Privacy Policy

bento is a tool for turning a single static HTML file into a shareable, sandboxed link — an incubation under draftzero.xyz. This policy explains what we collect, why, who processes it, how long we keep it, and your controls. It applies whether you use bento via the website, the HTTP API, the CLI, or a connected AI client (e.g. ChatGPT or Claude over MCP).

What we collect

• The HTML you publish. The single HTML document you upload, paste, or have an AI client publish on your behalf, plus a title (taken from your input or the page's <title>). This is stored so we can serve your shareable link.
• IP address. The IP of the creator/reporter, used only for rate-limiting and abuse prevention. We do not use it for advertising or profiling.
• API tokens. Tokens that authorize publishing are stored hashed; the plaintext is shown to you once and never stored. A token owns the pastes it creates so it can update or delete them.
• PINs (private pastes only). If you make a paste private, the 4-digit PIN is stored as a one-way bcrypt hash — we cannot recover it.
• Aggregate view counts. A per-paste hit counter. It is not tied to a viewer identity; viewers are not tracked.
• Abuse reports. A free-text reason and the reporter's IP, used to review and act on reported content.

We do not require an account, name, or email to use bento, and we do not collect passwords, payment-card data, health data, or government identifiers. Publishing pages that contain login/password fields is blocked.

How content is rendered

Your HTML renders inside a sandboxed iframe on a separate, cookieless per-paste origin, isolating it from the app and from other pastes. Public pastes are reachable by anyone who has the link; private pastes additionally require the PIN.

Who processes your data (subprocessors)

• Fly.io — application hosting.
• Cloudflare — CDN/edge, TLS, and Turnstile (a privacy-preserving anti-bot check that processes a challenge token and IP at create/connect time). Cloudflare R2 stores the HTML bodies.

We don't sell your data, and there are no third-party advertising or analytics trackers.

Retention

Pastes auto-expire 30 days after their last update, after which the HTML body and its metadata are deleted. Deleting a paste removes it immediately. Reported content that crosses a threshold is disabled pending review. Hashed tokens persist until they expire or are revoked.

Your controls

• Delete anytime — with your API token (or the paste's one-time edit token) via the API, CLI, or a connected AI client (delete_paste).
• Let it expire — do nothing and it's removed after 30 days.
• Report — flag any paste for review from its page or via abuse reporting.
• Revoke access — a connected client's token is independent and revocable.

Connected AI clients (MCP)

When you connect bento to an AI client, authorizing the connection mints a bento token tied to that connection (no account or email is created). The client can then create, update, and delete the pastes it makes. Only the HTML documents you ask it to publish are sent to bento.

Children

bento is not directed to children under 13 and we do not knowingly collect their data.

Changes & contact

We may update this policy as bento evolves; material changes will be reflected here. Questions, data requests, or privacy concerns: hi@bento.draftzero.xyz (abuse reports: abuse@draftzero.xyz).