Privacy

Privacy notice

Last updated: October 12, 2026

This notice describes, in plain English, what personal data TutorFrame collects, why, and what you can do about it. TutorFrame is built for a private tutor's practice: tutors, the families and students they invite, and visitors who join the waitlist, and visitors who send a request from a tutor's public page.

Who runs TutorFrame, and who decides what

TutorFrame is operated by Andrew Maier, a sole proprietor registered in Armenia ("we", "us"). Full operator details, including the postal address, are in the legal notice. You may use TutorFrame from different countries. This notice explains our processing and your rights, including under the EU General Data Protection Regulation (GDPR) where it applies.

Who decides about a piece of data depends on what it is used for:

• We decide about the data we need to run TutorFrame itself: accounts and sign-in (your email address, name and sessions), emails about your account, security logs, error reports, key product actions, and support, content reports and data requests. For this data we are the controller.
• The tutor decides about the records of their own practice: their students and families, lessons, terms, money records, homework, reports, notes, and messages, including records about students who are children and their family adults. We keep and process those records for the tutor, on the tutor's instructions: the tutor is the controller of them and TutorFrame is the tutor's processor.

If you are a family adult or a student, ask your tutor about the records they keep about you. Your account data remains our responsibility. A personal study log that you write for yourself is private by default; you choose who can read each entry. We provide that account feature to you. Entries the tutor writes in their practice are the tutor's records. You can always write to us as well; we pass a request about a practice's records to its tutor and tell you that we did.

What we collect, and about whom

Tutors

We keep your name, email address and time zone. For your practice, we keep its name, time zone, currency, subjects, services, prices and rules. We also keep the sign-in data described below. If you enable a second sign-in step, your authenticator secret is encrypted on our servers so we can check a code. Recovery codes are kept as hashes, not readable codes.

Family adults

We keep your name, email address, family membership and administrator status. We keep the children you are linked to and the access you gave or received, with its dates. We record which terms you accepted or declined, when, and any decline reason. We also keep consent for a child's login and your notification choices. You may write messages and personal study-log entries, and share files.

Students, children included

A child's record - their name, schedule, homework and progress - is kept by the tutor, and a family adult follows it for them; a child does not need a login, phone number or email address of their own to be taught through TutorFrame. The tutor's card for a student holds their name, whether they are an adult, and any contact email or phone number the tutor adds. Around it the practice keeps lessons, attendance, cancellations, homework, the student's answers, the tutor's feedback, reports for adults, and the money records of those lessons. A tutor's private notes on a student are kept for the tutor alone and are never shown to a family or a student. A student who has their own sign-in also has an email address with us, and, for a student under 18, the date of birth a family adult entered to enable it.

Files, messages and other text you enter

We store the text you write in homework, answers, feedback, reports, notes, goals, study logs, public profiles, requests and chats. We also store lesson places or meeting links, time records, and the names and rules you give services, packages and discounts. For an uploaded file we keep its name, type, size, uploader, time and storage reference. The file itself is stored privately in Cloudflare R2. We provide a five-minute download link after checking access. Someone who receives a file may keep their own downloaded copy.

Chats include family conversations, private threads, groups and announcements. We keep the participants, original audience, read position, message text, files and revisions. Who can read a message depends on their access to its subjects; messages about money require financial access. An edit keeps earlier revisions. Deleting a message hides its text and files from ordinary reads, but does not erase those earlier revisions. They stay until the practice is erased. It does not recall a downloaded file or a delivered email.

A personal study-log entry is private until you share it with named people. A tutor's private notes and diary are visible only to the tutor. Reports are for adults. Please record only what you need for tutoring. Do not upload identity documents, card details, or sensitive information such as health data unless you have a lawful basis and it is necessary.

Payments tracked, not processed

TutorFrame does not take payments from families and does not process or store card details. Families pay their tutor directly, outside the service. The tutor records what was charged and what was paid - the amount, the date, how it was paid (cash, bank transfer or other) and an optional note - and TutorFrame keeps that journal so both sides can see a clear statement.

Everyone who signs in

For each sign-in we keep the session with the browser it came from, so you can see your sessions and end them. A shared browser can retain several accounts and your choice of active account. If you protect an account on that browser with a PIN, we keep a salted verifier and failed-attempt counters, not the PIN itself; we do not store the IP address with it. To slow down attacks, we count attempts to sign in or to open an invitation per email address and, where our network setup passes it on, per network address, in a form that cannot be read back, and clear those counts daily. If you sign in with Google, Google tells us your name, email address and any profile image link, and we keep the sign-in tokens it issues encrypted. Everyone who receives our emails has their address's delivery state kept: whether mail to it bounced or was reported as spam.

Visitors, the waitlist and support

If you join the waitlist on this site, we keep your email address and the moment you joined, and nothing else: no name and no network address. They are kept in the application's database (Railway Postgres, in the EU) and used only to tell you when TutorFrame opens to you. We keep them for 12 months from the day you joined, or until you ask us to remove your address by writing from it to hello@tutorframe.net. To tell people from automated programs, the waitlist form uses Cloudflare Turnstile, as a tutor's request form does: it loads only when you start to use the form (see "Visitors who send a request from a tutor's page" below and the processor table). To slow down abuse, we count sign-ups per network address, in a form that cannot be read back, and clear those counts daily. If you write to us, we keep your message, attachments and address to answer it. A content report may be shared with the affected user where needed to explain or contest a decision. A valid DMCA counter-notice is sent to the original complainant, including its contact details. We also disclose data when a binding legal obligation requires it. Every visit to this site or the application passes through Cloudflare, which sees your IP address and the page you asked for. We use IP addresses for security and to limit abuse, including provider request logs (see "How long we keep it"); we never sell them or use them for advertising.

Visitors who send a request from a tutor's page

A tutor may publish a page with a request form. You need no account to use it. If you send a request, we keep what you type: your name, your email address, a phone number if you give one, the subject you pick from the tutor's list (or "other"), when you would like to have lessons, and your message. Please do not put more about a child than the tutor needs to answer you. The tutor then adds notes of their own and the state of the conversation (for example "contacted"), and we keep that history with the request.

The tutor decides what is done with your request: they read it, answer it, may add you to their practice as a student, or delete it. We keep it for the tutor and process it for them. The tutor is the controller of it and TutorFrame is the tutor's processor. The tutor gets an email that names you and the subject and links into the application; the email does not carry your message, address or phone number.

To tell people from automated programs, the form uses Cloudflare Turnstile. It loads only when you start to use the form, and it runs in your browser: Cloudflare then receives your network address and details of your browser, under its own privacy policy, and tells us whether the check passed. Nothing is loaded from a third party just by reading the page. To slow down abuse, we also count requests per network address, in a form that cannot be read back, and clear those counts daily.

A request that did not lead to a student is deleted, with its notes and history, 365 days after its last change. A request that became a student's card follows the tutor's records of that student. The tutor can delete a request sooner.

A tutor's public page

A tutor who publishes a page chooses what it says: their name as they want it shown, a description, subjects, qualifications, prices as they wrote them, lesson lengths and formats, cancellation rules, and any phone number, email address or link they choose to add. All of it is visible to anyone who has the link. Unless the tutor turns it off, search engines may list the page. The page shows no student, no family, no lesson and no calendar, sets no cookie and counts no visit. A tutor can hide the page at any time; it is then no longer served, though a search engine may keep its own copy for a while.

Why we use it, and the legal basis

Where the General Data Protection Regulation applies, each use of data rests on one legal basis: performance of a contract with you, your consent, our legitimate interest (balanced against your rights), or a legal obligation, such as keeping financial records for the period the law requires. Where consent is the basis, you can withdraw it at any time; see "Your rights" below.

• The waitlist: your consent, given by submitting the form. You can withdraw it at any time by asking us to remove your address.
• Accounts and sign-in: performance of our contract with the account holder.
• Security logs and limits on sign-in attempts: our legitimate interest in keeping the service safe.
• A tutor's practice records (students, families, lessons, homework, reports, notes and messages): the tutor's own legal basis towards their families; we process these records on the tutor's instructions, under our contract with the tutor.
• Terms, charges and payments: the tutor determines the legal basis for their records. We process them on the tutor's instructions, including keeping the history of corrections.
• Family access and a child's own sign-in: performance of a contract, resting on the tutor's invitation and the family's acceptance of it; a child's sign-in additionally rests on the recorded consent of a family adult.
• Emails about your account: performance of our contract with you. Emails about lessons, homework, terms, messages and money records also process practice data on the tutor's instructions.
• Loading a tutor's existing records from a spreadsheet at their written request: the tutor's written request; we process the records on the tutor's instructions.
• A request sent from a tutor's page: the requester's own request, and the tutor's own legal basis towards the people who write to them; we process the request on the tutor's instructions, under our contract with the tutor; the bot check on the form: our legitimate interest in keeping the form free of automated abuse.
• A tutor's public page: the tutor's own choice to publish it; we process it on the tutor's instructions, under our contract with the tutor.
• Your personal study log: performance of our contract with you; a minor's own login also requires the family adult's recorded consent.
• Error reports: our legitimate interest in finding and fixing bugs.
• Key product actions: our legitimate interest in understanding how the product is used by all accounts except demos.
• Content reports and challenges: our legitimate interest in protecting people and their rights, and a legal obligation where the law requires us to act or disclose information.
• Support and requests about your data: our legal obligation to answer requests about your data, and our legitimate interest in answering your questions.

Children

A child does not need their own account to be taught through TutorFrame: the tutor keeps the child's schedule, homework and progress, and a family adult follows them and manages who may see them. A child may be given their own sign-in only when an administrator of the child's family, signed in with an email address they have proved is theirs, enters the child's date of birth and email address, confirms that they are the child's parent or legal guardian by typing their full name, and then enters a code we send to their own address. Only after that does the child receive an invitation.

We keep a record of that consent: who gave it, the name they typed, which version of the notice they saw, and when it was given, confirmed or withdrawn. For a child under 13, the family adult also receives an email when the child accepts the invitation and their account is created, which summarizes the consent and carries a link to withdraw it. Withdrawing the consent removes the child's access to the practice's records and cancels any invitation still pending; it does not delete what already happened.

A child's account can see lessons and homework, use permitted chats, goals and their own study log, cancel lessons, ask to move a lesson, and book a lesson at the normal price; a lesson the child books creates a charge that the family's payer owes. It cannot see money or accept terms, and a child under 18 never sees a lesson report. The date of birth is used to apply age and access rules. The tutor is the controller of the child's educational records and related family-adult records. We process those records for the tutor; we are the controller of the child's account and service security data. The tutor must have a lawful basis for recording a child's data even when the child has no login. Consent to a login is separate from that basis. Children of any age can be students in the beta. A child under 13 has their own sign-in only through a parent or guardian, by the steps above. A parent or guardian can ask us to show, correct or delete the child's data, subject to identity, authority and the tutor's controller duties. They can also withdraw consent; see "Your rights". We never use a child's data for advertising and never sell it.

There is no public directory of students and no way to search for a child. We do not count children's page views. When analytics is enabled, their eligible key actions are counted in the same way as other real accounts, using a random account ID, event ID and time; children's content never goes into analytics, error reports or logs. If you think an adult has the wrong access to a child, or you want to report content or contact, write to hello@tutorframe.net. You can also use the content reporting procedure. On our request, the tutor or the family's administrator restricts the disputed access in the product, and we tell each side what was done; we do not decide who a child's guardian is.

Who processes your data, and where

These providers help run TutorFrame. Providers acting on our instructions are processors, or subprocessors for the records we hold for a tutor. Google sign-in also operates under Google's own privacy policy. A provider may process its own security and service data under its own policy.

A calendar link you create yourself is read by the calendar app you add it to; that app's provider is your choice, not our processor. The link shows lesson times, places, the student's name, the service and the practice or family name, never amounts, terms or notes, and you can reset or turn it off at any time. Email sent to our support address, hello@tutorframe.net, is received through Cloudflare Email Routing, which forwards it to a Gmail mailbox of the operator's, where it is kept (see Google (Gmail) in the table).

The application's database, hosting, files, error reports and product analytics use EU regions. Postmark's mail service uses US infrastructure. Google operates servers worldwide, including outside the EEA; we have not verified a fixed region for sign-in or our Gmail mailbox. Cloudflare's network is global. Because the operator works from Armenia, outside the EEA, limited data may also be accessed from there for running and supporting the business. Where GDPR requires a transfer safeguard, the transfer must be covered by an applicable adequacy decision or the European Commission's standard contractual clauses, with additional protection where needed. EU storage alone does not cover access from another country. Ask hello@tutorframe.net for the safeguard that covers your data and a copy, with confidential details removed.

How long we keep it

How long each kind of data is kept:

• Account data (sign-in email, name, sessions): while the account exists; erased within 30 days after it is closed.
• Working educational data (schedule, homework, reports): as long as the tutor keeps the practice; erased within 30 days after the tutor closes the practice or asks us to.
• Notifications (in the app and by email): while the account exists; erased within 30 days after it is closed. Completed and failed original mail jobs normally expire after 7 days. Copies of jobs that failed for good expire after 365 days by default; a shorter configured period may apply. A verified deletion also covers stored mail and queue copies, rather than waiting for that default expiry.
• Financial records (charges, payments, statements): as long as the tutor keeps the practice. A tutor who needs them for their own tax duties should export them before closing the practice; after that they are erased within 30 days, except what the law requires us to keep. Payments, charge lines and the journal are not overwritten during ordinary use: a correction is a new entry. The separate practice-erasure process removes them.
• Terms and the history of changes (the terms a family accepted or declined, and who changed what and when): as long as the tutor keeps the practice; erased within 30 days after the practice is closed, except what the law requires us to keep. Ordinary use cannot overwrite their history. The separate practice-erasure process removes it.
• Files (homework uploads and a tutor's template materials): as long as the practice keeps them; erased within 30 days after the practice is closed. Unconfirmed uploads and files with no remaining homework, answer, report, message-revision or template references are checked daily. They become eligible for removal 24 hours after their last change and are normally removed within about 48 hours. Hidden message revisions can still refer to a file.
• Chats and message revisions: while the practice exists, then erased within 30 days after a verified practice-erasure request. Hidden earlier revisions still count as file references.
• Personal study logs: until you delete an entry or the relevant account or profile is erased. Personal entries you authored are removed by account erasure; another person's records may retain a disabled reference to you.
• Requests sent from a tutor's page: 365 days after the last change, unless the request became a student's card; the tutor can delete one sooner.
• Sign-ins: a sign-in ends when you sign out, or after 30 days without use; a sign-in link stops working after 15 minutes. An invitation stops working after 7 days, and a confirmation code after 10 minutes.
• Waitlist addresses: 12 months from the day you joined, or until you ask us to remove yours by writing from it to hello@tutorframe.net.
• IP addresses: provider request logs used for security, and keyed abuse counters cleared daily. Sign-in sessions do not store your IP address.
• Server logs: our retention policy is 30 days. Our providers keep their own request logs for the periods their policies set.
• Error reports (Sentry): 90 days.
• Key product actions (PostHog): 12 months.
• Backups: the beta currently runs without database backups; their schedule and retention period will be listed here when backups start. After a restore, deletions and consent withdrawals must be reapplied before the service reopens.
• Support messages and records of data requests: 3 years. Closed in-app deletion-request histories expire three years after their last event; open requests remain until resolved. Erasure receipts contain IDs, dates, counts and coded exceptions, not contact details or content. Their retention policy is three years, but automatic receipt expiry is not scheduled today. Unplaced technical records of failed-job decisions have no automatic expiry today; they hold job IDs, an action and a bounded reason, not the job payload.

Your rights

Where GDPR applies, you can ask for access and a copy, correction, erasure, restriction of processing, and portability of data you provided when processing is based on consent or contract and is automated. You can object to processing based on legitimate interests, including product analytics. You can withdraw consent at any time without affecting earlier lawful processing. These rights have legal limits; we explain any refusal. Product analytics is used to understand service usage, not to make decisions about your access or prices. Much of it you can do yourself, straight away:

• In your account settings: change your name and time zone, choose which emails you receive, see your sign-ins and sign out everywhere.
• In account settings: request deletion of your own account, see the request status and deadline, or withdraw it before acknowledgment. Requesting deletion does not immediately end access or close a tutor's practice.
• Reset or turn off your calendar link.
• A tutor can export their lessons and money records as CSV, and correct their own records; a money record is corrected with a new, reversing entry.
• A family adult can withdraw the consent for a child's sign-in and revoke access they gave.

For anything else, write to hello@tutorframe.net from the email address of your account; a request from another address waits until that address confirms it. We verify who is asking and their authority (for example, that a parent manages the family of the child they are asking about) before acting on a request. We never ask for a copy of an identity document. An answer holds only your own data, never another person's. We acknowledge within 3 working days and reply without undue delay, within 30 days of receipt or an earlier deadline required by law. Where the law permits an extension for a complex request, we tell you why and give the new deadline within the initial period. Requests are normally free; any fee or refusal must have a lawful reason.

We erase your account and its personal records within 30 days of receiving a verified deletion request, except specifically justified legal retention. The deadline runs from receipt, not acknowledgment. Account deletion ends sign-ins and personal access. It does not automatically close a tutor's practice or erase another person's records. Where those records still need your account ID, only a disabled reference remains, without your authentication or contact data.

To erase a practice, its tutor must request that separately and export any records they need first. Within 30 days we erase the practice's educational, financial, contractual and audit records. There is no blanket financial-record hold by TutorFrame. Minimal consent evidence needed by another practice can remain, with access limited to consent use and withdrawal. We explain retained references and any legal exception to you. Removing data from external providers and files is part of the request and is handled manually.

If you sent a request from a tutor's page, we verify you through the email address stored on that request. We act on a reply from that address, not an address supplied by someone else. You may ask for access or an export: it holds your request and the time it was received, not unrelated information about other people. The tutor is responsible for assessing access to personal data in their notes and status history; a note is not exempt from GDPR access merely because it is private. A request is not edited: to correct one, ask for its deletion and send a new request. Your tutor is responsible for deciding deletion requests under applicable law. We pass your verified request to them, record that step and tell you the outcome. Converting the request into a student's card does not create an account. We still verify you through the request's email address and pass requests about the card to the tutor. Once you have an account linked to the practice with the authority you ask about (for example, you accepted an invitation as a parent or as the student), we treat you as a person of that practice and verify you as described above.

If you live in a US state with a privacy law, you may ask us to tell you what personal data we hold about you, to correct it and to delete it; write to the address above. We do not sell personal data and do not share it for advertising. Where GDPR applies, you can complain to a supervisory authority, especially in the country where you live or work or where a breach occurred. You do not have to contact us first.

Security

Connections are encrypted. There are no passwords to steal: you sign in with a short-lived email link or with Google, and tutors can add a second sign-in step. Access is checked on every request, including emails, exports and the calendar feed. Calendar links, and invitation links in our database, are stored only in a form that can check them, not reveal them; an invitation link is also kept, encrypted, in the email job that sends it until the email is sent (or, if sending failed, until that copy is removed or expires under the mail-job retention above). Files are private, and money and terms records cannot be changed after the fact. No system is perfectly secure. We tell the affected tutor without undue delay if a breach affects records we process for them. For data we control, we notify the competent authority within 72 hours of awareness where GDPR requires it, and notify affected people without undue delay where a high risk makes notification necessary.

Cookies and browser storage

We set no advertising or analytics cookies and run no cross-site trackers. These are the cookies used by the deployed application:

• tutorframe.browser_credential: keeps your browser's retained accounts and active sign-in. It lasts up to 30 days and is renewed when the active session is renewed. Keeping another account in the list does not extend that account's inactive session.
• __Secure-tutorframe.session_token: the session cookie used for a temporary demo or an older sign-in being migrated to the browser credential. Its maximum lifetime is 30 days, but demo access ends sooner. Ordinary retained account sign-ins use the browser credential instead.
• __Secure-tutorframe.state: protects Google sign-in against a forged callback. It lasts 5 minutes and is cleared when the callback is handled.
• tf_invite_proof: remembers that you confirmed the invited email address. It works only on that invitation's path, for up to 30 minutes, and is cleared when the invitation is answered.
• tutorframe.demo: marks a temporary demo visit and recognises when it has ended. It lasts up to 24 hours and is cleared when you leave.

When clearing an old sign-in, the system may also clear tutorframe.session_token, the older name without the secure prefix. On sign-out it sends expiry instructions for __Secure-tutorframe.session_data and __Secure-tutorframe.dont_remember. Session caching is disabled and our sign-in screens do not set a persistent value for either. The cookies above are for sign-in, security and a demo you request, not tracking. You can clear or block them in your browser; sign-in and invitation features may then stop working.

Browser local storage holds your theme and animation choice (theme and tutorframe:mosaic-paused). Tab session storage holds the email you typed to sign in (tutorframe.signInEmail) and the calendar day to focus when returning (calendar-focus-day). The sign-in email is cleared when you continue, and the calendar choice is cleared when used. You can clear this storage in your browser. PostHog receives events only from our servers and stores nothing on your device. Sentry sets no cookies. Turnstile receives browser and network signals when you use a protected form. Our forms request a bot-check token; they do not request a clearance cookie.

Changes to this notice

We may update this notice as the product or its processors change. The date at the top shows when it was last revised; material changes will be pointed out to tutors and families in the app.

Contact

For questions about this notice or to exercise your rights, write to hello@tutorframe.net. Full operator details are in the legal notice, and the terms of using TutorFrame are in the terms of service. To report copyright infringement or other illegal content, use Copyright complaints and reported content.

Back to TutorFrame