Privacy Policy

This policy covers tinycto.com and the tinycto MCP server, anywhere you read the curriculum, create an account, or connect a client like Claude Desktop or Claude Code. I'm JP LeBlanc, I built this thing and I run it.

Doesn't cover the sites we link out to (LinkedIn, GitHub, X, whatever). Once you click away, their privacy policy takes over, not this one.

Reading the curriculum costs you nothing, information-wise: no account, no cookie banner, no tracking pixel with your name on it. Make an account, though, and we collect what you hand us: name, email, and either a hashed password or whatever Google or GitHub sends back when you sign in that way (name, email, avatar). We never see your Google or GitHub password. Can't, by design. Write in through the residency form and we keep what you typed (name, email, company, and your answers) so JP can reply. It isn't added to a mailing list, and it's deleted on request like everything else.

Answer the survey and we keep only the option you picked for each question, with the time it arrived. No name, no email, no IP address. Answers are published only as percentages across everyone who responded.

Connect an MCP client and we log which tools you call, list_themes, get_lesson, and so on, so the thing keeps working and I can actually see what gets used.

Vercel Analytics gives us the aggregate numbers: page views, rough traffic levels. No cookies, no profile built on you across other sites.

If you use the AI-native guide, we keep what you tell it about your company: headcount, which functions you run, who owns each one, your deadline and who set it, the constraints you state, the rulings you get back, your check-in notes, and the titles and review dates of your intent documents. We store the details of your documents only if you type them in. This is sensitive, and we treat it that way.

It is tied to your account, and no page or tool shows it to anyone else. The admin dashboard does not show it. We keep its contents out of our logs.

To answer a constraint that isn't in our own list, the guide sends what you typed, plus the parts of your profile the answer needs, to an AI model through Vercel's AI Gateway. Don't type anything you can't share with a processor like that.

Connecting an AI tool to your guide profile is a separate permission. It only happens if you approve it on the consent screen.

You can download all of it as a file, or delete all of it, from your dashboard at any time. Deleting your guide data leaves your account alone. Deleting your account deletes the guide data with it.

Running the site and the MCP server. Authenticating you. Keeping your account intact between visits. Figuring out which lessons and tools people actually use, so the curriculum gets better instead of me guessing.

Reaching you about your own account: a password reset, a security notice, a real change to these terms. Not a newsletter you never asked for.

A session cookie keeps you signed in, if you've got an account, functional, not tracking, it doesn't follow you anywhere else. Light or dark mode gets saved in your browser's local storage and never touches our servers.

No ad cookies. No retargeting pixel. Nothing following you around after you leave.

Keeping tinycto running means some infrastructure necessarily touches your data: Vercel for hosting and analytics, our database provider, Google or GitHub if that's how you signed in. Each one's a processor working under our instructions, not a free agent with your data.

We don't sell it. We don't hand it to advertisers. Nobody outside that list sees it, unless the law makes us.

Account data sticks around as long as your account does. Delete the account, we delete the data tied to it, short of whatever we're legally on the hook to keep. Want it gone faster? Email hello@tinycto.com, no retention team, no ticket queue, just me reading the email and doing it.

Doesn't matter where you're writing from: ask to see what we hold on you, correct it, export it, delete it. If you're in the EU, UK, or California, that maps onto rights you already have under GDPR or the CCPA, we just don't make the answer depend on your zip code. Send requests to hello@tinycto.com, you'll get a real reply, not a form-letter.

tinycto's written for people already running engineering teams. Not aimed at kids, and we don't knowingly collect data from anyone under 16.

Passwords get hashed, never stored as plain text. Everything runs over HTTPS. Production access is limited to what's actually needed to keep the lights on. Nothing's unbreachable, and if something goes wrong with your data, you'll hear about it plainly and fast, not buried in a footnote three months later.

If this policy changes in a way that actually matters, the date at the top moves and account holders get told directly. Not a quiet edit you'd only catch by diffing the page.

Questions, requests, something that feels off: hello@tinycto.com. Goes straight to me.