tenon.alanlong.design
Privacy notice
Last updated 24 August 2026. Applies to the Tenon MCP server at https://tenon.alanlong.design/mcp and to this website.
The short version
Tenon has no accounts and keeps no database of users. When your AI assistant sends a request to Tenon, the request is processed in memory, answered, and discarded. Nothing your assistant sends is stored, and Tenon calls no other service, including no AI model. Tenon's own record of a request is one operational log line: which tool was called, how the call went, and some sizes and timings, with no content, no names and no IP address. Raw lines are kept for three days; daily totals are kept as counts. The one place something you type is kept is the feedback form, and only if you use it. Cloudflare, which hosts Tenon, keeps its own short-lived security records about connections, as any hosting provider does; the section on hosting says what those are.
Who is responsible
Alan Long, an individual based in the United Kingdom, is the controller for the processing described on this page. Contact: hello@alanlong.design. Cloudflare, Inc. processes data on Alan's behalf as the hosting provider (see "Hosting").
What Tenon does with what your assistant sends
Tenon is a set of tools an AI assistant (Claude, ChatGPT, or another MCP host you choose) can call. Depending on the tool, a request may contain:
- the text of a job advert and a description of the role that your assistant wrote from it;
- statements about your work and preferences (for example "eight years designing banking apps", or "remote within the UK"), and your assistant's assessment of how they match a role;
- which countries you are authorised to work in.
Some of that is personal data about you, or about a person you are helping (if you are running a check for someone else, the personal data comes from you, and you should have their agreement to use it). Tenon uses it for one purpose: to check the assistant's reading against a fixed contract and to compute a score, then return the result to your assistant. It is held in the server's memory for the life of that single request, normally well under a second, and is not written anywhere.
The response repeats parts of what was sent, so that your assistant can show you what was accepted and what was rejected and why. It goes back only to the assistant that made the request.
What is kept
| Kept by Tenon | What it contains | For how long |
|---|---|---|
| One log line per request to the server | The HTTP method, the route (one of a fixed list, or "other"), the status code, the request and response sizes in bytes, and a timing figure. For tool calls, a few more fields about how the call went, listed in full under "Usage counts" below. Never the content of a request, never a header, never an IP address. If the server hits an internal error, the line records only a category such as "internal", never the message. | 3 days, then deleted automatically |
| The same log events in Cloudflare Analytics Engine | The tool-call fields, written there as well when that store is switched on: the tool name, how the call ended, which rules rejected something, the attempt number, how many roles were in the call, the score to a tenth, whether the optional labels were supplied (never the labels themselves), the coarse size buckets listed under "Usage counts", the size and timing figures, and the version number of the Tenon software that answered. Not the method, route or status. A call that turns telemetry off writes only a marker that one call opted out, and nothing else. Off by default; this page will say when it is on. | 3 months |
| Daily totals | Counts only, one document per day in Cloudflare key-value storage: how many calls per tool, how many ended each way (also broken down by attempt), how often each rule and each combination of rules rejected something, how the scores, role counts and coarse size buckets spread, typical response times overall and by request-size bucket, how many calls supplied the optional labels, how many calls each software version answered, and how many calls turned telemetry off. Nothing per request and nothing per person. | Kept indefinitely |
| What you type into the feedback form | Your answers to the form's questions: up to five ratings (three 1-to-5 scales and two multiple-choice), four fixed-choice questions (where you were using Tenon, whether the assessment finished, where a problem was if there was one, and whether you were invited to the beta or found Tenon yourself), an optional message, which assistant you were using if you choose to say (a fixed list, or a name you type if you pick Other, or prefer not to say), and the date. The server also stamps which version of the form was live: a number, nothing about you. An email address only if you choose to give one. Nothing else is recorded with it automatically. See "The feedback form" below. | Until reviewed and acted on, and in any case deleted within 12 months; an email address is deleted once Alan has replied |
| Email you send to the support address | Whatever you choose to write. Please leave CVs and other people's details out of it. | Kept in Alan's mailbox in the ordinary way |
| Nothing else | No accounts, sessions, cookies, identifiers across calls, analytics scripts on this site, or copies of requests. |
This is a tested property of the code, not a habit: an automated test sends requests containing marker text and fake personal details and fails if any of it appears in any log output, the usage fields included.
Usage counts
Tenon keeps a count of how it is used, so that problems show up without anyone having to report them, and so that it can be improved for you and for everyone else who uses it. The counts are built from the log line every request writes. Here is the whole of that line, field by field. There is nothing else in it.
| Field | What it holds |
|---|---|
event | The kind of record: a request, or an error. |
method | The HTTP method, such as GET, POST or DELETE. |
path | The route, as one of a fixed list of names, or the word "other" if it is not on the list. A path a caller invents can never carry text into the log. |
status | The HTTP status code. |
in_bytes | How big the request was. |
out_bytes | How big the response was. |
ms | How long Tenon took to answer. |
When the request is a tool call, these are added:
| Field | What it holds |
|---|---|
tool | Which of the three tools was called. |
result_status | How the call ended: complete, incomplete (needs another pass) or failed; for the gate tool, pass, fail, unconfirmed, or mixed when a batch disagreed; or error when the call was refused. |
rule_codes | The names of any rules that rejected something (for example observed_span, the rule that a quotation must really be in the advert), or, for the gate tool, which of its fixed gates failed (vacancy, location, title, salary). Never what was rejected. |
attempt | Whether this was a first or second attempt at a fit read. |
role_count | How many roles were in the call. |
score_decile | For a single-role fit call, the fit rank rounded to a tenth (so "between 0.7 and 0.8"), never the score itself. Left out for batches. |
labels_present | Yes or no: whether the assistant supplied the optional model and prompt labels. Never the labels themselves. |
advert_chars_bucket | Roughly how long the advert text was, as one of four wide ranges (up to 2,000 characters, up to 8,000, up to 24,000, more). The length only, never the text. |
requirement_count_bucket | Roughly how many requirements the description listed, as one of a few wide ranges (none, 1–2, 3–5, 6–10, 11–20, 21–40, more). A count, never the requirements. |
statement_count_bucket | Roughly how many profile statements a fit call carried, in the same wide ranges. A count, never a statement. |
want_count_bucket | Roughly how many wants a fit call carried, in the same wide ranges. A count, never a want. |
citation_len_bucket | Roughly how long the longest accepted citation quote was, as one of four wide ranges (up to 25 characters, up to 50, up to 100, more). The length only, never the quote. |
If the server hits an internal error, the line holds only event and, for an error inside the tool layer, a code that is a category such as "internal". An error anywhere else logs the event name alone. Never a message, never a stack trace.
What is never there. No advert, no CV, no statement about you, no preference, no text you or your assistant wrote. No name, no email address, no IP address. Nothing that links one call to another, or any call to a person.
Why. The counts answer questions such as: is the server up, which rules reject most often, do fit reads complete first time, are scores bunching in a way that suggests a bug. That is how Tenon gets better.
Lawful basis. Legitimate interest: Alan has an interest in keeping Tenon working and improving it, and the fields are too coarse, too short-lived and too disconnected from anything else to identify anyone or affect them. That judgement is written down in a legitimate interests assessment (the three-part test the Information Commissioner's Office describes: purpose, necessity, balance). You can ask for a copy at the address below.
For how long. Raw lines live in Cloudflare Workers Logs for three days. When the Analytics Engine store is switched on, the same events are kept there for three months, and a scheduled job inside Tenon reads that store once a day (it is Cloudflare's own service, not a third party) to write the daily totals, which are kept indefinitely, as counts only. Each event in that store also carries the version number of the Tenon software that answered, so a problem can be tied to a release; that is a fact about Tenon, not about you.
Your switch. Every tool accepts a telemetry setting. Ask your assistant to call Tenon with telemetry set to false (for example, "use Tenon with telemetry off") and the usage fields above are left out for that call. The line records only that telemetry was off, and the only thing written to the Analytics Engine store is a marker that one call opted out: no tool name, no outcome, no rules, no sizes, no timing. That marker exists so the daily totals can say honestly what share of calls the counts do not describe. The request line itself (method, route, status, sizes, timing) is still written, as it is for every request to any web server.
What the counts cannot see. A tool call whose arguments do not fit the tool's schema is refused by the protocol layer before the tool runs, so it produces no usage fields at all, only the ordinary request line with its status. The counts therefore understate schema failures; this is a known limit, recorded in Tenon's internal data map, not a hidden collection.
Plainly. Tenon is non-commercial. There are no adverts, nothing is sold, no profiles are built, and nothing is shared with anyone for marketing. The counts exist only to improve Tenon for you and others.
The feedback form
There is a form at tenon.alanlong.design/feedback for telling Alan that something went wrong, or was useful. If you use it:
- What is kept: what you put into the form: your answers to the five rating questions (three 1-to-5 ratings and two multiple-choice), your answers to four fixed-choice questions if you give them (where you were using Tenon (a fixed list, with "prefer not to say"), whether the assessment finished, where a problem was if there was one, and whether you were invited to the beta or found Tenon yourself), the optional "what went wrong" message, which assistant you were using if you choose to answer that question (picked from a list; if you pick Other, a name you type yourself), and the date you sent it. An email address is kept only if you choose to give one, so that Alan can reply. One thing is added by the server: a number saying which version of this form was live when you sent it, so answers to old and new questions are not mixed up. It says nothing about you.
- What is not kept: nothing else is recorded automatically. No IP address, no browser details, nothing about your conversation with your assistant beyond what you chose to write, no request identifier, and no log line is joined to it.
- Where: in Cloudflare's key-value storage, in Alan's account, processed by Cloudflare as Alan's hosting provider. Alan, in the United Kingdom, is the controller.
- For how long: until it has been read and acted on, and deleted within 12 months of being sent in any case. An email address is deleted once Alan has replied.
- To have it removed: write to hello@alanlong.design with roughly when you sent it and the first few words, and it is deleted. If you gave an email address, writing from that address is enough.
- Lawful basis: legitimate interest, covered by the same written assessment as the usage counts. You decide what to write; please leave out CVs and other people's details.
If you would rather open an issue on the public GitHub repository (github.com/ajalong/Tenon), what you write there is public and is kept by GitHub under GitHub's own terms.
Hosting
Tenon runs on Cloudflare Workers, so every request to Tenon, and every visit to this website, passes through Cloudflare's network. Cloudflare processes the connection details (your assistant's or your browser's IP address, request headers, the page or route requested, country) to deliver the request and to protect the site, under a data processing agreement with Alan and under Cloudflare's own privacy policy. Two things are worth spelling out:
- Cloudflare's optional per-request application log, which would have stored request headers for three days, is switched off for Tenon.
- Cloudflare's security and traffic analytics still exist for the site: they hold sampled connection records (including IP address, path, country and user agent) for a limited period (on the plan Tenon uses, security event samples for 24 hours and security analytics samples for seven days) and aggregate counts for longer. Alan can view them in Cloudflare's dashboard; they are not exported, joined to anything, or used for anything but keeping the site up.
Cloudflare's network is worldwide, so a request may be handled in a data centre outside the UK for the duration of that request, and the analytics above are held by Cloudflare wherever it operates. Transfers outside the UK are covered by Cloudflare's data processing addendum, which incorporates the UK International Data Transfer Addendum; a copy is available from Cloudflare.
What not to send
Tenon does not need, and does not ask for, information about health, ethnicity, religion, politics, sexuality, or trade union membership. Please leave anything of that kind out of what you give your assistant to send. The fields that take statements about you and your preferences say the same in their own descriptions, which your assistant reads.
Your rights
Under UK data protection law you have the right to be told what personal data is held about you and to get a copy; to have it corrected; to have it deleted; to restrict how it is used; to object to its use; and to data portability where it applies. In Tenon's own records, the only thing that can be retrieved, corrected or deleted is a feedback submission, if you made one. Otherwise there is nothing to act on: no copy of your request exists after it is answered, and neither the three-day log line nor the daily counts have any field that could be matched to a person. Cloudflare's short-lived security records are the one place a connection detail exists, and Alan can ask Cloudflare to act on a request that concerns them. To exercise any right, or if you think anything on this page is not true, write to hello@alanlong.design. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
Lawful basis
Tenon processes what your assistant sends because you have asked your assistant to use it. The lawful basis is legitimate interest: providing the service you chose to invoke, in a way that keeps nothing. The usage counts and the feedback form rest on legitimate interest too (keeping Tenon working, and hearing where it went wrong), assessed in writing as described above. You can object at the address above. The simplest objection to the service itself is to disconnect Tenon from your assistant, after which nothing further is processed; the simplest objection to the usage fields is the per-call telemetry switch.
Changes
If any of this changes, this page changes with it and the date at the top moves. Material changes will also be noted on the front page.