Ben

Privacy Policy

Effective September 30, 2026

The short version

Ben only keeps what it needs to work: your account and the things you add yourself (cards, lists, your car, receipts, your contact card). We don't sell your data, we don't show ads, and we don't use tracking or analytics cookies.

Your data is encrypted on our server (AES-256). Card numbers aren't visible even in the admin panel.

Who we are

Ben (benhome.app) is responsible for your personal information. For any privacy question or request, email [email protected].

What we collect and why

• Account: your email, your name (optional) and your password, stored only as a one-way hash. We need these to sign you in and to send password reset emails.
• What you add: cards (number, store, note, label, expiration date, balance and stamps), card photos, shopping lists, your contact card and photo, your car (license plate and due dates), receipts, receipt photos and warranties. We keep them so we can show them to you.
• Sharing and invites: the email addresses of people you share a card with or invite. We use them only for that share and for one invite email. Invites expire after 30 days.
• Notifications: the push address your phone gives us when you turn notifications on. You can turn them off anytime.
• Security log: when and what happened in your account, IP address, approximate country and city (from Cloudflare), device and browser, language and technical request headers. It helps us spot abuse and sign-ins that aren't yours. We keep it for 180 days.

To recognize the store when you scan a card, Ben builds summary patterns from cards across all accounts: the code type, length and the common start of the numbers (up to 8 characters, only when at least 2 different accounts have it). Full card numbers are never part of these patterns, and the match against your scanned code happens on your phone.

Your camera is used only to scan codes and take the photos you choose to save.

Who we share it with

• Cloudflare: delivers and protects the connection to our site (your data travels encrypted).
• Google (Gmail): sends Ben's emails. If you sign in with Google or add a card to Google Wallet, Google receives what's needed for that.
• Google, Apple and Mozilla push services: deliver notifications to your phone (the content is encrypted).

We don't sell your personal information and we don't share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA).

Cookies and storage on your phone

We use only a necessary sign-in cookie (your session), a short-lived cookie when you sign in with Google, and a cookie that remembers your country and language. Your browser also keeps your settings (theme, text size) and a copy of your cards so they work offline. No analytics or advertising cookies, so there's nothing to opt out of.

How long we keep it

As long as you have an account. When you delete your account (Profile > "Delete account"), we immediately delete your cards, photos, lists, contact card, car, receipts, notifications and log.

Your privacy rights

• Know and access: you can see all of your data in the app, and download your cards as a file (Profile > "Backup").
• Correct: you can edit your data at any time.
• Delete: Profile > "Delete account", or email us.
• Opt out of sale or sharing: there's nothing to opt out of, because we don't sell or share your information.
• No discrimination: using any of these rights never changes how Ben works for you.

California residents have these rights under the CCPA, and residents of other states with privacy laws (such as Virginia, Colorado, Connecticut and Texas) have similar rights. To make a request, email [email protected]. We'll verify it's you by asking you to write from the email on your account, and we'll respond within 45 days.

Kids

Ben isn't meant for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has created an account, email us and we'll delete it.

Changes

If we make meaningful changes to this policy, we'll let you know in the app or by email.