Privacy Policy

1. What we collect

When you create an account we collect your name, email address, and role (student or tutor). Tutors additionally provide a profile photo, bio, qualifications, subjects, and rates. Messages you send through the platform are stored so conversations can be retrieved.

2. How we use your data

We use your data to operate the marketplace: matching students with tutors, enabling messaging, processing payments, and sending account-related emails. We do not sell your personal data to third parties.

3. Keeping chat safe

To protect the marketplace, messages that include email addresses, phone numbers, links or messaging-app names are blocked until the relevant fee has been paid. To help keep users safe — many of them under 18 — each chat message is also checked automatically for harmful content such as sexual content, harassment or threats. Messages flagged by that check, and conversations reported by a user, are reviewed by our team. Our team can also read a conversation when needed — for example to investigate a complaint, suspected misuse of the platform or a safety concern — and every time they do, it is recorded. When a conversation is reported we keep a copy of its recent messages for that review, even if an account is later deleted, and we may share it with the police or child-protection services where someone may be at risk.

4. Services we use

These providers process data on our behalf, each under their own security and privacy commitments. We only share what each one needs.

• Supabase — Accounts, sign-in, profiles, messages and profile photos (our database and file storage).
• Vercel — Hosts the website. Vercel Web Analytics and Speed Insights give us anonymous, aggregated usage and performance figures.
• Cloudflare Turnstile — Checks that sign-ins and sign-ups come from a person rather than a bot, using technical signals from your browser.
• OpenAI — Checks chat messages for harmful content (see section 3). Only the message text is sent. OpenAI does not use it to train its models and may keep it for up to 30 days to prevent abuse.
• Sentry — Receives an error report when something breaks. We configure it to exclude message content, cookies and personal details.
• postcodes.io — Turns a postcode or town into an approximate location for distance search. For tutors we store only the centre of their postcode district and its area name — never the full postcode. Students’ searches are not stored.
• Have I Been Pwned — Checks new passwords against known data breaches. Only the first five characters of a one-way fingerprint of the password are sent — never the password itself.
• Stripe — Will process payments once paid features launch. Card details go directly to Stripe and never reach us.

Profile photos are also checked for inappropriate content on your own device before upload — the photo is not sent anywhere for that check.

5. Data retention

We retain account and message data for as long as your account is active. You can request deletion of your account and associated data at any time by contacting us.

6. Your rights

Depending on your location, you may have the right to access, correct, or delete your personal data, and to object to certain processing. Contact us to exercise these rights.

7. Cookies

We use essential cookies to keep you signed in and to remember your theme preference. We use privacy-respecting analytics to understand aggregate usage of the site.

8. Changes to this policy

We may update this policy from time to time. Material changes will be highlighted on this page.