The privacy boundary

TutorCat staff never see what children write or upload. Not their homework messages, not their wellbeing notes, not their photos or voice, not the tutor's replies. This is built into the server: an admin account has no access to student data at all. There is no switch to change it, and no screen in the console that could show it.

#What admins can see

• Counts and totals: accounts, sessions, active students, consent rates, tokens, cost, safety events.
• AI usage records: for each AI call, which account it was for (shown by email and role only), the model, the job, the tokens and the cost. See below.
• Account details: email, role, plan, number of profiles, created date, suspended or active.
• Feedback notes that a family chose to send to the team, after being told the team reads them.
• Payments: the paying account's email, the package and the amount.
• The audit log of admin changes.

#What admins cannot see

• A student's homework conversations, steps or answers.
• Photos of worksheets, voice recordings or transcripts.
• Session summaries, portfolio, wellbeing check-ins or notes.
• The content of any safety event. Safety events are shown as a count only.
• A feedback note's link to a session. There is none.
• The content of any AI call. Usage records hold no question, answer, photo or voice.

Parents see their own child's sessions in the parent area, except when a child tells us someone is hurting them, which stays private to keep them safe. Other serious concerns, such as self-harm, do alert parents.

#AI usage records and OpenRouter

Costs shows what each account spent, so each usage record is linked to the student, or to the parent for a session summary. That link is metadata only: the account, the model, the job, tokens, cost and timing. Message content is never in it. The console shows the account's email and role, never a child's name. If a family is erased, the link is removed and the spending stays only as an anonymous total. See Costs.

Some AI jobs go through OpenRouter, a service that reaches many models with one key. Every request to it asks for zero data retention and no training on the data, and goes only to endpoints that promise both. A request is never sent without those protections. See Models.

#What this means day to day

• A bug report about a conversation. Ask the parent for a screenshot from their parent dashboard. Reproduce it in a test account with the same grade and question.
• A safety alert. Never try to read the child's content or look up the individual event. Confirm from the counts that it was recorded. The child was shown helplines straight away, and linked parents were emailed (in some rare cases the child is shown support contacts only).
• A parent calls about an alert. Listen first. Do not ask for details of the child's messages. Point them to the helplines the child was shown.
• Reasons and notes. Never write a family's email, a child's name or anything a child wrote into an audit reason, a ticket or your recruiting sheet.