Privacy
Who is responsible
Thimo Eder, Frankenbergstraße 5, 91477 Markt Bibart, Germany, [email protected]
Hosting and server logs
This website is hosted on GitHub Pages (GitHub, Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA). Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) delivers it and protects it from attacks.
When you visit, Cloudflare processes your IP address, the time, the address of the page you ask for, your browser's user agent and, where your browser sends it, the page you came from. GitHub processes the requests Cloudflare passes on to it, which can include your IP address. This is needed to deliver the site and keep it secure (Art. 6 (1) (f) GDPR); without it, the site can't be shown to you.
Cloudflare processes this data on my behalf under its data processing agreement (Art. 28 GDPR), which lets it use the data only to provide its services, including protection against attacks, and keep it only as long as that requires. Its privacy policy describes the data it processes for its own purposes. GitHub logs IP addresses for its own security purposes, as the GitHub Pages documentation says, and handles them under its privacy statement, which says it uses brief retention terms by design. Neither publishes a fixed period for these logs, and I get neither log. Cloudflare's dashboard shows me aggregate traffic statistics and, for requests its security features block or flag, sample entries with the IP address, country, page and browser for up to 31 days; I use them only to fend off attacks.
GitHub and Cloudflare are both certified under the EU-US Data Privacy Framework. Transfers to them in the USA rely on the European Commission's adequacy decision for this framework (Art. 45 GDPR).
Downloads and updates
The Download buttons download the app from the X Bench releases on GitHub (GitHub, Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA). When you download it, GitHub processes your IP address and browser data under its own privacy statement.
The X Bench app asks xbench.dev for a new version 30 seconds after it starts and then every six hours. Cloudflare passes each check on to the X Bench releases on GitHub, so Cloudflare, on my behalf, and GitHub receive your IP address, the time and technical request data such as the app's user agent. The app sends no telemetry, analytics or crash reports. An update downloads from GitHub only when you choose to install it. The check keeps the app secure and current (Art. 6 (1) (f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework, as above.
Cookies and local storage
This website sets no cookies and uses no local storage. It loads no fonts, scripts or images from other servers, and uses no analytics service or tracking. Only if Cloudflare suspects an attack from your connection may it show a browser check, which reads technical properties of your browser, and set cookies strictly needed for it, such as cf_clearance, which records for 30 minutes that you passed (§ 25 (2) No. 2 TDDDG).
Contact by email
If you email me, I use your address and message only to answer you (Art. 6 (1) (f) GDPR), and delete them once the matter is settled, unless the law requires me to keep them. My email is hosted by ALL-INKL.COM – Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany), which processes it on my behalf. Writing to me is voluntary and not required by law or contract; without a reply address, I can't answer you.
Your rights
I personally keep only the emails you send me. The hosting providers also process data as described above, partly on my behalf. I can't tell who is behind an IP address. If you want me to check the security samples Cloudflare shows me, tell me your IP address and when you visited (Art. 11 (2) GDPR). I can ask Cloudflare about the data it processes for me; GitHub answers for its own logs directly. Your rights cover all processing I am responsible for, including processing on my behalf.
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), and to restrict its processing (Art. 18). Where processing is automated and based on your consent or a contract, you also have the right to data portability (Art. 20). To use your rights, email me at [email protected].
Right to object: where I process your data based on legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You can also complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for me is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
I make no decisions about you based solely on automated processing that have legal or similarly significant effects, and build no profiles (Art. 22 GDPR). Cloudflare automatically checks requests for attacks and may challenge or block them.
The X Bench app
X Bench runs on your Mac. It has no account and sends me no usage data, analytics or crash reports.
The services you connect receive what their features need, directly and under your own account and their privacy policies: Claude Code, Codex and Grok Build send your prompts and code to Anthropic, OpenAI and xAI, Trello and Jira boards are reached at Atlassian, and remote access, when you switch it on, runs through ngrok.
Dictation transcribes your speech on your Mac. The app's browser pane loads the pages you or your agents open, and pictures from the web in a chat or ticket load from the servers they're on. Besides that and the connected services, the app contacts GitHub for the update check and, the first time you use dictation, to download the speech model.