The Benchmark: Privacy Policy

Effective: 20 October 2026

The Benchmark is an online game. Your profile, results, bests and favourites are saved on our servers so you can keep your history, compare with friends and appear on leaderboards. This notice covers the game, its Playtest, our website and support correspondence.

Who we are

Denis Ceric, an individual trading as Prephyx in Montenegro, is the controller responsible for deciding how your personal data is used. In this notice, "we" and "our" refer to Denis Ceric operating The Benchmark.

For privacy questions or requests, email thebenchmarkgame@gmail.com.

What we collect

Steam sign-in and profile. We receive your SteamID, display name and Steam friends' IDs. Steam verifies your sign-in ticket; the game database does not keep that ticket or your Steam password. We store an internal player ID, account creation and last-sign-in times, your linked SteamID and display name. Friends' IDs are matched against players of The Benchmark; we retain links only to friends who also play, refreshed when Steam supplies your friend list at sign-in.

Country and preferences. If you have never set a country, we initially use the country Cloudflare reports for your connection. The game database stores a two-letter country code, its broad region and whether the country was detected or chosen; it has no IP-address field. You can change or clear your country in Settings. After that we do not preset it again for that profile. We also store favourite games and your choice about displaying your name on public boards.

Results and rankings. When a result is successfully saved, we store its run ID, game and rules version, score, result statistics, server timestamp, moderation status, game build and platform. We calculate bests, ranks, overall points and score distributions from these results.

Moderation. We keep account/result status and records of moderator decisions, including affected internal player/run IDs, time, action and reason. Name changes also record the previous and replacement names. Staff access and actions are recorded separately from public boards.

Technical requests and support. Cloudflare receives request information, including IP addresses, to deliver and secure the website and game service. Hosting providers process technical, security and error logs. Our application records errors, and Cloudflare samples requests for troubleshooting. If you contact us, we receive your email address, message and any information or attachments you choose to send. Please do not send passwords or Steam Guard codes.

On your device. Theme, sound and display preferences remain on your device. We do not request GPS location or collect payment-card details through the game; Steam handles purchases. We do not use advertising trackers or third-party marketing analytics in the game or website. Service performance metrics and our administrative usage summaries help us operate the game.

Why we use it

Where data-protection law requires a legal basis, we use:

Providing the online game and responding to service requests: account/sign-in data, results, history, preferences, rankings and friend comparisons are used to perform our contract with you.
Relevant regional boards: our legitimate interest in providing useful country/region rankings supports the initial country setting, which you can change or clear.
Fair play, safety and reliability: our legitimate interests in fair competition, handling moderation disputes, preventing abuse and maintaining the service support moderation, security/error logs and operational summaries.
Support and legal requests: we use correspondence to answer you, resolve problems and meet any applicable legal obligations.

Steam sign-in and saving your results are necessary to provide this online-only game. Without the required account and result data, those services cannot work. Choosing a country, showing your name on public boards, setting favourites and contacting support are optional.

We do not sell personal data or share it for advertising. Automatic checks can refuse invalid submissions or hold implausible results out of rankings for review. Moderators can review held results and act on accounts. Contact us to challenge a moderation decision. We do not use these game checks to make decisions with legal or similarly significant effects on you.

What other players can see

Public leaderboards show rank, display name and score. Names are initially visible. If you hide your name in Settings, other players see "Anonymous player" on public boards. Your name remains visible to you and to Steam friends on friends boards and comparisons.

Country and region determine which boards include your results. A player viewing a country board can therefore infer the country associated with a listed result. Clearing your country removes that profile's country/region board membership after cached results refresh.

Providers and international processing

Cloudflare, Inc. delivers our website and API, connects the API to the database and provides security, caching and operational logs on its global network.
Neon, a Databricks service, hosts our game database in Frankfurt, Germany. Its hosting/support providers may process data in other countries under its service terms.
Google/Gmail handles correspondence sent to our support address.
Valve Corporation (Steam) separately operates your Steam account, purchases and Steam services under its privacy policy.

The controller accesses the service from Montenegro. Database hosting in Germany does not mean all processing occurs in the EU. Our hosting contracts include data-processing terms and international-transfer safeguards, including standard contractual clauses and applicable adequacy frameworks. You may contact us for information about the safeguards relevant to your data. Providers may also process technical/account data for their own responsibilities under their terms and privacy notices.

How long we keep it

Game profile, linked identity and results: while your game profile exists, including older results and derived bests/rankings. There is currently no automatic age-based expiry for individual results.
Friend links: refreshed when Steam supplies the list at sign-in; removed when the relevant game profile is deleted.
Public caches: leaderboard copies refresh on short intervals, ordinarily within a minute; aggregate score-distribution caches last up to ten minutes. A page already open on another player's device may show an older copy until it refreshes.
Moderation records: retained after game-data deletion to document decisions, investigate disputes and protect the integrity of moderation. These records are not automatically erased by "Delete my data" and currently have no fixed automatic expiry. They can include earlier names and internal player/run IDs. Contact us to request a review of continued retention; any applicable legal right to erasure or restriction still applies.
Support correspondence: retained while needed to handle your request, related follow-up, disputes or applicable legal obligations. The need for continued retention depends on the issue rather than the lifetime of your game profile.
Application/request logs: sampled logs are retained in Cloudflare Workers Logs for three days under our current Free plan. Cloudflare may retain other security or service records under its own responsibilities.
Database recovery history: the production and Playtest databases currently have a six-hour point-in-time recovery window. A deleted record may remain recoverable within that window. This is the recovery-history setting, not a promise that every separate copy of data is erased after six hours; data held separately for support, moderation or provider security has the retention described above.

Your controls and requests

In Settings → Account & data:

Download my data creates a JSON copy containing your profile details, linked identities, saved runs, current friends and moderation entries about that profile. You may also email us for an access request or information not included in this download.
Delete my data removes the current profile, identity link, results, bests, favourites, friend links and overall ranking from the active game database. The current game then reconnects through Steam and creates a fresh, empty profile. It does not delete your Steam account or prevent future sign-in. Retained moderation records, support correspondence, temporary caches and recovery copies are described above. If you want help stopping further account processing, contact us.
Country and public-name controls let you change board membership and how your name appears.

Depending on the law that applies, you may request access, correction, erasure, restriction or portability of personal data, or object to processing based on legitimate interests. You can also complain to us about how your data or a privacy request has been handled by emailing the address above. We may need proportionate information to verify a request. We respond within the applicable legal deadline, normally one month under the GDPR/UK GDPR, and explain any permitted extension.

You may complain to your competent data-protection authority. This may be Montenegro's Agency for Personal Data Protection and Free Access to Information, an EU authority where you live or work, or the UK Information Commissioner's Office.

Younger players

Steam's age and account rules apply to access through Steam. We do not receive your date of birth from the Steam sign-in used by this game. If you are a younger player, ask a parent or guardian for help understanding this notice. A player or guardian can contact us about a child's information or privacy rights.

Security and changes

Connections to our service are encrypted. Game sessions expire within 24 hours, and the Steam ticket and session token stay out of the desktop game's interface. Administrator access requires Cloudflare Access and multi-factor authentication; administrative changes are recorded with a reason.

We update this notice when our practices change and show its effective date above. We will provide additional notice where required by applicable law.