Privacy.

This is a personal site run by Roger Henley. There is no company behind it, no advertising, and nothing collected here is sold or shared with a third party for their own use. The site runs on one rented server in the United States.

Every visit writes a short record of what happened: the page, when it was opened and left, the previous site if the browser reports one, a coarse device class (phone, tablet, desktop), the display mode you picked, and which links you followed. These records exist so I can see what works on the site and what nobody reads.

A random id is set in a first-party cookie on your first visit so repeat visits from the same browser can be counted as one visitor. It carries no personal data and is not shared with anyone. Your network address is stored only as a salted hash, which cannot be turned back into the address. No third-party analytics or tracking scripts run on this site.

A message through the contact form stores your name, email address, the message, and a hashed network address. It is used to answer you and for nothing else.

Requesting access stores your name, email address, organization, and stated role, plus the approval decision and when your access ends. Signing in stores a session record with a hashed network address and browser type. Members’ page views and actions on the site are recorded against their account in the same event stream as anonymous visits.

A job description you submit is stored in full, along with the requirement-by-requirement assessment the site produces from it and the résumé written for it. The text is processed by a language model that runs on this server; it is not sent to any outside AI service. Every model decision is logged so I can review and correct it. Reviews stay attached to your account and are mailed to you and to me when they finish.

Booking stores your name, email address, the length you chose, the time, and any note you add. The same details are written into my Google Calendar as the event itself: your name in its title, your note in its description, and your email address as an attendee, which is how Google may send you an invitation. Google receives what you put on the booking form, and the calendar connection is to my own calendar rather than to yours.

Cancelling removes the event from the calendar and marks the booking cancelled here. Both of us are emailed when a meeting is booked and when one is cancelled.

The decision test is a research instrument, open to anyone, and the data it produces is the point of it. Taking it stores every answer you give: which option you chose, how long you took, and the confidence you rated yourself at. It also stores the number you were asked to hold at the start of each block and the number you typed back at the end, so that a missed number can be told apart from a number held but not transformed.

Alongside that it records the conditions the run happened under, because they change what the measurements mean: a coarse device class, whether you used sound or the visual tick, whether you passed the tap-along check, and your reaction time and its variability from that check. A run that is started and not finished is kept and marked unfinished, because where people stop is itself a measurement.

The details asked for before the test are all optional and you can take it without giving any of them: a name, an age band, an education level, an occupation, and an email address. The email address is an identifier as well as a contact. It is how a second run by the same person is recognised as a repeat, and it is the only way results can be sent to you. Results go only to someone who asked for them. Your answers are graded on this server and are not sent to any outside service, and no language model is involved in the test.

You are never told which individual questions you got right or wrong, during the test or afterwards. That is not secrecy for its own sake: an answer key that gets out ruins the instrument permanently for everyone who takes it later.

Transactional email (verification, approval, review results) is sent through Resend, which sees the recipient address and the message. Delivery status is logged. No marketing email is sent.

• Event records lose their identity columns (account, session, visitor id, address hash) after 13 months. The anonymous counts remain.
• Sessions end on sign-out or after 30 days, and are removed when access expires.
• Accounts, contact messages, job description reviews, and meeting bookings are kept until you ask for them to be removed. There is no job that expires them on a schedule.
• Decision test measurements are kept indefinitely, because they are a research dataset and a dataset that expires in pieces cannot be analysed. The identity attached to a run (name, email, age band, education, occupation) is cleared whenever you ask, which leaves the measurements in place with no person attached to them.

You can ask for a copy of everything held about you, or for it to be deleted, by writing to the address below. Removing an account ends its sessions and detaches its reviews and event records from it; say so if you want the reviews themselves removed too. Blocking cookies in your browser stops the visitor id; the site still works.

For the decision test, deletion means your identity is cleared and the anonymous measurements stay. Say so if you want the run itself removed and it will be, though be aware that is the one request here that cannot be undone and cannot be repeated, since the test only works once on the same person.

rogerhenley345@gmail.com