Privacy Policy

Cookie Tutoring is run from the United Kingdom by Tristan Pagden, trading as cookie and Cookie Tutoring, the same person and business that runs cookie. We are the data controller for everything described here. Our address for correspondence is 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB, United Kingdom. Contact us at support@cookie.education, or through our contact page.

• Your account. Name, email address and password are held by the shared cookie account system; signing in here creates nothing new. When you sign up, the shared account system also notes where the sign-up came from (the page your visit began on, the website that sent you, the page you were heading to and any campaign tag in the link), as cookie.education's privacy policy explains. It is kept with the account and deleted with it.
• If you are a student: the lessons you book, who with, when, and their status; the lesson times you suggest and agree with your tutor; what you write in a lesson request; your messages; reviews you leave; and your age group (13 to 15, 16 to 17, or 18 or over), which decides who books your lessons. It is the one you gave when you signed up, asked once for cookie and Cookie Tutoring, and never your date of birth.
• If somebody else looks after your lessons (a parent or guardian, say), we record who they are, that they are responsible for you, and whether you are under 18. They must be 18 or over. We do not ask for your date of birth. They pay for your lessons, they can see when those lessons are, and they can read your messages with your tutor. They cannot join a lesson and they cannot write in your conversation.
• If you are 13 to 15 and invite an adult to look after your lessons: the email address you give us for them, and their name if you add it. We use it once, to send them the invitation; the link in it stops working after 14 days or once it is used. If they accept, they become the person who looks after your lessons, as above. If they do not, we send nothing else. The invitation is kept with your account.
• If you apply to tutor: a university email address we verify with a code, your university, degree and result, school-level qualifications and grades, photos or scans of your certificates if you choose to add them, a CV you upload, your teaching experience, notes from your interview, and your Enhanced DBS certificate details and a copy of the certificate.
• If you apply to tutor, where you teach from and your right to work. Which country you are in when you teach. If that is the UK, the law requires us to check your right to work before your first lesson, whatever your nationality: a Home Office share code and, for that route only, your date of birth, which the Home Office checker asks for and which we delete the moment the check is recorded; or a check of your British or Irish passport by Vouchsafe, a government-certified digital identity provider, which compares a short video of your face with the passport photo to confirm it is you; or original documents we look at ourselves. We keep the outcome, the date, the route, the name on the evidence, whether your permission is time-limited, and the evidence itself. The lawful basis is a legal obligation, and it is used for nothing else.
• If you apply to tutor, an identity check. A photo of a passport, driving licence or ID card, and a photo of your face, taken through Stripe Identity. The photographs go to Stripe and never reach us; we are told the outcome, which kind of document it was, and, if it did not pass, the reason. Nothing from this check, no copy of your passport and no photograph, reaches our systems. This applies to tutors only; we never ask a student or a parent for identity documents.
• What you tell us you are looking for. The first time you use Cookie Tutoring we ask, and you can leave any of it blank: whether you are the student or a parent, guardian or sponsor, an age range (under 13, 13 to 15, 16 to 17, or 18 and over, and never a date of birth; we do not ask yours again if you gave it when you signed up), the subjects, levels and exam boards you want, what you are working towards, and the most you would want to pay per hour. If you look after somebody else's lessons, the answers are about them rather than about you. We use it to set up the tutor search for you, and to start the message when you ask a tutor for lessons (you can edit or delete it before you send), and for nothing else: no tutor is shown any of it unless you send it, it never appears on a profile or in a message, and you can change or clear it on your account page at any time. It is deleted when your account is.
• Your public tutor profile, if you have one: display name, photo, bio, teaching style, subjects, rate, availability, and a video introduction if you upload one. This part is deliberately public.
• Lesson reports. After a lesson the tutor writes a short note: what was covered, what the student did well, what to keep working at and what is next. The student and whoever looks after their lessons can read it; the tutor can change it for a day after filing it, and then it is fixed.
• Pages brought into a lesson. A photo of a past paper, an essay, a page of a textbook: whatever a student or tutor puts on the whiteboard to work on together. We keep the file and its name. Both people in the lesson can see it, and so can whoever looks after that student's lessons.
• Lesson content. The shared whiteboard is saved so you can look back at it. We do not currently record lesson audio, video or screen sharing, or make transcripts of lessons. If we ever do, it will be off unless everyone in the lesson agrees for that lesson (for anyone under 18, a parent or guardian as well), having lessons will never depend on agreeing, and this page will say so before it happens. We will never record anyone's camera.
• Payments. Amount, date, what it was for, and Stripe's reference for it. Your card number never reaches us; Stripe handles that directly.
• Waitlist requests. If you ask us to tell you when a tutor becomes available, we keep the email address you gave us and what you were looking for: the subject, the level, and anything you typed in the box. You do not need an account for this, and most people who use it do not have one.
• The assistant: Cookie Tutoring has the same assistant as cookie, run by cookie. If you use it, what you ask and its replies, and, for that question only, the page you are on and any text you highlighted, are sent to cookie's AI service and to OpenAI. It can read your study record in cookie. A chat is kept only if you choose to save it, and you can delete it at any time. It is not in lessons or in the vetting interview. If you are a tutor, it can also read, for your question, the study record of a student you teach: the same mastery, due work, streak and homework you can already see on that student's page, and the notes and past papers that student chose to share with you.
• Web search, in the assistant: the assistant can search the web for something it cannot answer from your lessons and your cookie work. The search goes through cookie's AI service to OpenAI, which runs the search and sends back the pages it found. OpenAI does not use it to train its models and keeps it for up to 30 days to check for abuse, and it runs the search with its own search system and Microsoft Bing, so your search may reach Microsoft as well. We don't keep the results.
• Your calendar link: if you add your lessons to a calendar app, it reads them from a private link that only you have, and anyone with the link can see them, so you can replace it at any time. Your calendar link also carries your revision plan from cookie and the homework your tutors set, when you have them, so a calendar that follows either link shows everything once.
• Suggested tutors: on Find a tutor you can ask for suggestions. Without AI they match the subject, level, board and budget you gave us. With AI (it uses your credits), we send the AI the public profiles of up to twenty matching tutors, your courses, grades and weakest topics from cookie, and anything you wrote in the box; it picks up to three of those tutors and says why. It never changes the order of the list.
• Technical data your browser sends in the ordinary course of loading a page, and errors when something breaks.

• To run lessons: scheduling, video, whiteboard, reminders.
• To take payment and pay tutors.
• To keep students safe. Vetting tutors, checking DBS certificates, and reviewing messages or profiles when something is reported.
• To show tutor profiles, ratings and hours taught to people choosing a tutor.
• To set up the tutor search from what you told us you were looking for. This is the only thing those answers are used for.
• To email you about your own lessons, requests, messages and payouts.
• To meet our legal obligations, including keeping financial records.

Our lawful bases are: performance of a contract for the person who holds the account and books the lessons; legitimate interests for a student whose lessons are booked by a parent or guardian, because a contract with the parent does not cover the child (we have weighed that interest against the child's, and the child's comes first); the recognised legitimate interest in safeguarding (Article 6(1)(ea) of the UK GDPR) for checking messages for contact details and reading them when there is a concern; legal obligation for financial records and for checking a UK tutor's right to work; for a tutor's application, the steps needed before we can agree to list them, together with our legitimate interest in knowing that the adults who teach children are who they say they are and are safe to do so; and legitimate interests for fraud prevention and keeping the service working. You can object to any processing we do on legitimate interests.

A tutor's criminal record check is criminal-offence data. We process it under the Data Protection Act 2018, Schedule 1, Part 2, paragraphs 10 (preventing or detecting unlawful acts) and 18 (safeguarding of children), and we keep the appropriate policy document those conditions require.

Nothing here asks for information about a student's health, disability or additional needs, and tutors are asked not to write it down. If a tutor needs to know something like that to teach well, tell them in the lesson.

This is worth being direct about, because it is the part people least expect.

• Messages between a student and a tutor are stored, and you cannot edit or delete one after sending it.
• We can hide a message that breaks the terms, so the person it was sent to stops seeing it. We do not delete it; it stays in our records so an appeal, a safeguarding enquiry or a lawful request can still be answered, and it can be put back.
• They are readable by us. In practice we read them when there is a report, a dispute about a lesson, or a safeguarding concern, not routinely and not for any commercial purpose.
• Software checks every message for phone numbers, email addresses and the names of other messaging apps, and flags a match for a person to look at. Nothing is blocked and no message is delayed. A flag is a pattern match, not a judgement, and it does not mean anybody has read the conversation; we still only do that for the reasons above. We do this because moving a lesson off the platform is the clearest warning sign there is, and asking a child to be the one who notices it is not good enough.
• If a parent or guardian looks after the student's lessons, they can read the conversation on their own account, and the conversation says so to both people in it. A message the software flags becomes a record in our reports queue that a person looks at; nobody is told about a flag unless it is acted on. If you mute somebody and they keep writing to you, what they send is stored and reported to us.
• We keep them while the account exists and for up to three years afterwards, because a safeguarding concern is sometimes raised long after the fact. Closing an account detaches your name from what you wrote rather than erasing the conversation, because otherwise anyone could delete what they had said to a child simply by deleting their account.
• Whiteboard snapshots are kept alongside their lesson so both people can look back at them, for 365 days afterwards, and are then deleted.

If we ever add lesson recording or transcripts, recordings will be kept for no more than 90 days and then deleted, this page will say how long transcripts are kept before any is made, and none of it will start without explicit consent from everyone in the lesson.

Your tutor keeps a short note about how you learn, so they can plan lessons and so a lesson is not spent going over what you already know. This holds learning information only — what you are working towards, what you find easy and hard, and what helps you learn. Nothing about your home, your health, or anything else about you belongs here.

It has four parts, and no free-text box for anything else:

• What you want to get to
• What you are already good at
• What you are working at
• What helps you learn

Alongside it we store what you are studying: the subject, the level, the exam board, and the grade you are working at and aiming for.

• Who can read it: the tutor who wrote it, you, and whoever looks after your lessons. Nobody else can, including other tutors and other students. A tutor sees only their own; a second tutor starts from nothing.
• Our AI suggests changes to it after a lesson, from the report your tutor has just written; the report is sent to OpenAI in the United States for that, only while the profile is switched on, and never with your name. Your tutor reads every suggestion and decides whether to accept it, change it first, or throw it away. Nothing an AI writes about you reaches you, or whoever looks after your lessons, until a person has agreed with it.
• It is never used to train anything. That is not a setting; it is the same commitment as everything else that happens in a lesson.
• You can turn it off at any time, and so can whoever looks after your lessons, on your learning profile page. Turning it off deletes what every tutor has written (it does not just hide it), and tutors cannot keep one after that.
• If they turn it off and you did not, we tell you, by email at the time, and it says so on your learning profile page afterwards. You can turn it back on yourself.

Your tutor also asks us to suggest a plan for a lesson, using this, their own notes from recent lessons, and how you are doing on your practice questions on cookie. A plan is their preparation and is not shown to anybody else.

• Anyone, including people who are not signed in: a verified tutor's public profile, their subjects, rate, availability, star rating, hours taught, and student reviews shown under a shortened name. That profile includes the university and degree from their approved application (with its result, once the degree is finished), and their A-level (or equivalent) subjects and grades; the tutor is told this before they enter them.
• Your tutor, or your student: your name, your lessons together, and your conversation.
• Nobody but us: a tutor's application, CV, GCSE grades, predicted degree results, certificate copies, DBS details and right-to-work record. These are not readable by students, by other tutors, or by anyone browsing the site; the database itself refuses those columns, as well as the page.
• Past papers: if a student shares a past paper with you, or you set them one, you can see their marks, time and grade for it, and their writing only if they chose to include it. You see it on cookie, over your own copy of the paper.
• Notes: notes a tutor sends a student are copied into the student's notes on cookie, with their pictures, drawings and widgets. A parent, guardian or sponsor who reads the student's messages can read those notes too, pictures included, on their Sponsees page. Notes a student shares with a tutor can be read by that tutor, and put on the whiteboard in a lesson, until the student stops sharing them.
• A tutor's shared resources: a tutor can choose to list, on their public profile, the notes, flashcards and question decks they share publicly on cookie under their own name. Anything they share anonymously is never listed.
• Reports you make are visible only to us. The person you reported is not told who reported them.

We use a small number of processors, each for one job:

• Supabase: database, authentication and file storage (EU region).
• Vercel: hosting this website.
• Fly.io: the video and whiteboard servers, which we run ourselves in London. Live video and whiteboard strokes pass through them; they are not stored there.
• OpenAI (United States): through the AI service we run ourselves at ai.cookie.education, for the AI features on this site: suggesting a lesson plan to your tutor, suggesting changes to a learning profile, helping a tutor draft a lesson report they then edit, suggesting tutors when you ask, and the assistant. What is sent for the first four never includes a name or an email address; the assistant sends what is on the page you asked from, which can include a name. OpenAI does not train on it and keeps it for up to 30 days to check for abuse. If we ever switch to a different provider, this page will say so first.
• Stripe: card payments and tutor payouts. Stripe is the data controller for your card details. For a tutor's identity check, Stripe and we are each an independent controller of the check.
• Vouchsafe (Interrobang Limited): the digital right-to-work check for a tutor who teaches from the UK with a British or Irish passport: a photo of the passport and a video selfie, which it compares with the passport photo. They carry out the check for us and we keep the result as our record.
• Resend: sending the emails this service generates. Its logs of what was sent, including the address it went to, are held in the United States.
• Umami: cookieless analytics that tells us which pages are visited and which buttons on them are pressed, in aggregate. It sets no cookie, does not follow you to other sites, and cannot pick you out as an individual. Its only purpose is statistics about how the site is used so we can improve it; it is shared with nobody but Umami acting for us, and Umami keeps those statistics in the EU. It is the same tool cookie.education uses. You can turn it off here for this browser, free, whether or not you are signed in:

We do not sell your data. If we are ever legally required to disclose something, or need to disclose it to protect a child, we will. In practice that means the police, or a local authority's designated officer or children's services, when a child may be at risk; the Disclosure and Barring Service, when the law requires us to refer a tutor we have removed; the National Crime Agency, which the Online Safety Act requires us to tell about child sexual abuse material; and HMRC or a court when the law requires it. Stripe decides for itself how it uses what it receives, under its own policy; everyone else on this list acts only on our instructions.

Nothing that happens in a lesson is used to train anything: not the whiteboard, not the messages, and not a recording or transcript if we ever add them. That could only change for people who agree to it separately, asked on its own and never as a condition of having lessons, and never for a lesson with anyone under 18 in it. If we ever ask, we will say so on this page before it starts, not after.

We use your corrections to our AI’s output (telling us a mark was wrong, putting a question in a better topic, correcting something we generated) to make that AI better. We never use your uploaded source material or your notes, we never use anything from a lesson unless you have separately agreed to that, and we never use anything that identifies you. You can turn this off at any time, and turning it off does not reduce the service.

Your source material is never used to train anything, whether you turn the setting above on or off. That is not a default we might change: past papers, textbook scans and specifications belong to the people who wrote them, and your notes are yours.

In practice almost nothing on this site produces one of those corrections today, because the AI features live on cookie. The one that matters is a tutor correcting a mark our AI gave their student, which is a real subject expert saying what the right answer was. That is the single most useful thing anyone can tell us, and it is also just a tutor doing their job.

The setting for this lives in your account on cookie.education, because it is one account across both products.

We set two, and no advertising or tracking cookies at all:

• A session cookie, so you stay signed in. It is scoped to cookie.education and its subdomains, which is how one sign-in covers both products. Strictly necessary: the site cannot work without it.
• A referral cookie, set only if you arrive through someone's referral link and press “Use it”; arriving alone stores nothing. It records which code you came from for 30 days so that the credit you followed the link for can be applied to your first lesson, and is cleared once that happens. It is used for nothing else and is not sent to anybody.

There is no cookie banner because there is nothing here to consent to or refuse beyond these two.

Primarily in the EU (Supabase, Ireland) and the UK (our video and whiteboard servers, London). Some processors (OpenAI, Vercel, Stripe, Resend) are US-based. Where data goes to the United States it does so under the UK International Data Transfer Addendum to the EU standard contractual clauses, or under the UK Extension to the EU–US Data Privacy Framework where the provider is certified, and we have assessed the risk of those transfers. Supabase's support staff can also reach our database from the United States when they need to keep it running. You can ask us for a copy of the safeguards we rely on.

• Your account: until you delete it.
• What you told us you are looking for: until you change it or delete your account, whichever comes first. There is no separate window because there is nothing here anyone would need to look back at; it goes with the account.
• Messages: up to three years after the first person in the conversation closes their account (see above), then deleted for good. The lesson times suggested and agreed in a conversation are kept with it, for the same time.
• An invitation you sent to a parent, guardian or sponsor: with your account, and deleted when it is. The link in it stops working after 14 days.
• Lesson and payment records: six years after the end of the tax year they fall in, which is what UK tax record-keeping requires, plus a short margin.
• Your learning profile: 365 days after your last lesson with that tutor, then deleted. Sooner if you turn it off, which deletes it straight away.
• A lesson plan your tutor asked us to suggest: 365 days after the lesson, then deleted.
• Tutor application material, including DBS details: for as long as the tutor is active, and up to three years after they stop, so we can answer a later safeguarding question. The application, its documents and the DBS record are cleared automatically when that time is up; we keep only that an application was made and what was decided.
• A record of action we took about somebody, and any referral we decided on: ten years for anything to do with a child's safety (every suspension or removal, anything linked to a safeguarding report, and every decision about referring somebody to the DBS, a LADO or the police), and three years for anything else, then deleted. We chose these periods and a solicitor has not yet confirmed them.
• The DBS certificate image itself: deleted the moment a person has decided on it. We keep the certificate number, its issue date, the kind of check and what we decided; we do not keep the document. That is what the DBS handling guidance asks for, and it means a question about whether somebody was checked can still be answered years later without us holding a copy of their criminal record check. A certificate that was uploaded and never decided on is deleted 180 days after it was uploaded.
• A tutor's right-to-work record: for as long as they are listed and two years afterwards, which is what the Home Office requires, then destroyed. A share code and date of birth given for the online check are deleted as soon as the check is recorded.
• Identity check results: the same window as the rest of a tutor's application, and for the same reason: a question about whether somebody was properly checked is asked after the fact or not at all. What we hold is a few words: passed or not, which kind of document, and any failure reason. The photographs are Stripe's and are governed by their retention, not ours, because we never hold them in the first place.
• Reports: three years, so a pattern of behaviour is visible rather than resetting each time. A report outlives both the person who made it and the person it is about; one we haven't finished looking into is kept until we have, however long that takes.
• Lesson reports: three years after the lesson, then deleted. After each lesson the tutor writes a short note (what was covered, what went well, what is next) which the student and whoever looks after their lessons can read. Three years matches how long messages are kept, because the two are read together.
• Pages brought into a lesson: 365 days after the lesson, then the file is deleted. Shorter than the windows above it because it is a working document rather than a record of what happened: its value is being able to look back at what was marked up, which is an academic year at most.
• Whiteboard snapshots: 365 days after the lesson, then the image is deleted. The same window as the pages above, because a snapshot is the other half of the same thing: the page goes on the board, you both write on it, and the snapshot is what that looked like when you stopped.
• Emails you send us: up to six years, then deleted automatically. Anything about a child's safety is kept for ten years, and anything the tax rules make us keep follows those rules.
• Waitlist requests: 365 days, then deleted, whether or not we ever found you a tutor and whether or not you unsubscribed. We use that address for exactly one email, the one saying a tutor is available, and there is a one-click unsubscribe link in it that needs no account and no password. It is not a mailing list and we do not have one.
• Profile views: 90 days, then deleted. We count how many signed-in people opened a tutor's public profile, so the tutor can see whether anyone is looking. We do not count or identify visitors who are not signed in, and we do not store your IP address to do it.

Your account is shared with cookie, so deleting it deletes both. You can start from your account page, which shows anything still outstanding on this side first (a lesson still booked, earnings not yet transferred) and then hands over to cookie, where the account itself lives. Or email support@cookie.education and we will do it. What we keep afterwards is exactly what the list above says, and nothing else: the financial records the law requires; your messages, any lesson reports and any report about you, with your name detached, for the periods above; and, if you were a tutor, the record that we checked you and what we decided. Lesson documents you brought into a lesson are deleted with your account, unless one was taken down after a report, which is kept as evidence for the report's period; whiteboard snapshots are the shared board from a lesson with somebody else, so they keep their own 365-day window. Everything else goes. We will tell you at the time what has been kept and why.

A child under 13 cannot sign themselves up. They can have an account only when a parent or guardian creates one for them, confirming they hold parental responsibility for that child and agreeing to the terms on their behalf. We record who did that and when; that record is what makes the account lawful, so we keep it for as long as the account exists. The child is never asked to agree to anything, and we never send account email to them. The adult sets their password and can change it or close the account at any time. The child signs in with that email address and password only; we don't allow a Google sign-in to be joined to an account set up this way.

Many students here are under 18, and that shapes the whole service rather than being a footnote. Anyone 13 or over can create their own account without a parent or guardian. Under 16, a parent, guardian or sponsor aged 18 or over agrees to the terms and books and pays for lessons, from an account of their own that is separate from the student's; from 16 a student may arrange and pay for their own, and is still treated as under 18 in everything else here. Tutors are DBS-checked before they can be listed; conversations are retained so a concern can be looked into; and referral rewards are arranged with a parent rather than offered to a child directly.

If you are the student, you are told, inside every conversation, that the adult who looks after your lessons can read it; it is not something that happens behind your back. If you are under 13, the adult who set up your account is the person who agreed to this on your behalf.

A parent or guardian can ask us for a copy of their child's data, or ask us to delete it, on the same terms as anyone else. See Safeguarding for what to do if you are worried about something.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to our processing it, ask us to restrict it, or ask for the data you gave us in a form you can take elsewhere. You can download a copy of your data as JSON from your account page at any time; for anything else, email us and we will respond within one month.

You can complain to us about how we handle your data, using the complaint form or by email. We acknowledge a complaint within 30 days and answer it as quickly as we can. If you are not satisfied, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Nothing on this site makes a decision about you by software alone that has a legal or similarly significant effect. Whether a tutor is listed, whether a report is upheld and whether an account is suspended are each decided by a person. Where an AI is involved (a suggested lesson plan, a suggested change to a learning profile, a draft of a lesson report), a named tutor reads it and decides, and nothing it writes about you reaches you or your family until they have. Suggested tutors and the assistant only suggest: you choose whether to contact a tutor, and the assistant changes nothing until you confirm it.

The practice marks and predicted grades a lesson plan draws on come from cookie, where they are produced by an AI and described in cookie's own policy, including how to challenge a mark.

The date at the top says when this last changed. If we start doing something materially different with your data, recording lessons for instance, we will tell you before it starts, not after.

support@cookie.education