Privacy

Who is responsible

Tony Tang, Paris, France, runs tonytang.dev, the Ask Tony chat and the MCP server at mcp.tonytang.dev. For anything about your data, write to [email protected].

The website

The site uses no analytics and no advertising. It is hosted on Vercel behind Cloudflare, and those providers process technical data such as IP addresses to deliver pages and protect them from abuse.

Video pages embed YouTube's privacy-enhanced player, so Google receives data when a video loads.

The Ask Tony chat

• Your questions and the answers are kept for 30 days, without your IP address, to improve the answers, along with any rating or comment you leave. Please don't include personal details in them.
• They are sent to AI providers through OpenRouter to generate the answer, and to TypeSafe to label them: the topic, whether you want to reach me, whether it's abuse, and whether the answer came from the site.
• Your IP address is used for rate limits and to protect your session, and isn't stored with your questions. Rate-limit records expire within 2 days. Cloudflare's operational logs can include request details such as your IP address for up to 7 days.
• Usage metrics such as counts, timings and costs are kept for three months. They contain no question text and no IP address.
• Cloudflare Turnstile checks that you're not a bot before a chat starts.

The MCP server

• Your AI assistant's provider handles your conversation under its own privacy policy. This server only sees the requests your assistant sends it.
• Those requests are used to answer and are not kept. That includes search terms.
• For each tool call and connection, one event is recorded: the tool used and the kind of client application, from a fixed list. It has no search terms, no IP address and no identifier for you, and is kept for three months.
• Your IP address is used for an immediate rate-limit check on Cloudflare. It isn't logged by the server.
• When your assistant opens a course lesson, the server reads that public file itself. Nothing about you goes with that request.
• The profile card some assistants display is self-contained. It requests nothing from my sites or anyone else's unless you open one of its links.

Transfers outside the EU

Vercel, Cloudflare, OpenRouter, Google, TypeSafe and the AI providers may process data outside the European Union, including in the United States, under their own terms and safeguards.

Legal basis and your rights

This processing relies on legitimate interest: running these services securely and improving them. You can ask for access to your data, correction, deletion or restriction, and you can object, by writing to the address above. Because chat questions are stored without identifiers, finding yours may need you to quote it. You can also complain to the CNIL, the French data protection authority.