Privacy Policy

Cognify Tutors is a tuition matching service operating in Singapore. We connect parents with private tutors, and we are responsible for the personal data described below. This policy explains what we collect, why, who sees it, and what you can ask us to do about it.

Cognify Tutors is operated by WAHA COMM, a business registered in Singapore under UEN 53447814W. Where this policy says “we” or “us”, that is who it means.

Our Data Protection Officer looks after your personal data and answers questions about it. Reach them at cognifytuition.sg@gmail.com, or on WhatsApp at 6058 0267. Use the email address for anything formal, like asking for a copy of your data or asking us to delete it, so both of us have it in writing.

If you request a tutor: your child's level and subjects, when they're free, your preferred lesson format and frequency, your postal code or town, your budget, your tutor preferences, and any notes you add. On the last step we ask for your name, mobile number and email address, so we can send you matches and confirm an introduction. If you use our Telegram bot we hold the contact name and number you give it there instead.

If you apply as a tutor: your name, age, gender, contact number, email address, education and institution, academic results, teaching experience and style, the levels and subjects you teach, the areas you travel to, your availability and your rate. You may also add a profile photo, which is optional. It is resized in your browser before it reaches us, so the original file and any location information saved inside it never leave your device.

If you create an account: your name and email, plus either a password (stored only as a salted hash, so we never see or store the password itself) or, if you sign in with Google, the name, email address and profile picture Google provides.

If you message us on WhatsApp: the number you message from and what you send us.

Automatically: a one-way hash of your IP address when you submit a request, used solely to stop the form being abused. We do not store the address itself, and the hash cannot be reversed to identify you.

If you give us someone else's personal data, such as a spouse's number or a referee's contact, please make sure they're happy for you to do that first.

To match parents with suitable tutors, to let you sign in and manage what you've submitted, to make introductions once both sides are matched. Tutor screening information is used to decide whether to award a verified badge.

We also use it to investigate misuse of the service and to meet our legal and tax obligations.

We do not use your data for advertising, and we do not sell it to anyone.

Contact details are never shown on the website. Parents browsing their matches see a tutor's name, profile photo if they added one, qualifications, experience, subjects, availability, general areas and rate, but never their phone number or email. Tutors viewing assignments see the general area of a request, never the postal code or address, and never the parent's name, number or email.

Contact details are shared only when a match is confirmed by our team, and then only with the two parties involved.

When you submit a request, we post the assignment to our public Telegram channel so tutors can find it. That post contains: the student's level and subjects, the general area (your town or district, never your postal code or address), whether you want home or online lessons, the times you said the student is free, lesson length and frequency, your budget range, and your tutor preferences.

Your name, phone number and email are never posted. If you type contact details into the notes box, we automatically strip out anything that looks like a phone number, email address, web link or messaging handle before the post goes out, but please don't put them there in the first place.

Anyone can read the channel, including people who aren't registered tutors. If you'd rather your assignment weren't posted publicly, tell us when you submit it and we'll match you privately instead.

We use Vercel Analytics and Speed Insights to count page views and measure how fast pages load. These don't use cookies and don't follow you across other websites, which is why you won't see a cookie banner here. We see aggregate figures (which pages are visited and how quickly they load), not individual browsing histories.

The cookies we do set are listed in the next section, and there are not many of them.

A cookie is a small file a website leaves in your browser so it can recognise you on your next page. We use as few as we can, and none for advertising.

Signing you in. If you create an account, we set a cookie so you stay signed in. It lasts 30 days, and signing out clears it. Signing in with Google also uses a short-lived cookie while you are handed between the two sites. Without these an account would not work, which is why they are set whether or not you agree to anything else.

Remembering your theme. Light or dark is kept in your browser's local storage, not a cookie. It never leaves your device.

What we don't use cookies for. No advertising cookies, no tracking pixels, nothing that follows you onto other sites. Our analytics are cookieless. We don't sell or share data with advertisers, and there is nothing to opt out of because we never opted you in.

You can clear or block cookies in your browser at any time. Blocking them stops you signing in; everything else, including sending a request, carries on working.

We use a small number of service providers to run the site: Vercel (hosting and analytics), Neon (the database), Google (email delivery through Gmail, and sign-in if you choose to use it) and Telegram (the assignments channel and bot). They process data on our behalf and are not permitted to use it for their own purposes.

Some of these providers store or process data outside Singapore. Where that happens we rely on their contractual data protection commitments to keep your data protected to a standard comparable to the PDPA. Telegram is the exception worth naming plainly: anything posted to the public channel is public, and is hosted on Telegram's infrastructure outside Singapore.

We may also disclose personal data where the law requires it, to a law enforcement or regulatory authority acting within its powers, or where it's necessary to protect someone's safety. If Cognify is ever sold or merged, records may transfer to the new owner, who would be bound by this policy.

We'll email or message you about your own request, your application, and matches. That's the service working, and you can't opt out of it while your request or application is active.

We'll only send you marketing (new features, tips, promotions) if you've agreed to it, and every message will have a way to stop them. You can also tell us to stop at any time on WhatsApp. We comply with Singapore's Do Not Call rules and don't send unsolicited messages to numbers we haven't obtained directly from you.

Requests: while the request is open, and for 12 months after it's closed, matched or withdrawn.

Tutor applications and accounts: while the account is active, and for 24 months after your last sign-in.

Records of completed introductions: 5 years. This is the record of who was introduced to whom, kept so we can answer questions about a past introduction, including a safety question raised long after the lessons ended. These are kept even if you ask us to delete everything else.

Telegram channel posts: assignment posts stay on the channel unless we remove them. Ask us and we'll delete the post for your assignment.

Data is held in a managed database with encrypted connections, and access is limited to the people who need it to run the service. Passwords are stored only as salted hashes. Contact details are kept out of every page the public can reach, enforced in the code itself rather than by remembering to be careful.

No system is perfectly secure, but if a breach happens that's likely to cause you significant harm, we'll notify you and the Personal Data Protection Commission as the PDPA requires.

You may ask us what personal data we hold about you, ask us to correct anything inaccurate, or withdraw your consent and ask us to delete it. Withdrawing consent means we can no longer match you.

Tutors can edit their own application at any time from their dashboard, and parents can close a request so it stops being shown to tutors.

Tutors can delete their application and account from their dashboard, and parents can delete a request from its page. That removes the data immediately, without waiting on us.

For anything else, message us on WhatsApp at 6058 0267. We'll respond to access and correction requests within 30 days, and tell you sooner if it's going to take longer than that.

For anything formal, write to our Data Protection Officer at cognifytuition.sg@gmail.com. Tell us what you want and which email address or number you used with us, and that is usually all we need to find you.

If you aren't happy with how we handled something, you can raise it with the Personal Data Protection Commission. We'd appreciate the chance to put it right first.

Requests describe a child's education level and subjects, but we ask parents not to include their child's full name or any other identifying detail. The account holder is the parent or guardian, not the child, and it's the parent who consents to what we do with this information.

If we change this policy we'll update the date at the top, and tell account holders by email if the change is a significant one. See also our Terms of Service.