Privacy Policy

Tutype is run by the person or organisation that operates this Tutype service ("Tutype", "we", "us"). For accounts people create for themselves, we decide how their information is used and are the data controller.

When a school, teacher or other organisation sets up classes or student accounts, that organisation decides how its learners' information is used and is the controller of that information. We process it on the school's behalf and on its instructions, as its processor. Questions about how a school uses its reports should go to the school first.

You can reach us about privacy at the Contact page.

Practice without an account. Progress and preferences are stored in your browser's local storage on your own device, not on our servers. This includes lesson results, key mastery, practice history, tests, placement, streaks, game progress and settings.

Information you give us.

• Account details: your email address and display name, or for Google or GitHub sign-in, the basic profile details those services share (name, email and profile picture) and a connection identifier.
• School accounts: a name, username and PIN set by the school. We store the PIN only as a one-way hash.
• Classroom information: school and class names, class membership, assignments, excused work and private notes teachers write about learners.
• Reminder settings: whether reminders are on, your chosen hour and time zone.
• AI requests: the prompts, passages and writing you choose to send to an optional AI feature.
• Shared results: the result or certificate details you choose to publish as a link.
• Messages you send us, such as support emails.

Information created as you practise. When you are signed in, we save practice measurements such as accuracy, speed, timing, key counts, dates and skill summaries so your progress follows you between devices and your teacher can see it. Progress sync does not send the full text you type during ordinary practice.

Technical information. Like every website, our servers and hosting provider receive your IP address, browser type and the pages requested. We use IP addresses, email addresses and account identifiers to limit repeated requests and protect accounts. If error monitoring is turned on, we receive error reports and sampled performance data with default personal information collection switched off and no session recording.

We do not ask for, and you should not send us, sensitive information such as health details, government identity numbers, financial details or passwords for other services.

• To provide the service you asked for: signing you in, saving and syncing progress, running classes, assignments and reports, sending sign-in codes and creating share links. This is necessary to perform our agreement with you, or with your school.
• To keep the service secure and working: rate limits, preventing abuse, fixing errors and keeping records of administrative actions in a school. This is our legitimate interest in running a safe, reliable service.
• To send optional practice reminders and run optional AI features. We rely on your choice to turn these on, and you can turn them off at any time.
• To comply with the law, respond to lawful requests and protect our rights. This is our legal obligation or legitimate interest.

We do not sell personal information. We do not share it for advertising. We do not show ads, use advertising trackers or build marketing profiles. We do not use your practice data or writing to train AI models, and we do not make decisions that have legal or similarly significant effects about anyone by automated means alone. Practice recommendations, such as which lesson to try next, only suggest what to practise.

Tutype is built for learners of all ages, including children. We take extra care with children's information and collect only what the learning features need.

• Children can practise without an account. Their progress then stays on their own device.
• A child who has not reached the age at which they can consent to online services where they live (for example, under 18 in Kenya, under 13 in the United States, and between 13 and 16 in the European Union and United Kingdom depending on the country) must only create a personal account with the permission and supervision of a parent or guardian.
• For school accounts, the school creates the account and is responsible for having the authority and any consent from parents or guardians that the law requires before giving us a learner's information. We use that information only to provide Tutype to the school, never for advertising or any purpose of our own.
• Students cannot see other students' records, cannot publish profiles and cannot message other users through Tutype.

Parents and guardians can ask to review or delete their child's information, or stop further collection. For a school account, please ask the school, which controls that account; we will help the school respond. If we learn we have collected a child's information without required consent, we will delete it. Contact us at the Contact page.

Teachers can see learners in the classes they teach; school administrators can see learners across their school. Classroom reports show practice attempts, dates, activity, speed, accuracy, time spent and skill summaries from the date the learner joined the class. Teachers can write private notes that the learner does not see. Schools can export reports and manage, reset or remove student accounts.

Classroom attempts are removed automatically after the school's retention period, which is about three years unless the school or operator sets another period. Once a school exports a report, that copy is the school's responsibility.

We share personal information only as described here:

• Service providers who run parts of Tutype for us under contracts that limit their use of the information to providing their service: our hosting provider; Neon (database); Resend (sign-in and reminder emails); Google (Gemini AI features and, when used, Google sign-in); GitHub (sign-in, when used); and Sentry (error monitoring, when turned on).
• Your school, if you use a school account or join a class, as described in section 5.
• Anyone with a share link you create. A shared result or certificate is public to anyone who has the link until you remove it or your account is deleted.
• Legal and safety reasons, when we believe in good faith that the law requires it, or to protect the safety, rights or property of users, the public or us.
• A change of ownership, if Tutype is reorganised, merged or transferred. The new operator must keep honouring this policy for information already collected, or give notice and a chance to delete it.

AI features only run when a signed-in user asks for them. Requesting a passage sends your prompt to Google Gemini through our server. Extending a passage also sends the existing passage. Drafting or improving a practical task sends your request, the task and your current response. AI review sends your response and the task text. We do not keep a separate copy of AI prompts or responses on our servers.

Google processes these requests under its own service terms. AI output can be wrong, so check it before relying on it. Do not include personal, confidential or sensitive details in AI requests.

Our service providers may store and process information in countries other than yours, including the United States and the European Union, where data protection laws can differ. When we transfer personal information across borders, we rely on safeguards the law recognises, such as the provider's contractual commitments and standard contractual clauses, and we only use providers that protect information to a standard consistent with this policy.

• Account and synced progress: while your account exists. When an account is deleted, its progress, sessions, sign-in connections, reminders and share links are deleted with it.
• Classroom attempts: until the school's retention period ends (about three years by default) or the school removes the student or class.
• Sign-in codes: stored as hashes and expire within minutes. Rate limit counters: deleted shortly after their time window ends.
• Error reports and hosting logs: kept for the limited periods set by those providers.
• Support messages: as long as needed to help you and keep a record of the request.
• Backups: deleted information can remain in encrypted backups for a limited period before it is overwritten.

We may keep information longer only where the law requires it or to resolve a dispute.

We use encrypted connections (HTTPS), store sign-in codes, PINs and invite links only as one-way hashes, limit repeated sign-in attempts, keep AI keys on the server and restrict classroom data to the teachers and administrators responsible for those learners. No method of storing or sending information is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

Depending on where you live, including under Kenya's Data Protection Act 2019, the EU and UK GDPR and United States state privacy laws, you may have the right to:

• be told how your information is used, which is what this policy does;
• get a copy of your information;
• correct information that is wrong;
• have your information deleted;
• object to or restrict certain uses;
• receive your information in a portable format;
• withdraw consent you have given, without affecting earlier processing; and
• complain to a data protection authority, such as the Office of the Data Protection Commissioner in Kenya or the authority where you live.

You can download your account data at any time from the account menu (Download my data). Turn reminders off in Settings or through any reminder email. For anything else, including account deletion, contact us at the Contact page. School-managed learners should ask their teacher or school administrator. We may need to confirm your identity before acting, and we will respond within the time the law allows. We will not treat you differently for using your rights.

Deleting information in Tutype does not recall copies others have already downloaded, such as a school's exported reports, or information a third party already holds.

We use only the cookies and browser storage needed for Tutype to work, such as keeping you signed in and saving your progress on your device. We do not use advertising or cross-site tracking cookies. See the Cookie Policy for details.

We may update this policy as Tutype changes or the law requires. We will change the date at the top of this page and, for significant changes, give notice in the app or by email before they take effect. If a change would use information already collected in a materially different way, we will ask for consent where the law requires it.

For any privacy question, request or complaint, contact us at the Contact page. Please do not send PINs, sign-in codes or passwords.