Privacy Policy

Information we collect

• Account data you provide as a tutor: name, email, password, profile details.
• Student data you add to run your business: student names, emails, lesson notes, homework, and scheduling details. You are the owner and controller of this data; we process it on your behalf.
• Payment data: handled by our payment processors (Stripe, PayPal, Paddle, Polar). We do not store full card numbers.
• Usage data: basic logs and analytics to keep the service secure and reliable.

How we use it

To provide and improve the service, process payments, send transactional emails and reminders, respond to support requests, and keep the platform secure. We do not sell your data.

Service providers we use

We rely on trusted providers to run Tutafy, including Supabase (database & auth), Vercel (hosting), Resend (email), Twilio (SMS), Stripe / PayPal / Paddle / Polar (payments), and Groq (AI features). Each processes data only as needed to provide their service.

Children's data

Tutafy is intended for tutors (adults). If, as a tutor, you record data about students under 13, you are responsible for obtaining any required parental consent (e.g. under COPPA). Parents can request access to or deletion of their child's data by contacting the tutor or us.

Your rights

You can access, export, correct or delete your data at any time from your account or by contacting us. Deleting your account removes your data from active systems.

Data retention & security

We keep data while your account is active and delete it on request. We use industry-standard security (encryption in transit, access controls). No system is perfectly secure, but we work hard to protect your data.

Cookies & analytics

We use essential cookies to keep you signed in and run the app. On tutafy.com, including the app after you sign in, we also use, only with your consent, analytics and advertising cookies to understand how visitors find us and how the product is used, and to measure our ads — including Google Analytics 4 and Google Ads (both loaded through one Google tag) and the Meta (Facebook) Pixel. Google Analytics tells us how many people visit, which pages they view (in the app too, once you are signed in) and, as two events, when someone signs up for an account or clicks a Go Pro button; those events carry no name or email address. The page addresses we send to Google never include an access code, a record ID or anything after a question mark (except advertising campaign tags such as utm_source), as long as the automatic page-change option of Google Analytics (called Enhanced Measurement) stays switched off in our Google Analytics settings. Pages that open a student's portal or a private record send nothing to Google at all. Google may set its own cookies and process this data under its own privacy policy. If you decline, no Google tag is loaded and nothing is sent to Google. You can accept or decline these in the cookie banner, and change your mind anytime by clearing your browser storage. Declining does not affect your ability to use Tutafy.

How visitors find us (our own measurement)

Only if you accept cookies, we also keep a short record of your visit in our own database (not with an advertising company), so we can learn which sites and searches lead to Tutafy and which pages help people decide. We store:

• a random visitor ID kept in one cookie (tutafy_vid) that lasts up to 13 months;
• your country (two-letter code, taken from our host's country header), the website, search or assistant that sent you (for example Google, an AI assistant such as ChatGPT, Gemini, Claude, Perplexity or Copilot, a social site, or none) and any campaign tags in the link;
• the pages you open on tutafy.com, as short page names with no personal details (for example /blog or /upgrade), their order and time, whether you pressed an upgrade button, and whether a paid plan followed;
• if you create a tutor account or sign in while this cookie is set, a link between the visitor ID and your account, so we can see which journey ended in a purchase.

We do not store your IP address, your browser details, the full web address (no search terms or ids) or the content of anything you type. Only the Tutafy owner can see these records. If you decline in the cookie banner, nothing is recorded and anything already stored for your visitor ID is deleted. Records older than 13 months are removed by a clean-up that the Tutafy owner runs by hand; it is not yet automatic. To have the records linked to your account deleted sooner, email us at the address below.

International visitors (GDPR / CCPA)

If you're in the EU/UK, we process your data on the lawful bases of performing our contract with you and, for analytics/advertising cookies, your consent. If you're in California, we do not sell your personal information. In both cases you can access, correct, delete or export your data — just ask.

Contact

Questions about privacy? Email support@tutafy.com.