Privacy

What we collect

If you create an account, Evalness stores your email address, display name, handle, a one-way password hash, and an HttpOnly session token. We store entries, prompts, evaluation runs, API-key metadata, usage, and scores associated with your account. Raw API keys and passwords are not stored. Public browsing does not require an account and Evalness does not use advertising or analytics cookies.

If you fill in a profile, Evalness stores the bio and the GitHub, website, and X links you enter, and publishes them on your profile page along with your handle and your published entries. Links are the ones you choose to add; Evalness has no follower or connection graph. If you upload an avatar we do not keep the file you sent: the image is re-encoded to a small square WebP with its metadata removed, and only that result is stored. Removing an avatar or clearing a profile field deletes the stored value.

Endorsements and reports are stored with the account that made them. An entry’s endorsement count is public, but who endorsed is not. Reports are private moderation records: the reason, any detail you write, and your account are visible to Evalness only, are never shown on public pages, and the number of reports on an entry does not by itself remove or hide it.

We process an IP address or trusted proxy address for abuse prevention and rate limiting. The limiter stores a one-way hash rather than the raw address. Standard infrastructure logs may temporarily contain request metadata needed to operate and secure the service.

AI-provider processing

Prompts, test inputs, and model outputs used in an evaluation are sent to third-party AI providers. At launch this includes NVIDIA; other configured models may use providers such as OpenAI or Anthropic. A provider may receive the prompt both as the model being evaluated and as an automated judge. Their processing is governed by their own privacy terms. Do not submit secrets, personal data, or content you are not authorised to share.

Evalness does not use submissions to train its own models. Third-party providers control their own retention and model-improvement practices under the terms that apply when a run is made; those practices can differ by provider and account tier.

Publication and use

Entries stay out of public discovery while queued. After a successful evaluation, the entry, author identity, submitted prompt, model metadata, and measured results become public. Holdout cases and private operational records are not published. We use account, run, and request data to operate the registry, produce scores, enforce budgets and limits, investigate abuse, and maintain security and reliability. We do not sell personal data.

Retention and deletion

Account and submission records are retained while the service and public evaluation history remain active. Short-lived rate-limit buckets expire automatically. Immutable score history may be retained where deletion would damage the integrity of the public benchmark; account identifiers can be removed or anonymised where practical. Profile fields, avatars, and endorsements are deleted with the account that owns them. Reports are retained after the reporting account closes, because deleting them would erase the record of an abuse report.

To request access, correction, or deletion, email support@evalness.com from the address on your account. We may ask you to verify control of the account.

Security and changes

Evalness uses hashed credentials, restricted cookies, request limits, and access controls, but no online service can guarantee absolute security. Material changes to this notice will be published here with an updated date. Evalness is not directed to children under 13 and does not knowingly collect their personal information. Contact us if you believe a child has created an account.