MoldBench Privacy Policy

This Privacy Policy explains how your personal data is processed when you use the MoldBench application (iPhone, iPad, Android and Mac versions; the "App") and the website https://moldbench.com (the "Site"). A separate notice for users in Turkey under Turkish data protection law (KVKK Aydınlatma Metni, in Turkish) is available at https://moldbench.com/tr/kvkk.

This policy has been prepared in light of Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Turkish Communiqué on the Obligation to Inform, Articles 13–14 of the EU General Data Protection Regulation (GDPR, 2016/679), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA) and similar US state laws, and the Apple App Store and Google Play rules.

1. Data controller and privacy contact#

The person who develops and provides MoldBench and who is the data controller for your personal data:

• Kadir Tolaz
• E-mail (privacy contact): support@moldbench.com. Writing "Personal Data Request" in the subject line helps us route your request faster.
• Website: https://moldbench.com

In this policy, "we", "us" and "our" refer to the data controller.

2. In short#

• No account. You do not create an account to use the App; we do not ask for your name, e-mail address or phone number.
• Your engineering data stays on your device. Your calculations, projects, calculation history and the CAD files you open are not sent to us or to anyone else.
• Ads only with your consent. In the free version on Android and iOS, ads are shown only if you tick the optional box at first launch or turn them on later in Settings. Ads are always requested as non-personalized. If you do not consent, no feature is restricted. There are no ads in the Mac version or in Pro.
• You control crash reports and session records. While this feature is on, a short session record is sent at the start of each session, even if nothing crashes. If your device's language/region preference is the European Economic Area (EEA), the United Kingdom or Switzerland, they are sent only with your consent; in every case you can turn them off in Settings.
• The store takes the payment. We never see your card details; your Pro entitlement is verified with a random ID that does not contain your name or e-mail address.
• We do not sell your personal data.
• The Site sets no cookies of its own; our hosting provider may set a cookie that is strictly necessary and used for security only. The Site does not track visitors and contains no advertising tags.

3. Data that stays on your device#

The following is processed and stored only on your device and is not transferred to us or to third parties:

• Values you enter in calculation screens, results, projects, calculation history and settings.
• STEP, DXF and DWG files you open in the App. The App's built-in viewer processes them on the device; the local server used by the viewer accepts connections only from within the device itself.
• Temporary copies of files received from another app via "Open in". They are deleted the next time the App starts.
• PDF reports and .mbench backup files you create. These files leave the device only when you save or share them; you choose where they are saved and with whom they are shared. A .mbench backup is not encrypted; it is readable text (JSON). Take care when storing or sharing backup files.
• Your consent and permission records: which version of the legal texts you accepted and when, your ad and crash-report choices and the times you made them. These records are kept on your device to apply your choices and as evidence.

Operating system backups. If your device's own backup feature is on (for example iCloud Backup, or Android's automatic backup to your Google account), the operating system may back up App data to your own account. Those backups are between you and Apple or Google; we have no access to them. You can manage this feature in your device settings.

You can remove this data from within the App or by deleting the App. Because we do not hold your data, we cannot recover it if your device is lost or the App is deleted; we recommend creating .mbench backups regularly (Settings > "Backup & Transfer").

4. Data processed in the App through service providers#

The App uses software development kits (SDKs) of the service providers below. This data is sent from your device directly to the respective provider. We do not match it with identity information such as your name or e-mail address.

4.1 Ads — Google AdMob (free version on Android and iOS only)#

• When: Only if you tick the optional ad consent box on the agreement screen at first launch, or later turn on Settings > "Ad consent". If you do not consent, Google's ad software is never started, no ads are shown and no feature is restricted. You can withdraw your consent at any time in the same place.
• Non-personalized ads: Every ad request is made as non-personalized. On iOS no tracking permission (App Tracking Transparency) is requested; therefore the iOS advertising identifier (IDFA) is not available to the App or the ad software.
• Data processed: Device identifiers (Android advertising ID, app set ID and, where applicable, other identifiers related to accounts signed in on the device; on iOS, app- or developer-scoped identifiers), IP address (to estimate approximate location), interactions such as app launches, ad views and taps, and performance and diagnostic data.
• Purpose: Serving ads, frequency capping, ad measurement, fraud prevention and the operation of Google's consent infrastructure. Google may use its own advertising partners to serve ads.
• EEA, United Kingdom and Switzerland: If Google determines, under the rules it applies for these regions, that its consent form is required for you, then in addition to this consent Google's consent form is shown and your choice is recorded before any ad is requested. If you do not consent there, Google may serve "limited ads" that do not use personal data for advertising; even then your IP address may be used to deliver the ad, and local storage on the device only to detect invalid traffic. Where Google considers it necessary, the App's Settings offer a way to change your choice in Google's consent form.
• Google's role: For advertising, Google also processes the data for its own purposes as an independent controller and may associate it with device identifiers. Google Ireland Limited is responsible for users in the EEA and Switzerland, and Google LLC elsewhere, including the United Kingdom. This processing is governed by Google's privacy policy: https://policies.google.com/privacy — How Google uses this data: https://policies.google.com/technologies/partner-sites
• Content: Ads are limited to content suitable for general audiences. You can report an inappropriate ad through the information icon on the ad or by writing to support@moldbench.com.
• No ads are shown in the Pro version or in the Mac version.

4.2 Crash reports and session records — Google Firebase Crashlytics (Google LLC)#

• When: Only after the agreement screen has been accepted, and only in release builds (including store versions, TestFlight/closed testing and test builds we distribute directly). If your device's language/region preference is the EEA, the United Kingdom or Switzerland, they are sent only if you tick the optional box at first launch (off by default); for other users they are on by default. This distinction is based not on your location but on the country code in your device's language preference (for example "Deutsch (Deutschland)" → Germany); if the country code cannot be determined, the European rule applies. Everyone can change this under Settings > "Send crash reports"; when you turn it off, session records are no longer sent either and unsent reports are deleted. Without permission, none of the data in this section is sent.
• Session records: While this feature is on, at the start of each session (when the App is opened, or when it returns to the foreground after a long time in the background), the following is sent even if nothing crashes, to measure the crash-free session rate: session ID, first session ID, session index, session start time, app ID, operating system version, device manufacturer and model, network connection type (e.g. Wi-Fi/mobile) and Firebase installation ID.
• Crash reports: When the App crashes or an uncaught error occurs: the stack trace and error message at the time of the error, the App's state at that moment, device information (such as manufacturer, model, CPU architecture, free memory and disk space, screen orientation, root/jailbreak status), operating system and App version, and Crashlytics/Firebase installation IDs. We do not intentionally add your calculation values or file contents to reports; however, an error message may contain part of the input that caused the error (for example a file name or a value that could not be read).
• Purpose: Finding and fixing errors; measuring the crash-free session rate.
• Google's role: For this service Google acts as our processor (Firebase Data Processing and Security Terms).

4.3 Purchases — Apple App Store / Google Play and RevenueCat, Inc.#

• Payment: The price of Pro is collected by the respective store (Apple or Google). We do not see your card or payment details; the store processes them under its own privacy policy, as its own controller.
• RevenueCat: The App connects to RevenueCat only after you have accepted the agreement screen. RevenueCat processes store transaction records (purchase history), a pseudonymous user ID randomly generated by RevenueCat that does not contain your name or e-mail address (the Support ID; Settings > "Support ID"), device and operating system information, and IP address. RevenueCat acts as our processor.
• Purpose: Verifying and restoring the Pro entitlement and keeping sales records.
• Store reports: The stores provide us with information such as order number, date, product, amount and country in their sales and financial reports.

4.4 When you write to us (support and data requests)#

• The App does not offer you an e-mail form; you write to us with your own e-mail app. In that case we process your e-mail address, your name if you provide it, the content of the correspondence and, if you share them, your Support ID or order number.
• Purpose: Answering your request, proving that we did where necessary, and handling data protection requests as required by law.
• Incoming e-mails reach our mailbox provider through an e-mail routing service (Cloudflare, Inc.). These providers act as our processors.

4.5 Test programs (Google Play closed testing, Apple TestFlight)#

• If you join a test program, we process the Google or Apple account e-mail address you shared so we can invite you, and the feedback, screenshots, crash and device information that the test platform passes to us.
• Purpose: Running the test and fixing errors.
• Test lists are kept in Google Play Console and App Store Connect; your e-mail address is removed from test lists no later than 6 months after the test ends.

4.6 Store reviews#

Reviews you post in a store are visible to us as the store displays them (for example your display name in the store and your review). We use them to read and reply and to improve the App; the rules of the respective store also apply to this processing.

5. The Site (moldbench.com)#

• The Site sets no cookies of its own. There is no visitor tracking, no analytics software, no advertising tag and no social media pixel. Fonts are served from the Site itself, so your browser does not send requests to another company while you read it.
• There is no contact form; the contact link only opens your own e-mail app.
• Hosting: The Site is hosted on Cloudflare, Inc. (Cloudflare Pages). To provide the service and prevent abuse, Cloudflare may keep technical logs such as IP address, browser information, request time and requested page. When it shows a verification page to traffic suspected to be malicious, it may set a cookie that is strictly necessary and used for security only. We do not use these logs for marketing; Cloudflare keeps them as our processor for a limited period under its own retention policies.
• Other domains of ours that redirect to the Site (for example moldbench.app) use the same infrastructure.
• When you follow links from the Site to the App Store or Google Play, the privacy policies of those sites apply.

6. Legal bases and how data is collected#

Personal data is collected by automated means through the SDKs listed in Section 4 while you use the App, by e-mail when you write to us, through the relevant platform in test programs and store reviews, and through the hosting infrastructure on the Site.

• Our legitimate interests: Keeping the App and the Site stable and secure, fixing errors, preventing abuse and answering user feedback. You may object to processing based on legitimate interest; for crash reports, the quickest way is to turn them off in Settings.
• Withdrawing consent: You can withdraw ad consent and (if your device's language/region preference is the EEA, the UK or Switzerland) crash-report consent at any time in Settings. Withdrawal does not affect the lawfulness of processing before it.
• Whether you must provide data: Store transaction data is a contractual requirement for activating and restoring Pro; without it Pro cannot be activated. Providing any other data is not mandatory; refusing ad or crash-report consent does not restrict any feature.
• Data obtained from third parties: Sales reports (Apple, Google), test platform feedback and store reviews reach us through the respective platform.

7. Recipients and international transfers#

• Transfers from the EEA and the UK: The providers rely on adequacy decisions (including the EU-U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
• You may request a copy of these safeguards through the channels in Section 9.
• Third parties with whom data is shared (Google AdMob, Google Firebase Crashlytics, RevenueCat, Cloudflare and the respective stores) provide, under their own agreements and policies, the same or equal protection of user data as stated in this policy and required by the App Store Review Guidelines.

8. Retention periods#

Data whose retention period has expired is deleted, destroyed or anonymized.

9. Your rights and how to exercise them#

Under Article 11 of the KVKK (Turkey) you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether data is used accordingly, to know the third parties to whom it is transferred in Turkey or abroad, to request rectification of incomplete or inaccurate data, to request erasure or destruction under KVKK Art. 7, to request that rectification, erasure and destruction be notified to third parties to whom the data was transferred, to object to an outcome against you resulting exclusively from automated analysis, and to claim compensation for damage caused by unlawful processing.

Under the GDPR and the UK GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw your consent at any time. You may lodge a complaint with the data protection supervisory authority of your country.

In California and other US states with similar laws you have the right to know about and access the personal information collected about you and to request its deletion and correction, and you will not be discriminated against for exercising these rights. We do not sell your personal information, do not share it for cross-context behavioral advertising and do not collect sensitive personal information. For users in the United States, ad requests are made in Google's "restricted data processing" mode, under which Google acts as our service provider. To appeal our response to your request, you may write to the same address.

How to submit a request:

• E-mail: support@moldbench.com with the subject "Personal Data Request".
• Users in Turkey may also use the other methods listed in Article 5 of the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller (for example an application signed with a secure electronic or mobile signature).

How we match your identity: Because there is no account system, data held by service providers is not matched to your identity. To handle your request we may need the ID shown under Settings > "Support ID" or your store order number. We do not ask for more information than we need to handle the request.

Response time: Requests under the KVKK are answered free of charge within 30 days at the latest (KVKK Art. 13); if handling a request involves an additional cost, a fee under the tariff set by the Turkish Personal Data Protection Board may be charged. Requests under the GDPR are answered within one month; this may be extended by two further months where necessary, taking into account the complexity of the request, in which case we will tell you (GDPR Art. 12(3)).

Complaint in Turkey: If your request under the KVKK is rejected, you find the answer insufficient or it is not answered in time, you may file a complaint with the Turkish Personal Data Protection Board within 30 days of learning of the answer and in any event within 60 days of your request (KVKK Art. 14).

What happens when you ask for deletion:

• Data on your device: We do not hold it; you remove it from within the App or by deleting the App.
• RevenueCat record: We delete it using your Support ID. If you keep using the App, a new pseudonymous record is created so that your Pro entitlement can be verified.
• Crash reports and session records: Because they are not matched to your identity, individual records may not be identifiable; crash reports are deleted automatically within 90 days. You can stop sending them in Settings.
• Advertising data: Google processes this data as an independent controller; you can use Google's tools and, on Android, reset or delete your advertising ID. If you send your request to us, we will help you reach Google.
• Correspondence: We delete it unless a statutory retention obligation or the protection of a legal claim requires otherwise.
• Sales records: They cannot be deleted before the statutory retention period ends.

10. Managing your choices#

• Ad consent: Settings > "Ad consent"
• Google consent choice: If Google's consent form applies to you, a way to change your choice is offered in Settings where Google considers it necessary.
• Crash reports and session records: Settings > "Send crash reports"
• Android advertising ID: Can be reset or deleted under Privacy > Ads in Android settings (the name of this section may vary by device).
• Support ID: Settings > "Support ID"
• All data on the device: By deleting the App.

11. Children's privacy#

The App is designed for professional users; it is not directed at children or at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, write to support@moldbench.com and we will delete it.

12. Data security#

• Data sent to service providers is encrypted in transit with TLS.
• Data on your device is stored in the protected area the operating system assigns to each app.
• We keep no user database containing your identity and process only the minimum data needed. Purchase records are kept at RevenueCat under a pseudonymous ID that does not contain your name or e-mail address.
• Only authorized people can access the service providers' administration panels (Firebase, AdMob, RevenueCat, store consoles, Cloudflare, e-mail), and access is protected with two-step verification.
• If personal data is obtained by others through unlawful means, we notify the Turkish Personal Data Protection Board and the affected persons as soon as possible (KVKK Art. 12(5); 72 hours in the Board's practice). For users in the EEA and the UK we apply the notification rules of GDPR Articles 33 and 34.

13. Automated decision-making and profiling#

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you, and we do not carry out profiling (GDPR Art. 22; KVKK Art. 11(1)(g)).

14. Cookies and similar technologies#

• App: The App itself does not use web cookies. In the free version, and only if you have given ad consent, third parties including Google may place and read cookies or similar technologies such as local storage on your device, and may use web beacons, device identifiers and your IP address, as a result of serving ads. The purposes are described in 4.1.
• Site: We set no cookies. Our hosting provider Cloudflare may set a cookie only for security purposes and only when strictly necessary (see Section 5).

15. Changes#

We may change this policy. In case of a material change, the updated text will be shown to you again when the App opens and you will be asked to confirm that you have read it before continuing. The date at the top shows the last update. We will send previous versions on request.

16. Contact#

• Kadir Tolaz
• E-mail: support@moldbench.com
• Website: https://moldbench.com

Turkish version: https://moldbench.com/tr/gizlilik