Privacy Policy

This policy explains what personal data we process when you use Katabench, why, and what your rights are. The data controller is Milan Jovanovic Tech DOO. Contact us at [email protected].

What we collect

• Account data: your email address and display name. Sign-up, sign-in, and credential management are handled by our authentication provider, Clerk; we don't store your password ourselves.
• Submissions: the code you write and the grading results (timings, allocations, test outcomes). Stored so you can see your own history and progress.
• Usage data: basic server logs needed to run and secure the Service (requests, error rates, abuse signals). In the app we also collect first-party telemetry: error reports, page-performance metrics such as Core Web Vitals, and session/view information, correlated by your opaque account id (never your email or name) using a self-hosted monitoring stack. This telemetry goes only to our own infrastructure; no third party receives it. We use no advertising trackers and no cross-site profiling, and we don't run a third-party web-analytics product.
• Payment data: purchases are processed by Paddle as merchant of record. Paddle collects and processes your payment details under its own privacy policy; we receive only what we need to operate your subscription (e.g., plan, status, country), never your card number.
• Support correspondence: emails you send us.

This marketing website (katabench.com) sets no tracking cookies. The app (app.katabench.com) uses a session cookie strictly for authentication, and local browser storage for a telemetry session id (see "Usage data" above) and to keep your in-progress code on your device.

Why we process it (legal bases)

Under the GDPR we rely on three legal bases: performance of our contract with you (Art. 6(1)(b)) to run the Service, including accounts, grading, history, authentication, billing, and transactional emails; legal obligation (Art. 6(1)(c)) for billing and tax records; and our legitimate interests (Art. 6(1)(f)) in keeping the platform secure and abuse-free and in improving the Service.

Sharing and processors

We do not sell personal data. We share it only with the providers needed to run the Service: Hetzner (infrastructure hosting) and Clerk (authentication) act as our processors, each under a data processing agreement. Paddle, our merchant of record, handles payment data as an independent controller under its own privacy policy (see "Payment data" above). We do not currently use a third-party analytics or email-marketing processor; if we introduce one, we will list it here before it goes live. Where data leaves the EEA, we rely on adequacy decisions or standard contractual clauses.

Retention

Account data and submissions are kept while your account exists and deleted within 30 days of account deletion, except where law requires longer retention (e.g., invoicing and accounting records under Serbian tax law). Backups roll off on a fixed schedule.

Your rights

You can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Email [email protected], or delete your account directly in the app. If you believe we're handling your data unlawfully, you may lodge a complaint with your local supervisory authority.

Changes

We'll post changes here and, for material changes, notify you by email or in-app notice.