---
title: "Privacy Policy"
description: "What tenon.tools collects: server logs, Google Analytics under Consent Mode, and waitlist emails. No ads, no third-party trackers, no data sold."
canonical_url: "https://tenon.tools/privacy/"
language: "en"
last_updated: "2026-08-23"
source: "Tenon Tools"
---

# Privacy Policy

_Last updated: 2026-08-23_

> **Everything this notice says about what the site does is accurate as of the date above. What is still outstanding is the operator's own identity and contact details — the entries below that read "to be published". Nothing else on this page is waiting on a decision.**

> This site collects three things. Its web server writes an access log entry for every request, including your IP address. Google Analytics 4 runs under Consent Mode and records which pages and calculators get used — you can refuse it in one click and everything still works. And if you type your email into a waitlist form, that address is stored so we can write to you when an app ships. There are no ads, no advertising networks, no social widgets, no external fonts and no CDN: googletagmanager.com is the only third-party host this site contacts, and nothing you type into a calculator ever leaves your browser.

Tenon Tools is a small independent software project, not a company with a data department, and this page is written to be read rather than to satisfy a checklist. Where something is uncertain it says so, and where a field has not been filled in yet it is marked, rather than filled with something plausible.

This notice covers the website tenon.tools and its subdomains. The three mobile apps — Tenon Calc, Tenon Cam and Tenon Log — are separate products and each carries its own privacy statement, because what an app does with data is not what a website does with it. The last section says which statement to read and what the apps have in common.

## Who is responsible for this site

The controller for the processing described here, in the sense of Article 4(7) GDPR, is:

A data protection officer has not been appointed. Article 37 GDPR requires one only in specific cases, and this project does not appear to fall into them — but that assessment is marked below because it has not been confirmed.

- Name: to be published
- Legal form (sole trader, company, other): to be published
- Postal address: to be published
- Country of establishment: to be published
- Email for privacy requests: to be published
- Data protection officer: none appointed. Article 37 GDPR requires one only for public authorities, for large-scale regular and systematic monitoring, or for large-scale processing of special-category data. None of the three applies to this project.
- EU representative under Art. 27 GDPR: depends on the country of establishment above, and is published with it

## Opening a page: the server log

The site is a set of static HTML files. Delivering one to your browser means the web server writes a line to its access log, and that line contains your IP address. This happens before any consent question can be asked, because it is how the connection works at all.

The purpose is threefold: serving the page, spotting abuse and attacks, and counting how often AI crawlers such as GPTBot, ClaudeBot and PerplexityBot fetch our pages — a number this project publishes and reviews rather than guesses at. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in operating a functioning and secure website.

Log lines are not joined to anything else, are not used to build a profile, and are not shared. They live on the same rented virtual server the site is served from.

- What is recorded: IP address, date and time, the requested URL, the HTTP status and response size, the referring page if your browser sent one, and the browser/crawler user-agent string
- How long it is kept: 14 days. The server rotates the access log daily and keeps fourteen compressed generations, after which the oldest is deleted.
- Hosting provider (a processor under Art. 28 GDPR): Hetzner Online GmbH, Gunzenhausen, Germany. The server this site runs on is in Hetzner's Nuremberg data centre, so the log never leaves the EU.
- Data processing agreement with that provider: Hetzner publishes a data processing agreement under Article 28 GDPR as part of its standard terms.

## Google Analytics 4, and how to switch it off

This site uses Google Analytics 4, measurement ID G-8NJKYHSWRR, to see which pages and which calculators people actually use. It is the only analytics tool here, and googletagmanager.com is the only external host any page on this site loads anything from.

Be clear about the default, because it matters. Analytics runs under Google Consent Mode v2. Before you make a choice, the advertising signals are set to denied and the analytics signal is set to granted — which means that on a first visit, analytics is on until you refuse it. Refusing takes one click in the banner, the choice is remembered, and no part of the site stops working. The footer link "Cookie settings" reopens the banner on any page so you can change your mind later.

Analytics is not loaded at all when the site is opened on localhost or a private network address, or when the key tenon_analytics_off is set to 1 in your browser's local storage. In those cases the Google script is never even requested.

Google acts as our processor for this and processes the data on its own infrastructure, which involves a transfer outside the EU. Google states that GA4 does not log or store IP addresses, and derives only coarse location from them. Data collected through this property is retained for 14 months and then deleted automatically.

- Automatically collected: page views, and — because enhanced measurement is enabled on the property — scrolls, outbound link clicks, site searches, file downloads and video engagement
- calculator_use: fired the first time you interact with a calculator on a page, recording which calculator and the page's language
- waitlist_signup: fired when a waitlist form is submitted, recording the page path and the page's language — never the email address
- app_store_click and download_cta_click: defined in the code but not triggered anywhere on the site today, because no store badges exist yet
- Legal basis: your consent, Article 6(1)(a) GDPR. Analytics storage stays denied until you grant it, and refusing costs you nothing on this site.
- Google contracting entity: Google Ireland Limited, which is the party the Google Analytics terms are entered into with.
- Transfer mechanism: Google LLC is certified under the EU-US Data Privacy Framework, and Google relies on the European Commission Standard Contractual Clauses for transfers an adequacy decision does not cover.

## A note on the consent default

The paragraph above is the one place where this notice describes behaviour that may need to change rather than merely be documented. In Germany, § 25 TDDDG requires prior consent before information is stored on or read from a visitor's device unless it is strictly necessary, and analytics cookies are generally not treated as strictly necessary.

So the site defaults analytics storage to denied and waits. Until you choose, no analytics cookie is set and no identifier is stored on your device. What still happens before you answer is that the Google tag itself is fetched and may send a cookieless ping, which carries no identifier but does expose your IP address to Google in the same way loading any third-party file does. That is stated here rather than dressed up, and it is the reason the legal basis above is consent rather than legitimate interest.

## Cookies and local storage

No cookie is set for the site's own sake — the pages are static and there is nothing to remember about you. The entries below are the complete list of what may end up in your browser.

The two tenon_ entries are read only by code running on this site and are never transmitted anywhere. Clearing site data in your browser removes all of them, which also resets your consent choice to undecided.

- _ga and _ga_<property> — cookies set by Google Analytics to recognise a returning browser. Set only while analytics is permitted.
- tenon_cookie_consent — local storage. Your answer to the consent banner, so it is not asked again and the correct signal is sent before any analytics call.
- tenon_analytics_off — local storage. A developer switch; when set to 1 no analytics is loaded at all. It is never set automatically.

## The waitlist form

Some pages offer to tell you when an app ships. Submitting that form sends your email address and the identifier of the list you chose to lists.tenon.tools, which runs Listmonk — self-hosted mailing-list software on the same server as this site. There is no third-party newsletter platform involved.

Subscription is double opt-in: your address is stored as unconfirmed and you receive one email asking you to confirm. If you do not confirm, nothing further is ever sent. Confirmation and later announcements are delivered through Migadu, an email hosting provider acting as a processor. Every email carries an unsubscribe link, and unsubscribing takes effect immediately.

The legal basis is your consent under Article 6(1)(a) GDPR, which you may withdraw at any time with the unsubscribe link or by email. The address is kept until you unsubscribe, and is used for nothing except the announcements the form promised. It is never sold, rented, shared for anyone else's marketing, or passed to Google.

The form also contains a hidden field that a human never sees. Only automated submitters fill it in, and submissions that do are discarded.

- What is stored: the email address, which list you joined, whether you confirmed, and the timestamps of those events
- Whether the submitting IP address is also stored: no. This installation has opt-in IP recording switched off, and individual subscriber tracking switched off with it.
- The mail is sent through Migadu-Mail GmbH, Rohnen 587, CH-9414 Schachen, Switzerland. Switzerland is covered by a European Commission adequacy decision, and Migadu's privacy policy is also its data processing agreement.

## What the calculators do with your numbers

Nothing. The concrete, rafter and stair calculators are small pieces of code that run inside your browser tab. There is no server call, no API, no logging of inputs and no storage of them — the source contains no network request of any kind outside the analytics script described above. Closing the tab is all it takes to erase what you typed.

The only thing analytics learns is that a calculator on a given page was used at all, and only while analytics is permitted. It does not learn your dimensions, your results or anything else you entered.

## What this site does not do

Rather than leave this to inference, here is the list in full. Each line is a property of the site as it is built today, checkable in the page source.

- No advertising, no advertising networks, and no ad-measurement tags
- No third-party fonts — every page uses the fonts already on your device, so no font server sees your request
- No content delivery network in front of the site, and no third-party embeds, social buttons or comment widgets
- No session recording, heatmaps, A/B testing tools or chat widgets
- No profiling and no automated decision-making in the sense of Art. 22 GDPR
- No sale of personal data, and no sharing of it for anyone else's marketing
- No user accounts, because the site has nothing to log in to

## Your rights

Under the GDPR you can ask for access to the personal data held about you, for it to be corrected or deleted, for its processing to be restricted, for a portable copy, and you can object to processing based on legitimate interest. Where processing rests on consent — analytics and the waitlist — you can withdraw it at any time, and doing so does not affect what happened before.

In practice most of it is immediate and needs no request at all: refusing analytics in the banner stops it, the unsubscribe link removes your address, and clearing your browser's site data removes everything stored on your device. For anything else, write to the address in the first section.

You also have the right to complain to a data protection supervisory authority, under Article 77 GDPR — normally the one where you live or work.

- Email for data protection requests: to be published
- Competent supervisory authority: follows from the country of establishment above, and is published with it

## Children

This site is aimed at people doing paid construction work. It is not directed at children, and nothing here is designed to attract them or to collect their data knowingly.

## The mobile apps

This page covers the website. Tenon Calc, Tenon Cam and Tenon Log are separate products, and each has its own privacy statement describing what that app actually does — which is not what this site does. Tenon Calc''s, Tenon Cam''s and Tenon Log''s are all linked at the foot of this page.

What the three have in common is worth stating here, because it is the reason they exist in this shape: they work offline, they require no account and no login, and photos, projects, calculations, diary entries and quotes stay on the device unless you choose to share or export them yourself.

Two things in that picture are not absolutes, and are named here rather than discovered later. Tenon Cam turns a GPS fix into a street address by asking the operating system, which may ask its own map service; and it checks the device clock against a network time source when a connection exists, so the stamp can record which clock it trusted. Neither sends a photo. Tenon Calc includes the Sentry crash-reporting SDK, which sends a report when the app crashes.

- Store purchases are handled by the App Store and Google Play; Tenon Tools never receives or sees a card number
- Purchases are unlocked through RevenueCat, which is integrated in all three apps. It receives the store receipt and an anonymous identifier the app generates for itself — no name, no email, no account — and answers whether a purchase is active. The apps never call it with a user id, because there are no user accounts to call it with.
- Tenon Calc reports crashes through Sentry: stack trace, device model, operating-system version, app version, the breadcrumbs leading up to the crash, and a per-installation identifier. Personal information is switched off at the SDK level, and performance tracing is off in release builds. Tenon Cam and Tenon Log contain no crash reporter at all.
- Per-app privacy statements: all three are published — the links are at the foot of this page

## Changes to this notice

When what the site does changes, this page changes with it, and the date at the top moves. There is no archive of previous versions yet; if one becomes worth keeping, it will be linked from here.

---

_This notice was drafted by the project's build process to describe the site's actual behaviour, which it does accurately as of the date above. It is not legal advice, and it has not been reviewed by a lawyer. The entries that read "to be published" are the operator's identity and contact details, which are not yet published._

Page: https://tenon.tools/privacy/ — this file is its markdown mirror. All mirrors: https://tenon.tools/llms.txt