Privacy Policy · Teach for a Cause

Teach for a Cause is run by students and volunteers, and most of the people we serve are minors. We collect as little as we can, never sell it, and never use it for advertising. This policy explains exactly what we collect and why.

Children’s privacy

Accounts for middle school Students (who may be under 13) are created by a parent or guardian, not by the Student. If a Student tries to sign up, we ask only for their first name, their parent’s email address and, if they choose, a short note to their parent. We use them once to email the parent an invitation, and delete them after 14 days (or as soon as the parent signs up).

A parent verifies their email address with a code we send, adds their child, and signs the consent form. Until then, the Student’s information is not shown to any Tutor, and no lessons or messages can happen.
We never ask a Student for a phone number, home address, photo, last name, or birth date.
A parent or guardian can see their child’s profile, lessons, and messages; withdraw consent; report a concern; or ask us to review, correct, or delete information by contacting chouksey.arnav@gmail.com. Parents of older Student accounts created before these changes can also use their private link, and can request a new one on the parents page.

Tutors are high school students. Each Tutor gives a parent or guardian’s contact information, and that parent or guardian must approve before the Tutor can teach.

What we collect

Student and parent accounts

If a Student asks us to invite their parent: the Student’s first name, the parent’s email, and any short note the Student adds for their parent (all deleted within 14 days).
For a parent account: parent/guardian name, email address, and phone number (so you can be reached during lessons).
For each Student: first name, grade, optional school and county, instruments and experience level, learning goals, musical interests, learning preferences, and weekly availability. We do not ask for a Student’s last name, photo, or birth date.
The signed consent form: guardian name, relationship, phone, typed signature, date, and browser information.
If a Student chooses to copy a link for their parent instead: the Student’s first name and any short note (deleted within 14 days, like an emailed invitation).

Waitlist and contact form (no account needed)

Added October 7, 2026. Our two public forms collect only what they need, and nothing from either is shared with Tutors or other families.

Waitlist: an email address and what you’re waiting for (an instrument, a state, or a grade). We email you once, when it changes, and delete the address 30 days after that email, or after 18 months if it never changes. Every email has a link that deletes your address from every list. We ask for a parent’s or guardian’s email, not a child’s.
Contact form: your name, email, optional role, and message, plus your account if you’re signed in. Only Program administrators read it, and we use your email only to reply. Messages are deleted a year after they’re handled; reports of concerns are kept until an administrator deletes them.
To stop abuse, both forms keep a one-way hash of your IP address, never the address itself.

Tutor accounts

Name, email, grade, optional school, county, short bio, and optional profile photo.
Instruments, self-reported skill and ensemble information, teaching preferences, availability, and Google Meet link.
Parent/guardian name, email, and optional phone; signed tutor agreement; the parent’s approval (typed name, relationship, date and browser information).

Program activity

Lesson requests, lesson offers, schedules (including weekly series), lesson logs and practice notes, confirmations, hour verifications, when each side confirmed a parent was nearby before joining, and which instruments a family asked to be told about when a Tutor becomes available.
Messages sent through the Program, the results of automated safety checks on them, and any reports submitted.
For Tutors: the results of the automated account check (each check’s outcome, a risk score, and short quotes of what triggered it), kept for 180 days, plus the latest result. Tutors see their status and any profile fixes they can make; only Program administrators see the full results.
Each Student’s or parent’s answer to “was the Tutor there?”, with the time and their confirmation that it’s truthful, and each Tutor’s confirmation that their lesson log is truthful.
A security log of account events such as sign-ins, sign-outs, password resets, and consent changes.
A random identifier stored in a cookie on each device you sign in from, with a short description such as “Chrome on Mac,” so we can email you when your account is used on a new device. We keep up to 20 per account.
If you turn on notifications for a device: the address your browser’s push service gives us for that device (up to 10 per account). We delete it when you turn notifications off or sign out on that device.
Basic technical logs kept by our hosting providers for security and reliability.

We never record lessons and never collect audio or video of lessons. We do not collect payment information of any kind.

Who can see what

Students and parents see active Tutors’ first name and last initial, grade, school, county, bio, photo, instruments, teaching preferences, and availability. They never see a Tutor’s email, phone, or parent’s information. A Tutor’s Google Meet link is shown only from 15 minutes before a booked lesson until 15 minutes after it ends.
Tutors can see Students whose parent or guardian has signed consent: first name, grade, county, instruments, level, goals, interests, learning preferences, and availability, so they can offer lessons. For a Student they are connected with, they also see the parent’s first name (for parent accounts). Tutors never see a Student’s or parent’s email, phone number, school, or last name.
Nonprofit partner reviewers see lesson records needed to verify hours (Tutor name, school, grade, Student first name, instrument, dates, and confirmations).
Anyone a Tutor gives their hours-verification link to (for example, a school advisor) sees the Tutor’s name, grade, school, instruments, and verified totals, never Students’ names or messages. The Tutor can turn the link off at any time.
Program administrators can see account and lesson information and messages to run the Program, verify hours, and investigate reports.

How we use information

To match Students with Tutors and schedule lessons.
To send transactional emails (requests, confirmations, reminders, security alerts, and safety notices), a weekly lesson summary to parents (which parents can turn off), and, if you turn them on, device notifications for the same events. Notifications never include message text.
To protect accounts: when you choose a password, we check it against a public list of passwords exposed in data breaches. Only the first five characters of a one-way hash of it leave our server, never the password itself.
To verify volunteer hours and produce hour records for Tutors.
To keep participants safe, including filtering messages, running automated safety checks, and investigating reports. Our safety checks run on our own systems using fixed rules; message contents are never sent to an artificial-intelligence or other outside analysis service.
To decide automatically whether a Tutor’s account can be shown to Students (the account check described in section 8 of the Terms). It uses the same fixed rules on our own systems. Accounts it doesn’t clear are reviewed by a person, and anyone can ask for a person to review a decision about their account.

We do not sell or rent personal information, and we do not use it for advertising or marketing.

Service providers

We use a small number of providers who process data on our behalf:

Supabase — database, authentication, and file storage (United States region).
Vercel — website hosting.
Our email provider (Brevo, or Google’s Gmail during testing) — delivery of transactional emails.
Browser push services (Google, Apple, Mozilla, or Microsoft, depending on your browser) — delivery of notifications, only if you turn them on. The notification content is encrypted so that the push service can’t read it.
Have I Been Pwned — the breached-password check described above (it receives only a partial hash).
Google — lessons take place on Google Meet under Google’s own terms and privacy policy.

We may also disclose information if required by law or to protect someone’s safety.

Donations

Donations are made directly on our partner nonprofit’s website. We do not receive, see, or store any donation or payment information.

Security

Data is encrypted in transit. Access to every record is restricted by database-level rules so users can only see what their role requires. Administrators must sign in with a second factor. No system is perfectly secure; please use a strong, unique password.

Retention and deletion

We keep account and lesson records while an account is active so hours can be verified and reported. You can ask us to delete your account and associated information at any time by contacting chouksey.arnav@gmail.com. Invitations a Student asked us to send their parent are deleted after 14 days. When an account with lesson history is deleted, we remove the person’s name, contact details, profile, and messages, but keep a de-identified lesson record so that a Tutor’s verified volunteer hours remain valid. We may keep limited records where needed for safety investigations or legal obligations.

Changes and contact

We will post any changes here with a new effective date. Questions or requests: chouksey.arnav@gmail.com.