How we keep your information safe

Last updated: 12 October 2026

Tutor holds information about children — their lessons, homework and progress — so we take care of it the way we’d want our own children’s information looked after. This page explains, in plain words, what we do today. The Privacy Policy covers what we collect and why.

Signing in

• No passwords for families, students or tutors. People sign in with Google, GitHub, or a one-time 6-digit code sent to their email.
• A sign-in code works once, for 10 minutes and 5 tries, and we keep only a one-way hash of it — never the code itself.
• What signing in gives you is a short pass that lasts an hour. The Tutor phone app stays signed in with a key kept in the phone’s secure storage (the iPhone Keychain); the key is replaced every time it’s used, and stops working after 90 days without use.
• Anyone can sign out of all their devices from the app, and we can do it for them if a phone is lost.
• HaasiTech’s own administration area needs a passkey (Face ID, Touch ID or a security key) and sits behind an extra access check.

Who can see what

• Parents see only their own children. Students see only their own work. Teachers see the students they teach. An institute’s admin sees that institute only.
• Each institute’s information is kept apart from every other institute’s.
• Personal details such as date of birth and address are optional. Tutor works fully with just first names, homework, tests and progress.
• We don’t look at institutes’ student information. We only access it when an institute asks us to help, or to keep the service running (for example, restoring a backup).

Where Tutor’s data lives

• Tutor’s data is not in the public cloud. Students’ records, homework, tests and photos are kept on HaasiTech’s own servers (on-premises, in the United States), run by the people who build Tutor — not on shared cloud services and not shared with anyone.
• Those servers have no open doors to the internet. They connect out through a private, encrypted tunnel to Cloudflare, which they open themselves; nothing from the internet can reach them except through that tunnel.
• Every page and app connection is encrypted (HTTPS), browsers are told to always use it, and Cloudflare blocks attacks before they reach us.
• We keep software up to date, and security updates install automatically.

Backups

• Everything — the databases and uploaded homework photos — is backed up every night.
• Each backup is checked by reading it back, and a second copy goes to a separate drive. We keep 60 days of backups.
• If a backup fails, we’re alerted on our phones the same night.

AI

Tutor’s AI features — reading handwritten homework and suggesting practice questions — run on our own computer. Your information is not sent to outside AI companies.

Other companies

A few companies help run the service, each only for its job: Cloudflare (carrying traffic), Resend (sending emails such as sign-in codes), Google and GitHub (only if you choose to sign in with them), Google Firebase (phone notifications) and WhatsApp (only for parents who turn it on). They’re listed in the Privacy Policy. We never sell information, and there are no ads.

Your control

• Anyone can delete their account — in the Tutor app (Profile → Delete my account) or on the web.
• An institute can close its Tutor account and have its information deleted; just ask us.

Found a problem?

If you think you’ve found a security problem, please tell us at [email protected]. We read every report and reply. No system is perfectly secure; if a problem ever affects your information, we’ll tell you as the law requires.