Legal

Privacy notice

Last updated 7 November 2026. This page lists the data we keep, why we keep it, for how long, and how to have it removed.

What we store

Your GitHub username, and when you first signed in

Why: Identifies you, and shows you as the owner of your entries
Who sees it: Public in the site's API with each run you publish, but not shown next to your entries on the board. Your profile page, off until you turn it on in Account settings, shows it with your published runs and that date
How long: Until you ask us to delete it

A signed session cookie holding your username

Why: Keeps you signed in
Who sees it: Only your browser and the server
How long: 14 days, or until you sign out

Your entries: name, description, configuration

Why: To list your runs on their boards
Who sees it: The name and the agent configuration are public, but an option value that is an object, a URL or text over 40 characters shows only as a short digest. Only maintainers see the description and those values in full. Entries made by pull request before 24 October 2026 are also visible to anyone who can see their pull request in node-q/hpg-submissions
How long: Until you ask us to delete them

Scores, and each task's result: its name, reward and any error, the agent's time, and the tokens and cost it used

Why: The boards
Who sees it: Public once published. Each task's result is public for runs published from 24 October 2026, and for earlier runs only if their owner agrees
How long: Indefinitely, as benchmark records, even after you delete the job

Run logs and agent trajectories of past runs on our machine

Why: Debugging and integrity review
Who sees it: Maintainers, while we had them
How long: 14 days. The site no longer runs benchmarks, and none are left

Jobs you upload to Your bench: results, trajectories, logs and other files. Your saved keys, and values in common key formats, are replaced with [REDACTED] before anything is stored

Why: So you can look at your runs
Who sees it: You, and maintainers handling an abuse report or support request; every such access is recorded
How long: Trajectories, logs and other files: hidden 30 days after upload. Each job's and trial's config.json, lock.json and result.json: readable until you delete the job. A deleted job is hidden at once. Stored files leave our storage only when we purge them after a review

For each job you publish, or upload with a run token: its hbench job id, and each trial's task, start time, finish time and token counts

Why: So the same job can't be published twice
Who sees it: Maintainers
How long: Indefinitely, even after you delete the job

Model keys you saved before the site stopped taking them

Why: No run uses them. Until you delete them, we use them only to replace them with [REDACTED] in jobs you upload
Who sees it: Nobody through the site: they're stored encrypted and never displayed. If your agent prints a key, it can appear in that run's trajectory, which maintainers can read
How long: Until you delete them in Account settings. A deleted key is hidden and never used again; its encrypted copy stays in our database

Contact address in the manifest of an entry made by pull request before 24 October 2026

Why: To reach you about your entry
Who sees it: Anyone who can see that pull request in node-q/hpg-submissions, and maintainers in our database
How long: Until you ask us to delete it. A copy stays in the repository's history

Runs you publish: score, entry name, owner, agent configuration, and any machine description you gave when you issued the run

Why: To list them on their board
Who sees it: Public. The board shows the score, entry name and agent configuration. The owner and the machine description are public only through the site's API, not on the board. When we take one down, its reason code and note are public in the audit log, and the note never names a person
How long: Indefinitely, as benchmark records, or until you ask us to delete them

Reports you file

Why: To act on them
Who sees it: Maintainers only, never the person reported
How long: Indefinitely

Emails you send to hello@nodeq.tech

Why: To answer you
Who sees it: Maintainers only
How long: We keep them as long as we need to answer you, and delete them if you ask

Server access logs, including IP addresses

Why: Security and abuse handling
Who sees it: Maintainers
How long: Rotated at 50 MB, and older logs are discarded

Encrypted backups of all of the above

Why: Disaster recovery
Who sees it: Maintainers
How long: Until a maintainer removes them by hand

We use Google Analytics to count visits and see which pages people read. It sets cookies whose names start with _ga in your browser, and Google receives your IP address, your browser's details and the pages you visit. Your browser also stores one setting of ours: whether you chose the light or dark theme.

Who else is involved

OVHcloud, which hosts our server in Singapore: the database, the API and this web app.
GitHub, when you sign in. We ask only for your public profile and don't keep the GitHub token.
Cloudflare, which carries all traffic to this site, terminates TLS, and stores Your bench's job files and our encrypted backups in R2.
Grafana Labs, whose Grafana Cloud keeps our server's metrics and logs for monitoring. The logs include IP addresses and the paths requested.
Google, whose Google Analytics counts visits to this site. It receives the pages you visit, your IP address and your browser's details, and sets the _ga cookies.
Our email provider, for mail you send to hello@nodeq.tech: Cloudflare Email Routing forwards it to our Gmail inbox, which Google hosts.
Your model provider, when a run uses your key. Your run's prompts and outputs go to them, and their terms apply to those calls.

We don't sell your data or share it with anyone else.

Subprocessors lists each provider with what it processes and where.

Your choices

Delete any model keys you saved before, at any time, in Account settings.
Download a copy of your data in Account settings. To have your account, entries and scores deleted, email hello@nodeq.tech. Deleting hides the data at once and keeps a hidden record. Stored files leave our storage only when we purge them after a review, and backups keep a copy until a maintainer removes it by hand.