Safety and privacy, as built
This page lists only what the product does today. Where something is not offered yet, we say so.
Access follows the relationship
Seeing a child's learning depends on how you are connected to that child and on what their parent has allowed. A linked guardian can see it. A teacher needs the child enrolled in their class and teacher access allowed. A mentor needs an accepted invite and mentor access allowed.
- LearnerLearns with tutors, drills, plans and a skill map. A learner account cannot open the parent, teacher or mentor dashboards.
- ParentSets the daily time limit, quiet hours and safety settings, and follows progress from the family dashboard.
- TeacherRuns a class: roster, live classroom view and class analytics, for learners enrolled in that class.
- MentorWorks on goals, plans and session notes only through a mentee link that has been accepted.
Around the learner
Filtered conversations
Tutor conversations pass through safety filters set to the learner's age band, including a filter for personal information.
Limits that are enforced
A parent's daily time limit and quiet hours are checked when a tutor session starts.
Guardian safety settings
Parents have a settings panel for how the tutor behaves with their child.
Memory the learner can see
The memory vault shows what the tutor remembers about a learner, and the learner can correct it.
Wellbeing without surveillance
Wellbeing signals for parents carry no scores and no message content.
Mentors by consent
A mentor sees nothing until the mentee invite is accepted and the child's parent has allowed mentor access, which needs the card check.
The child can see who can see
Learners have a "My privacy" screen that names the parents, guardians and schools who can see their learning and decide about their data, explains each thing they use in child-friendly words, and shows their private-by-default settings.
Private by default
For every learner under 18: no location beyond the country, a profile that is never public, analytics off unless a parent ticks it, no streak pressure and no marketing.
Accounts and sign-in
Passwords are hashed
Passwords are stored as salted hashes, never as the password itself, and new passwords have to meet a strength policy.
Attempts are limited
Repeated sign-in, sign-up and password reset attempts are rate limited.
Sign out everywhere
You can reset a password and sign out of every device. A signed-out session is refused.
Separate views
A learner account cannot open the parent, teacher or mentor dashboards.
Age check at sign-up
Everyone gives a date of birth and country when they sign up. We work out the age on our side, keep only the year and month, and apply the age of digital consent for that country (18 where we have not reviewed the country's rules, or no country is given).
Parental consent, one choice at a time
A learner below that age gets a paused account, and we email their parent or guardian a single-use link. The parent reads what we collect and why, and makes eight separate choices, none pre-ticked. Tutoring, AI processing, memory, analytics and service emails are confirmed by email, with a follow-up a day later. If nobody answers within 14 days, the paused account and the parent's email are deleted.
A card check before anyone outside the family sees data
Learning circles, mentor access and teacher access need a card check: a 50-cent (or 50p or 50 euro cent) charge refunded in full straight away, with an email confirming both. In India, Brazil, South Africa, South Korea and China, every choice needs it.
Schools, for education only
In the US, UK, EU and EEA, a verified school can authorise tutoring, AI processing, memory and teacher access for its own classes, for educational purposes only. Parents are told, and a parent's choices override the school's.
Parents stay in control
Parents can review what they agreed to, turn any choice off, withdraw consent, download all their child's data from every service in one file, or delete it. Turning something off works straight away and deletes the data that existed only because of it. Deletion covers every store, including vector memory, and is checked store by store until nothing is left.
AI that does not keep or learn from children's data
Tutor replies come from models on our own servers through our model gateway, which is asked not to log messages. A commercial model is only a fallback, under terms that forbid training on or keeping the data. Children's data is never used to train AI.
A second sign-in step for adults who see children's data
Teacher, mentor, school official and admin accounts must set up a passkey or authenticator app before their first session. Parents can turn it on too; learners are not asked. Allowing more, withdrawing consent, downloading or deleting data asks you to confirm it is you again.
Not offered yet
- Signing in with Google, Microsoft or Apple. The app supports it, but it is not switched on yet.
- The card check. It is built but not switched on yet, so until it is, parents cannot allow learning circles, mentor access or teacher access, and parents in India, Brazil, South Africa, South Korea and China cannot give consent.
- Names of the specific teachers and mentors on the child's own "My privacy" screen, and per-learner teacher access badges.
- Expert-reviewed syllabus outlines. Every curriculum outline, including UK GCSE, is still marked beta until a subject expert has reviewed it.
We do not claim any certification or regulatory compliance on this site. How we handle personal data is set out in the privacy policy.
Raise a concern
- A child's safetyEmail [email protected]. If a child is in immediate danger, contact your local emergency services first.
- Your data or your child'sEmail [email protected] to ask for a copy, a correction or deletion.
- Help with the appEmail [email protected].