Privacy Policy

Writing Tutor is a parent-managed writing practice service independently operated from China. The operator is the data controller for account, child-profile, writing, report, support, and product-usage information controlled by Writing Tutor. Children do not receive independent accounts. Waffo.com Limited acts separately as Merchant of Record for paid transactions.

• Parent account data: name, email address, password hash or Google sign-in data, email verification and password-reset records, profile settings, and avatar reference.
• Child profile data: child name, age, grade band, and writing level entered by the parent.
• Writing and learning data: assignments, topics, ideas, outlines, drafts, revisions, final essays, AI Coach conversations, feedback, scores, reports, strengths, challenges, and progress history.
• Usage and security data: plan and quota activity, session records, IP address, user agent, authentication cookies, and anti-abuse verification results.
• Subscription data: selected plan, billing cycle, subscription status, and provider customer, product, and subscription references. Writing Tutor does not store complete payment-card numbers.

• Authenticate the parent account and protect it from abuse.
• Create and maintain child writing projects, reports, and progress history.
• Provide parent-requested AI writing guidance without automatically replacing the child's work.
• Apply plan limits, operate subscriptions, provide support, and diagnose failures.
• Meet legal, security, fraud-prevention, accounting, and dispute obligations.

Depending on the information and location involved, processing is based on providing the requested service, the parent's consent or explicit choices, compliance with legal obligations, and legitimate interests such as account security, fraud prevention, service reliability, and support. Child-data processing that requires parental authorization is not based only on accepting the general Terms.

We use service providers only for defined product functions. The current service stack includes:

• Vercel for application hosting and delivery.
• Neon for structured application data.
• Cloudflare for Turnstile abuse protection and private R2 avatar storage.
• Google for optional account sign-in.
• Resend for account and service emails.
• Waffo Pancake / Waffo.com Limited as Merchant of Record for checkout, subscription management, tax handling, refunds, and payment disputes.
• Kids Web Services (KWS) to conduct adult or parent verification. KWS receives the parent contact and verification information needed for its process; Writing Tutor receives and stores the verification result, method, reference, location, and relevant timestamps rather than full identity-document or card data.
• OpenRouter and the selected GLM 5.2 processing endpoint, currently Z.ai or Novita to process the limited prompt, writing context, and output needed for a user-requested AI feature. Writing Tutor uses route-level zero-data-retention and data-collection controls where supported.

These providers may process information outside the parent's country, including in China, the United States, or other locations used by their infrastructure and subprocessors. Where applicable, we rely on provider contractual terms and available transfer mechanisms, limit the data sent to the function being requested, and use privacy or zero-data-retention settings where supported. Contact the privacy address below for current provider information relevant to a particular request.

Writing Tutor currently uses a necessary HTTP-only authentication cookie, Cloudflare Turnstile technology for abuse prevention, and limited session storage for writing continuity. We do not currently use advertising cookies or a product analytics SDK. This section will be reviewed if non-essential analytics or marketing technology is introduced.

Account, child-profile, writing, AI, and report information is retained while the account remains active and as needed to provide requested features. Parents may request a private export or reviewed deletion of one child profile or the entire account. An approved deletion is performed only after the authenticated account holder returns and gives a separate final confirmation. Product data controlled by Writing Tutor is then deleted. Limited legal-consent, security, fraud-prevention, support, tax, payment, and dispute records may be retained for the period reasonably necessary to demonstrate compliance, protect the service, or satisfy applicable law. Service providers may retain records under their own legal duties and published terms.

Subject to applicable law, parents may request a private copy or reviewed deletion of their account and child data, withdraw child-data consent, and contact us to request correction, objection, or restriction. Account and child deletion require a separate final confirmation by the authenticated account holder; submitting a request or receiving administrative approval does not itself delete data.

Writing Tutor is designed for use through an account owned by an adult parent or legal guardian. A child must not create an account independently. Before an eligible child profile is used, the parent receives a direct child-privacy notice and must complete the required adult-verification and child-specific consent process. The applicable consent age and verification method may vary by country. See the Child Privacy Notice for more detail.

We use access controls, private object storage, encrypted transport, ownership checks, signed payment webhooks, and limited provider credentials. No service can promise absolute security. Material policy changes may require renewed notice or consent, especially when they affect child data.

Email us at privacy@writing-tutor.com.