Privacy Policy

Effective July 22, 2026.

Bento is made by West End Studios, based in Ontario, Canada. Bento is designed to collect as little as possible, and this policy describes everything it does collect. It covers the Bento app, the Bento Plus service, and this website.

1. Your data stays on your computer

Bento stores everything (schedule, tasks, notes, marks, study guides, backups) on your own computer. There are no Bento accounts or sign-ins, and the app contains no analytics or telemetry. Apart from the three things described next (the license check, update checks, and any AI requests you choose to run), the app does not send your content to us or to anyone else.

One choice of yours can change that picture: if you point Bento’s data folder at iCloud Drive, Dropbox, or another synced folder, that service will copy the folder to its servers and your other devices under its own privacy terms. Bento doesn’t send anything to that service itself; the syncing is done by the service you chose.

2. The license check, and update checks

When you first enter your license key, the app checks it with our server once per device (the key and a randomly generated device identifier, none of your content) and doesn’t repeat the check on that device. The device identifier is created by the app, contains nothing about your computer (no serial number, hardware identifier, or device name), and exists only to enforce the device limit for that license. If the computer is offline at the time, the app works anyway and quietly completes the check on a later launch.

Bento also keeps itself up to date: the app periodically asks our update server whether a newer version exists, and downloads it if so. That check includes the app’s version number and the standard technical information any web request carries, such as an IP address and request headers. We do not attach your license key, your profile, or any content to an update check, and our application code does not record IP addresses for update or license checks; Cloudflare, whose network these services run on, processes that technical information under its own privacy and retention practices (see Service providers below). Beyond the license check and update checks, the app only contacts our server on Bento Plus, where each AI request carries the license, described under Bento Plus below.

3. AI with your own key (buy-once plan)

When you run an AI feature using your own API key, the material involved (for example, the notes being turned into a study guide, or an uploaded marked test) is sent from your computer directly to the AI provider you chose in the app, Anthropic or OpenAI, under your own account and that provider’s privacy terms (Anthropic · OpenAI). We are not in that path at all. If you configured a Custom endpoint instead, the same material goes to that service, under whatever terms you have with it. We do not operate, review, or control Custom endpoints; choosing a service whose privacy and security practices you are comfortable with is your responsibility. Providers’ retention and data-use rules are their own, and differ between providers, sometimes between free and paid tiers of the same provider.

Your API key is stored on your computer in an encrypted file (on macOS, the encryption is protected by the Keychain; on Windows, by your Windows account’s data protection) and is sent only to the provider it belongs to, never to us. In the rare case where the operating system’s secure storage isn’t available, the app tells you so in Settings.

4. AI on Bento Plus

On Plus, the same material passes through our server, which exists to attach our AI credential, forward the request to Anthropic, and pass the answer back. About that path:

• Our server does not retain the content of requests or responses, and Bento’s application code does not write that content to its logs.
• Anthropic processes the forwarded request under its commercial API terms. As of this policy’s date, Anthropic says standard API inputs and outputs are automatically deleted within 30 days. Anthropic can retain some data longer where the law requires it or to enforce its usage policies, and its current policy describes longer retention for content flagged by its safety systems. We are on that standard arrangement; the details are in Anthropic’s own policies.
• Our server keeps usage metering: token counts and request counts per license, per month. Numbers, not content. This is what enforces the monthly allowance, and it is kept for the period described in section 11. Alongside it, per license, a randomly generated device identifier the app creates. It contains no serial number, hardware identifier, or device name; it exists only to limit how many devices use one license (for Plus, a device that makes no AI requests for a week stops counting; for the buy-once plan, the limit counts devices the license has activated).
• Our server keeps the license record: your license key, subscription status, plan, and the purchase email, created and updated by our payment provider.

We do not retain your prompts, the AI’s responses, your notes, your uploaded documents, or any other student content. On Plus, what we keep is the metering and the license record above.

5. Payments and license records

All purchases, the buy-once app and Plus subscriptions alike, are processed by Paddle as merchant of record. Paddle handles your payment details under their privacy policy; we never see card numbers. From Paddle we receive the information needed to create and manage the Bento license: the purchase email, the product or plan, license or subscription status, purchase and renewal dates, and Paddle’s customer, subscription, and transaction identifiers. Those fields become the license record for either kind of purchase.

If Bento was bought as a gift, the license record also holds the personalization the buyer typed at checkout (what the student calls them, such as “Mom” or “Aunt Sue”). It exists so the app can deliver the small surprise it powers, and it stays with the license record so later activations (a new computer, a reinstall) can still deliver it; ask us and we’ll remove it. Within Bento’s own systems, the license record is the only customer record we retain for a buy-once customer, apart from any support correspondence; our service providers process the limited information described under Service providers below.

6. Support and correspondence

If you email us, we receive your email address, your message, and anything you choose to attach. We use that to answer your question, troubleshoot Bento, and handle license or refund requests. Support conversations are normally kept for 24 months after the last message, then deleted, unless an active support matter, dispute, fraud or security issue, or legal obligation needs them longer. We don’t use support messages for advertising or profiling, and emailing us never adds you to a mailing list. You can also ask us to delete a conversation sooner, subject to anything we need to keep for those same reasons.

7. Service providers, and where information is processed

Bento is operated with the help of a few service providers: Paddle (purchases and billing), Anthropic (the AI behind Bento Plus), Cloudflare (this website, plus the infrastructure hosting Bento’s license, update, and Plus services), and the email service that hosts our support mailbox. Resend sends Bento’s transactional email, such as the license email after a purchase; to do that, it processes the recipient email address, delivery metadata, and the contents of that email, including the license key, under its own service terms and data-processing commitments. Cloudflare processes technical information such as IP addresses to deliver and protect those services, and may retain operational data under its own privacy and retention practices; our application code does not record those IP addresses. These providers may process information in Canada, the United States, or other countries where they operate, and information processed outside your province or country can be subject to the laws of that jurisdiction.

We may use or disclose the information we hold where the law or valid legal process requires it, or where the law permits it, to investigate fraud, abuse, security incidents, or threats to Bento or its users. West End Studios can only disclose information it actually holds or controls, and because Bento collects very little, that information is limited.

8. Security

We protect the small amount we do hold with safeguards matched to it: encrypted connections for data in transit, access controls on the license service and its admin tools, and systems designed to log and retain as little as possible. Access to license and usage data is limited to what’s needed to operate and support Bento. No system can be guaranteed secure, but collecting less means there is less to expose if something ever goes wrong.

9. This website

bentoplanner.com is a static site. Bento uses no analytics, advertising cookies, or tracking technologies on it. The site is delivered through Cloudflare, which processes technical information such as IP addresses, and may apply its own strictly-necessary security measures, as part of serving and protecting the site.

10. Students and children

Bento is designed and sold for university and college students, and Bento and its AI features are intended for users 18 years of age or older. We do not market Bento to children or design it for them.

Bento does not require a student account, name, age, or email address to use the app. The optional profile (a first name and a country, used to orient the AI) is stored on the computer and appears only inside the AI requests described above. Student content stays on the computer unless someone deliberately runs an AI feature: on the buy-once plan that material goes directly to the chosen provider under the buyer’s own account, and on Bento Plus it passes through our server to Anthropic as described above, where we do not retain it. If you believe personal information about someone under 18 has reached us contrary to this policy, contact our Privacy Officer (below); we will investigate and delete it where required, subject to anything we must keep for legal, security, or fraud-prevention reasons.

11. Retention and deletion

• License records are retained for as long as the license needs to keep working. For the buy-once plan that is the life of the product, and for Plus that includes lapsed subscriptions, because the app deliberately keeps working after a subscription ends and the record is what proves the license is real.
• Usage counters are monthly token and request totals per license (numbers only), kept for 24 months for administering the allowance, support, fraud prevention, and billing disputes, then deleted.
• Device identifiers are kept with the license record. On Plus, a device that makes no AI requests for a week stops counting toward the limit on its own; buy-once activations count until we clear them at your request (the app never contacts us after activation, so nothing ages out by itself).
• Rate-limit counters are per-minute and delete themselves within minutes.
• Support conversations are kept for 24 months after the last message, then deleted (sooner on request), unless an active dispute, security matter, or legal obligation needs them longer.
• Database backups: a deleted record can persist in our database’s automatic backups for up to 30 days before aging out.
• Your app data is yours: export it, back it up, or delete it, all from inside the app.

12. Your privacy rights

Email hello@bentoplanner.com to ask what information Bento holds about you, to correct it, or to request deletion. For most customers that means one license record; for Plus customers it also includes the usage counters. Deleting a license record stops that license from activating or from using Plus AI, so we will confirm before doing it. We may also ask for enough information to confirm a request concerns your own license or information before acting on it. Paddle keeps its own transaction records as merchant of record, under its own privacy policy and legal retention duties; requests about payment details go to Paddle, since we never had them.

If you have a complaint about how Bento handles personal information, contact our Privacy Officer (below); we will investigate and respond. Depending on where you live and which privacy law applies, you may also have the right to complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

13. Changes and contact

If this policy changes materially, the new version is posted here with a new effective date, and we will give additional notice where the law requires it, such as by email or in the app. If a change would ever mean collecting more than described above, the How Bento uses AI page changes with it. Privacy Officer: Founder, West End Studios, hello@bentoplanner.com.