Privacy Policy

Last updated: September 29, 2026

This policy describes Bento for iOS and iPadOS and the optional Bento Sync service. Bento has no advertising or analytics trackers and does not sell your data. Contact: support@bentoapp.net.

1. Browsing and local storage

You choose the third-party servers to connect. Normal browsing requests go directly from your device to those servers, which receive your IP address, requests and any credentials needed for the operation. Their own terms and privacy policies apply.

Settings, server logins, history, saves, downloads and image caches are stored on your device. When you use Bento Sync, the data described below is also processed on Bento's server. Downloaded media stays on your device. You can clear the image cache in Data & Info and manage downloads separately.

2. Optional Bento Sync

• Account and profile: email address, handle, display name, bio and avatar; authentication data used to secure your account.
• Library and preferences: saved-post metadata, collections, saved-pool metadata and seen state, followed tags, blacklists, recent viewing history, app settings and feed configuration.
• Server accounts: server addresses, usernames, API keys or passwords and, where available, temporary Cloudflare clearance cookies. Sensitive credentials are encrypted at rest. They are not part of your public profile.
• Social features: friendships, blocks, profile visibility preferences, encrypted messages and shared collections, and the metadata needed to deliver them, such as participants and timestamps.
• Notifications and background updates: notification tokens where registered, update events, and temporary matching-post metadata used to refresh followed tags. If you enable background updates, Bento's server uses your saved logins to check your sources. Shared timeline caches contain post IDs and time boundaries.

Your email supports account verification, password reset and account-related communication. Core account and sync processing provides the service you request (Article 6(1)(b) GDPR). Security and abuse prevention serve the legitimate interests of protecting users and operating the service (Article 6(1)(f)). Where processing is required by law, Article 6(1)(c) applies.

3. Visibility and encryption

Your profile card (handle, display name, bio and avatar) can be visible to other users. Profile settings control the audience for your library and whether saves, follows, history, blacklists or your list of booru sites are shown. Login credentials remain private to your account. Review these settings before sharing.

Direct-message content and shared-collection content are end-to-end encrypted. The server stores encrypted content and delivery metadata; it does not hold the keys needed to read that content. Ordinary synced library data is not all end-to-end encrypted. Synced booru credentials are encrypted at rest and can be used by server features you enable.

If someone reports a message or shared item, the selected content and relevant evidence may be disclosed to moderation. Reports may include user identifiers, the reason, text, relevant conversation context and an evidence attachment. This is separate from routine encrypted delivery.

4. Optional image tag suggestions

When you request image-based tag suggestions, Bento sends a preview to its server for processing by the tag suggestion service. The service does not save the preview. Uploads you publish to an image board are handled under that board's rules.

5. Support and bug reports

“Report a Bug” prepares an email with your device model identifier, operating-system version and build, app version and build, language, region and time zone. You can add a message and an optional image. Image attachments are resized and re-encoded without the original file's location or EXIF metadata. Visible information in the image remains visible.

You can inspect the report before confirming in your email app. Bento does not automatically add passwords, API keys, account identifiers, history or logs, and does not capture screenshots automatically. Your email provider and our support mailbox process your email address, message, diagnostics and attachments so we can respond and troubleshoot. Support correspondence is separate from your Bento Sync account; deleting that account does not delete emails already sent. Contact support to request deletion of correspondence.

6. Service providers and third parties

Bento uses server hosting and backup infrastructure to operate Bento Sync. Requests to the website and service expose technical connection data, including an IP address, to the infrastructure handling them; this is needed to deliver responses and protect the service. Email providers handle support and account emails; Apple handles push delivery when available. Providers receive the information required for those functions. Third-party boorus receive requests made to their services, including server-side requests for enabled background features. Data is not shared for advertising.

7. Retention and deletion

You can delete your Bento Sync account in Settings → your profile → Delete Account. Signing out or uninstalling the app does not delete it. Account deletion removes account-linked service data according to its relationships; it cannot recall messages, screenshots, exports or copies already received by other people. Support correspondence and moderation records can be separate from account data. Their retention depends on the time needed to handle the request, investigate abuse and meet applicable legal obligations; they are not kept for advertising. We do not promise that every such record disappears immediately with account deletion.

Server backups rotate on a seven-day schedule and may retain recently deleted data until rotation. Local downloads and copies on other devices must be removed separately. Contact support for access or deletion requests, including when you cannot sign in.

8. Your rights

Subject to applicable law, you can request access, correction, deletion, restriction and portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. You can complain to a data protection supervisory authority, including one where you live or work. Send requests to support@bentoapp.net; we may need to verify account ownership.

9. Security, age and updates

Connections to Bento Sync use TLS. Bento is for adults aged at least 18 or the age of majority in their jurisdiction. We update this page when data practices change. Keep your app current and protect your account and encryption recovery phrase.