what your rights are. The data controller is Milan Jovanovic Tech DOO. Contact us at privacy@katabench.com.

What we collect

• Account data: your email address and display name. Sign-up, sign-in, and credential management are handled by our authentication provider, Clerk; we don't store your password ourselves.
• Submissions: the code you write and the grading results (timings, allocations, test outcomes). Stored so you can see your own history and progress.
• Usage data: basic server and edge-network logs needed to deliver and secure the Service (requests, error rates, and abuse signals). The app also requests a limited set of remote UI release flags needed to safely enable, disable, or roll back features. An anonymous lookup uses only an in-memory identifier; a signed-in lookup may use your opaque account id, never your email or name. If you allow analytics, we also collect explicit product events, error reports, page and session information, and performance metrics such as Core Web Vitals. App diagnostics are sent to our self-hosted monitoring stack; limited product events are processed in the EU by PostHog. On the marketing site, we also use privacy-focused Cloudflare Web Analytics for aggregate traffic and performance measurement. It does not use analytics cookies or log URL query strings. We use no advertising trackers and do not build cross-site profiles.
• Payment data: purchases are processed by Paddle as merchant of record. Paddle collects and processes your payment details under its own privacy policy; we receive only what we need to operate your subscription (e.g., plan, status, country), never your card number.
• Newsletter data: if you subscribe, we process your email address, signup source, consent and unsubscribe records, and newsletter preferences. Our email provider, Kit, also processes delivery status and engagement information such as email opens and link clicks so we can operate the list, understand which emails are useful, and maintain deliverability.
• Support correspondence: emails you send us.

Cookies and similar technologies

We describe these technologies by family because providers may rotate individual cookie names as their security and authentication systems change.

Family	What it does	Typical duration	Status
Authentication and session	Clerk signs you in, maintains your session, and protects the authentication flow. Tokens may contain account and session identifiers.	Short-lived tokens are refreshed during your session; supporting sign-in state may persist for the configured account session lifetime or until you sign out.	Necessary
Security and traffic delivery	Cloudflare and Clerk distinguish legitimate traffic from abuse, enforce rate limits, and securely deliver the site.	Usually the browser session or another short security period.	Necessary
Consent and preferences	Katabench remembers whether you selected necessary technologies only or also allowed analytics.	6 months	Necessary
Functional browser storage	Katabench keeps preferences and local product state such as theme, in-progress editor content, learning progress, and a destination needed to complete a sign-up flow.	Until the feature no longer needs it or you clear browser data.	Necessary
Service configuration and controlled rollout	A limited remote configuration lookup lets Katabench safely release, disable, or roll back UI features. It may use an ephemeral in-memory identifier or, when signed in, an opaque account id. No feature-exposure event is retained when analytics is disabled.	The browser value is memory-only for the current page; rollout rules last until the feature is fully released or retired.	Necessary
Product and performance analytics	With permission, our self-hosted monitoring measures errors, performance, and sessions, while a limited product-improvement funnel is sent to our EU analytics project. Browser markers and signed-in events use only an opaque account id.	Self-hosted telemetry is kept for 14 days. Product events are kept for up to 12 months. Browser markers remain until you withdraw permission or clear browser data.	Optional; consent required
Aggregate marketing-site analytics	With permission, Cloudflare's cookieless beacon measures marketing page views, referrers, approximate location, browser/device information, and performance.	Cloudflare makes Web Analytics data available for up to 6 months.	Optional; consent required

Optional analytics is off until you confirm Allow all or a selection with Analytics enabled. Your choice applies to both katabench.com and app.katabench.com. Use the Cookie settings control on either site to change or withdraw it at any time. Withdrawing stops future analytics on your next page load and removes analytics browser storage on the app; it does not affect processing that already occurred.

Newsletter consent is separate from the analytics choice above. Marketing emails sent through Kit may contain a small tracking image and tracked links that record opens and clicks. You can withdraw newsletter consent at any time using the unsubscribe link in every marketing email; changing Cookie settings does not subscribe or unsubscribe you.

Why we process it (legal bases)

Under the GDPR we rely on four legal bases: your consent (Art. 6(1)(a)) for optional product, performance, and web analytics and for newsletter marketing; performance of our contract with you (Art. 6(1)(b)) to run the Service, including accounts, grading, history, authentication, necessary service configuration and controlled feature rollout, billing, and transactional emails; legal obligation (Art. 6(1)(c)) for billing and tax records; and our legitimate interests (Art. 6(1)(f)) in securely delivering the platform, preventing abuse, and diagnosing the Service without optional browser analytics. You may withdraw analytics consent at any time through Cookie settings.

Sharing and processors

We do not sell personal data. We share it only with the providers needed to run the Service: Hetzner (infrastructure hosting), Cloudflare (content delivery, security, and consent-based Web Analytics), Clerk (authentication), and Kit (newsletter list management, delivery, and engagement reporting), and PostHog (EU-hosted service configuration and consent-based product analytics) act as our processors, each under a data processing agreement. Kit's processing of newsletter subscriber data is governed by its Data Processing Addendum. Paddle, our merchant of record, handles payment data as an independent controller under its own privacy policy (see "Payment data" above). We do not currently use an advertising processor. Where data leaves the EEA, we rely on adequacy decisions or standard contractual clauses.

Retention

Account data and submissions are kept while your account exists and deleted within 30 days of account deletion, except where law requires longer retention (e.g., invoicing and accounting records under Serbian tax law). Backups roll off on a fixed schedule.

Necessary security logs are kept only as long as required to operate, investigate, and protect the Service under our and our providers' retention schedules. Optional self-hosted browser telemetry is kept for 14 days, product events for up to 12 months, and Cloudflare Web Analytics is accessible for up to 6 months. Browser-side durations are described in the table above.

Newsletter data is kept while you remain subscribed. After you unsubscribe, we stop marketing sends and retain only the limited consent and suppression record needed to honor your choice, resolve complaints, and demonstrate compliance. You may ask us to delete that record where applicable.

Your rights

You can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Email privacy@katabench.com, or delete your account directly in the app. You can withdraw newsletter consent using the unsubscribe link in any marketing email. If you believe we're handling your data unlawfully, you may lodge a complaint with your local supervisory authority.

Changes

We'll post changes here and, for material changes, notify you by email or in-app notice.