Privacy Policy
Last updated 7 October 2026
The short version
Tenora holds your contacts and your notes about people. That is private, so here is the deal in one paragraph.
Tenora does not sell your data and does not show ads. It does not email the people in your network. Your rows are readable only by your account. You can delete any of it, or all of it, at any time.
The rest of this page is the detail behind that. It is worth two minutes because you are about to put real people in here.
Who runs this
Tenora is built and run by Dylan Gutowski, an individual in New York, not a company. It is free and in beta. If you want to reach a human about anything on this page, that human is hey@tenoraapp.com and it is the same person who wrote it.
What we collect
Your account
Signing in is Google only. We store your email address, and your name and profile picture from Google. That is what identifies your account and it is the whole of it. There are no passwords: Google does the sign-in and Tenora never sees one.
Gmail and Google Calendar, only if you connect them
Connecting either one is a separate, optional step inside the app, and nothing below happens unless you take it. You can disconnect at any time from the same place, Connectors in the account menu, and the access is revoked.
- The daily scan. Gmail: message headers only, which is who a message was from, who it was to, the date and the subject line. It never opens the body of an email, and no AI is involved. Calendar: the events on your calendar, their times and who was invited. People already on your orbit are matched by email address, so an email you exchanged or a meeting you held becomes a logged contact and your last-contact date moves forward without you typing it. It can also name people you write to who are not on your orbit yet and ask whether to add them. It never adds anyone on its own.
- The weekly pass. Once a week Tenora reads the last seven days more closely, so your records say what you actually talked about. It reads the subject line and the short preview Gmail shows for your recent mail, the titles of your meetings, and it opens up to eight emails from people you emailed with who are not on your orbit yet. That text is sent to Anthropic, the AI that does the reading. For people already on your orbit it adds a short dated note on what you discussed, any next step you owe them, and, when their signature says it plainly, the city they are based in. Undo puts a week's changes back. New people are only listed in your General chat for you to add or skip; nobody new is added until you say. Someone you archived is never proposed again and gets no notes.
- What it never files. Nothing about health, accommodations, disability services, counselling, discipline or grades is written into anyone's record. Mail or a meeting that plainly names one of those in its subject, preview or title is skipped before the AI sees it, and a note that touches one is thrown away.
- What happens when you ask. If you ask Tenora a question that needs an email, for example "what did Priya say in her last email", it searches your mail and reads that message so it can answer you. That text is sent to Anthropic to produce the answer, the same as anything else you type, and it is kept as part of that chat like the rest of the conversation. Nothing is read this way unless you ask a question that requires it.
- What is stored. From the daily scan, a dated line on that person's timeline saying an email or a meeting happened, with the subject or event title. From the weekly pass, the notes above, and the list of people it proposed, in your General chat. Tenora keeps no copy of your mailbox or calendar.
- How far back. The daily scan: the last 30 days once, when you connect. After that, the last two days each morning, and the last seven when you press Scan now. The weekly pass: the last seven days, once a week.
- Who sees it. Only you. It is not sold, not shared, not used for advertising, not used to build any profile, and not used to train any model, by Tenora or by anyone else. No human reads it.
Tenora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What you put in
Everything you add about the people in your network. Typically that is names, email addresses, phone numbers, companies, job titles, LinkedIn links, photos you upload, your own notes about a person, when you last spoke, and how close you are. If you paste a spreadsheet, drop a CSV, drop your phone's contacts file, or import a LinkedIn export, we store what was in it.
Tenora is a chat, so your conversation with it is part of what is stored: the messages you send, what it answered, and what it wrote to a person's record as a result. There is also the one short note it keeps about you, About you in the account menu, in your own words, which you can read and edit there.
How you use it
Standard technical logs from our hosting: rough timing of requests, error reports, and the general health of the app. We also measure how the product itself is used, so we can find what is broken and make it better: which screens get opened, which steps people get stuck on, whether an import worked. That is counts and events about features, not the content of your notes and not the people in your network.
We do not run advertising pixels or third-party tracking cookies, and we do not sell or share any of it. The only cookie Tenora sets is the one that keeps you logged in.
The part that actually matters: other people's information
Most of what you put into Tenora is information about people who are not you and who did not sign up. That is the whole point of the product, and it is also the thing that deserves a straight answer.
So, plainly:
- They are not contacted. Tenora does not email, message, or notify the people in your network. If you send someone a message, it goes from your account, in your words, because you sent it.
- It is not sold or shared. Tenora does not sell personal information, and does not share it with data brokers or advertisers.
- We do not build a shared database out of it. Your contacts belong to your account only. Another user cannot see them, search them, or discover that a person exists in your network.
- You are responsible for what you add. Only put in information you legitimately have, and write notes you would be comfortable having written. Treat it like your own notebook, because that is what it is.
Who else touches your data
Tenora is one person plus a small number of well-known services. Each one gets only what it needs to do its job.
| Service | What it does | What it sees |
|---|---|---|
| Supabase | Database and login | Your account and your contact rows, stored in a Postgres database in the United States |
| Vercel | Hosting | Traffic to the site and app, plus standard server logs |
| Anthropic | The AI that reads your dumps and half-writes your drafts | What you type and the records it needs to answer you. If you connect Gmail or Calendar, what the weekly pass reads |
| Sign in, and the optional Gmail and Calendar connections | Your basic profile. Your mail and calendar, read-only, only if you connect them |
On the AI specifically, because people ask: what you type, the records of the people the answer is about, and your About-you note are sent to Anthropic's API to be processed, and the result comes back to you. Anthropic does not use data submitted through its API to train its models. Tenora does not train any model on your data and does not operate one. The daily scan of Gmail and Calendar involves no AI at all: no part of it is sent to Anthropic. The weekly pass does use it: the subject lines, previews, meeting titles and the few emails it opens are sent to Anthropic to be read, as described above.
Tenora sends you no email. There is no newsletter, no digest and no notification, so no mail service holds your address.
How it is protected
An honest description rather than a list of impressive words.
- Traffic is encrypted in transit over HTTPS, and the database is encrypted at rest by Supabase.
- Every table has row-level security switched on with owner-only policies. In plain English: the database itself refuses to hand your rows to any account that is not yours, so a bug in the app cannot leak them to another user.
- There are no passwords to steal. Sign-in is Google's, and the tokens for a Gmail or Calendar connection are stored server-side, scoped to reading only, and thrown away when you disconnect.
- Access to the production database is limited to Dylan.
No system is perfect and no guarantee of security is given. Where a breach affecting your data occurs, notice will be provided as required by applicable law.
How long it is kept
Your data stays until you delete it. Archive someone and they leave your orbit, but their record stays until you delete your account or ask for it to be erased. Delete your account and everything attached to it is removed from the live database right away, and from backups within 30 days.
What you can do
- See it. Everything Tenora knows about a person is on that person's card. There is no hidden profile behind it.
- Correct it. Say so in the chat and it is fixed, or change the ring and the cadence on the person's card. Say "undo" and the last change is reverted.
- Delete it. Your whole account, yourself: account menu, Your data, Delete account. It takes effect right away and disconnects Google. To erase a single person completely, email hey@tenoraapp.com; Archive on their card only takes them off your orbit.
- Take it with you. Account menu, Your data, Export: every person, note, logged contact and chat, and your About-you note, as one file. Photos and the original files you dropped in are not in it.
- Disconnect Google. Connectors in the account menu, Disconnect. The scans stop and the token is deleted; what was already logged stays on your timeline until you remove it.
If you are in the UK, the EU, or California, these mirror rights given to you by law there. Requests are handled within the period the applicable law requires.
Age
Tenora is not intended for children under 13. If you are under 18, use it with the consent of a parent or guardian. An account identified as belonging to a person under 13 is deleted.
Changes to this policy
Tenora is early and it will change. When this page changes, the date at the top changes with it. Where a change materially affects what happens to your data, notice may be given by email or in the app. Check the date above; continued use after a change means the current version applies.
Contact
Questions, deletion requests, or anything at all: hey@tenoraapp.com.