Privacy Policy

Cognify Tutors is a tuition matching service operating in Singapore. We connect parents with private tutors, and we are responsible for the personal data described below. This policy explains what we collect, why, who sees it, and what you can ask us to do about it.

To be confirmed: Your registered business name, UEN, and a contact address for data protection enquiries. Singapore's PDPA also requires a named Data Protection Officer with working contact details — a person's name and a monitored email address, both of which need to appear in this section.

If you request a tutor: your child's level and subjects, when they're free, your preferred lesson format and frequency, your postal code or town, your budget, your tutor preferences, and any notes you add. If you create an account we also hold your name and email address. If you use our Telegram bot we hold the contact name and number you give it.

If you apply as a tutor: your name, age, gender, contact number, email address, education and institution, academic results, teaching experience and style, the levels and subjects you teach, the areas you travel to, your availability and your rate.

If you create an account: your name and email, plus either a password (stored only as a salted hash — we never see or store the password itself) or, if you sign in with Google, the name, email address and profile picture Google provides.

If you message us on WhatsApp: the number you message from and what you send us.

Automatically: a one-way hash of your IP address when you submit a request, used solely to stop the form being abused. We do not store the address itself, and the hash cannot be reversed to identify you.

If you give us someone else's personal data — a spouse's number, a referee's contact — please make sure they're happy for you to do that first.

To match parents with suitable tutors, to let you sign in and manage what you've submitted, to make introductions once both sides are matched, and to invoice and collect our commission. Tutor screening information is used to decide whether to award a verified badge.

We also use it to investigate misuse of the service and to meet our legal and tax obligations.

We do not use your data for advertising, and we do not sell it to anyone.

Contact details are never shown on the website. Parents browsing their matches see a tutor's name, qualifications, experience, subjects, availability, general areas and rate — but never their phone number or email. Tutors viewing assignments see the general area of a request, never the postal code or address.

Contact details are shared only when a match is confirmed by our team, and then only with the two parties involved.

When you submit a request, we post the assignment to our public Telegram channel so tutors can find it. That post contains: the student's level and subjects, the general area (your town or district — never your postal code or address), whether you want home or online lessons, the times you said the student is free, lesson length and frequency, your budget range, and your tutor preferences.

Your name, phone number and email are never posted. If you type contact details into the notes box, we automatically strip out anything that looks like a phone number, email address, web link or messaging handle before the post goes out — but please don't put them there in the first place.

Anyone can read the channel, including people who aren't registered tutors. If you'd rather your assignment weren't posted publicly, tell us when you submit it and we'll match you privately instead.

We use Vercel Analytics and Speed Insights to count page views and measure how fast pages load. These don't use cookies and don't follow you across other websites, which is why you won't see a cookie banner here. We see aggregate figures — which pages are visited and how quickly they load — not individual browsing histories.

The only cookie we set is the one that keeps you signed in.

We use a small number of service providers to run the site: Vercel (hosting and analytics), Neon (database), Resend (email delivery), Telegram (the assignments channel and bot) and Google (only if you choose to sign in with Google). They process data on our behalf and are not permitted to use it for their own purposes.

Some of these providers store or process data outside Singapore. Where that happens we rely on their contractual data protection commitments to keep your data protected to a standard comparable to the PDPA. Telegram is the exception worth naming plainly: anything posted to the public channel is public, and is hosted on Telegram's infrastructure outside Singapore.

We may also disclose personal data where the law requires it, to a law enforcement or regulatory authority acting within its powers, or where it's necessary to protect someone's safety. If Cognify is ever sold or merged, records may transfer to the new owner, who would be bound by this policy.

We'll email or message you about your own request, your application, and matches — that's the service working, and you can't opt out of it while your request or application is active.

We'll only send you marketing — new features, tips, promotions — if you've agreed to it, and every message will have a way to stop them. You can also tell us to stop at any time on WhatsApp. We comply with Singapore's Do Not Call rules and don't send unsolicited messages to numbers we haven't obtained directly from you.

Requests: while the request is open, and for 12 months after it's closed, matched or withdrawn.

Tutor applications and accounts: while the account is active, and for 24 months after your last sign-in.

Records of completed introductions and commission: 5 years, because Singapore tax rules require us to keep business records for that long. These are kept even if you ask us to delete everything else.

Telegram channel posts: assignment posts stay on the channel unless we remove them. Ask us and we'll delete the post for your assignment.

Data is held in a managed database with encrypted connections, and access is limited to the people who need it to run the service. Passwords are stored only as salted hashes. Contact details are kept out of every page the public can reach, enforced in the code itself rather than by remembering to be careful.

No system is perfectly secure, but if a breach happens that's likely to cause you significant harm, we'll notify you and the Personal Data Protection Commission as the PDPA requires.

You may ask us what personal data we hold about you, ask us to correct anything inaccurate, or withdraw your consent and ask us to delete it. Withdrawing consent means we can no longer match you.

Tutors can edit their own application at any time from their dashboard, and parents can close a request so it stops being shown to tutors.

Tutors can delete their application and account from their dashboard, and parents can delete a request from its page — that removes the data immediately, without waiting on us.

For anything else, message us on WhatsApp at 6058 0267. We'll respond to access and correction requests within 30 days, and tell you sooner if it's going to take longer than that.

To be confirmed: A monitored email address for formal data-protection requests. WhatsApp alone is usually not considered sufficient for a written PDPA request, so this needs to be a real inbox someone checks.

Requests describe a child's education level and subjects, but we ask parents not to include their child's full name or any other identifying detail. The account holder is the parent or guardian, not the child, and it's the parent who consents to what we do with this information.

If we change this policy we'll update the date at the top, and tell account holders by email if the change is a significant one. See also our Terms of Service.