Privacy Policy
Last updated: 2 October 2026
We are a tutoring practice, not an advertising business. We collect the minimum needed to answer your enquiry and to run your lessons.
We do not sell, rent, lease or share personal information. We do not run targeted advertising, and we never build commercial profiles of students.
Signing in is optional. You can read every page of this site, including the course material, without an account.
1. Who this is for
This is a mixed audience site. It is for students, parents and schools looking for mathematics tutoring, and it is not directed primarily at children.
Signing in with a Google Account is strictly optional and no part of the site requires it. That is deliberate: Google's API Services User Data Policy prohibits an application directed primarily at children from using Google Sign-In at all, and permits a mixed-audience site to offer it only where users can access the site in its entirety without an account.
Students under 13 should not create an account. A parent, guardian or teacher should make contact on their behalf.
2. What we collect, and why
If you send the contact form
We receive your name, email address and message. We also record the IP address the message came from. The form is protected by Cloudflare Turnstile, a bot check that runs in your browser on the home page; when you send the form, our server asks Cloudflare to confirm the check passed.
This is used to reply to you and to arrange tutoring. Your enquiry reaches us as an email sent through Brevo, an email delivery service. It is not added to a marketing list, and you will not receive anything you did not ask for. Enquiries are automatically deleted after 90 days.
If you sign in with Google
Signing in gives us an opaque Google account identifier and your email address; Google also tells your browser your name and a link to your profile picture, so the page can show who is signed in. We never see your Google password, and we request no access to Gmail, Drive, Calendar or Contacts. Our server checks each sign-in against Google's published signing keys.
On your device, two items are kept in your browser's local storage until you sign out: the sign-in token Google issued (it carries your name, email and picture link) and our own session token with the same name, email and picture. They are what keep you signed in. On our server, the session is stored only as a hash of that token — never the token itself — with your account identifier and email, and it expires after 30 days.
Signing out ends the session on our server immediately, on every device, and removes both items from your browser.
Your course progress
Without an account, everything you do in the courses — videos watched, checkpoints passed, quiz answers, review schedules, practice settings, your theme choice — is kept only in your own browser's local storage. Nothing is sent to us.
If you sign in, that progress is copied to our server, stored against your account identifier with your email, so it follows you between devices. It includes a mastery rating per skill and, for the Differential Equations course, an activity log of up to your most recent 1,500 attempts — when, what kind (a quiz answer, a checkpoint attempt or a finished video), whether it was right, and which item — plus daily totals. It is used only to show you your progress and to choose your next practice; it is not used for anything else and is never shared.
Your drawings and notes on the course pages are kept on your device only. They are never sent to us, signed in or not.
Cookies. Our own code sets none. Google's sign-in code, on the pages where it loads (see below), keeps one cookie on this site, g_state, for up to 180 days. It records the state of Google's sign-in prompt; when we checked, it held only timestamps, a few settings and a random value Google's code generates — no name, no email, no account. Our server ignores it. YouTube sets its own cookies once you start a video (see below).
Services that load in your browser
Some pages load code or media from other companies. When they do, that company receives the ordinary information any website receives — your IP address, your browser type and the page you are on — under its own privacy policy. None of them receives your course progress or account details from us.
- Google Sign-In loads on the home page, the Student Portal and the Differential Equations course for every visitor, so the Log in button works; in the Venture Capital course it loads only when you press Log in. Google receives your account details only if you sign in. Where it loads, it keeps the
g_statecookie described above, and it may set its own cookies on its own sites. Profile pictures are shown from Google's servers. - Cloudflare Turnstile (the bot check) loads on the home page.
- Cloudflare Web Analytics runs on the home page only. It counts page views without cookies and without building a profile of you or following you to other sites; it is not an advertising product.
- cdnjs (run by Cloudflare) supplies the math library the Differential Equations course uses.
- Desmos supplies the graphing calculator on Differential Equations pages. Its code loads from Desmos; your graphs are worked out in your own browser, and we send Desmos nothing about you.
- YouTube plays the lesson videos, in both courses in its privacy-enhanced mode (
youtube-nocookie.com). A page you only read sets no YouTube cookie. In the Differential Equations course, the first time you start a video the page also loads YouTube's player-control script, so it can notice when you have watched most of a video and tick it off for you; YouTube sets its own cookies at that point. In either course, YouTube may set cookies once you play a video.
3. How long we keep things
| Data | Retention |
|---|---|
| Contact form enquiries (name, email, message, IP) | 90 days, then automatically deleted |
| Sign-in sessions on our server (hashed token, account identifier, email) | 30 days, then expired — or at once when you sign out |
| Synced course progress, including the activity log | Until you ask us to delete it |
| Sign-in items on your device | Until you sign out |
| Course progress, drawings and settings on your device | Until you clear them (your browser's site data, or the course's reset) |
On our server, retention is enforced by expiry set on the record when it is written, not by anyone remembering to clear it out. What is on your device is yours to clear at any time.
4. Who else receives data
The complete list. There are no others — no data brokers, no advertising networks, no social media pixels.
| Party | What they receive | When |
|---|---|---|
| Cloudflare | Hosting, storage of enquiries, sessions and synced progress, the bot check, cookieless page-view counts, and the math library (cdnjs) | Always |
| Ordinary request information when its sign-in code loads (see section 2); your account details only when you sign in | On the pages listed in section 2; account details only if you sign in | |
| Brevo | Your enquiry, so it reaches us as an email | Only if you send the contact form |
| Desmos | Ordinary request information when the calculator loads; nothing about you from us | On Differential Equations pages |
| YouTube (Google) | Ordinary request information when a video player loads; its own cookies once you start a video | On course pages with a video |
| TinyURL | The click on our booking link, which it forwards to Wyzant | Only if you follow the booking link |
| Wyzant | Nothing from us. The booking link takes you to their site, where their own privacy policy applies. | Only if you follow it |
5. What we never do
- No selling, renting, leasing or sharing of personal information. There is no "sale" or "share" as the CCPA defines it, so no "Do Not Sell or Share My Personal Information" mechanism is required. If that ever changed, this policy would change first and the link would appear.
- No targeted advertising, and no advertising of any kind on this site.
- No commercial profiling of any user, and specifically not of students.
- No use of student data for anything but delivering the tutoring you asked for.
- No unsolicited marketing. Contacting us about lessons does not sign you up to anything.
6. Schools and FERPA
Where a school or district engages us, we act as a school official with a legitimate educational interest in the student records involved, under the school's direct control as to their use and maintenance. We do not re-disclose student records and we do not use them commercially.
Schools requiring a signed Data Processing Agreement should request one before students use the service. Parents and eligible students may review, correct or delete student data through the school; requests made to us directly are answered within 45 days.
7. COPPA and children under 13
- We do not knowingly collect personal information from a child under 13 without consent. Accounts are for adults arranging tutoring.
- Where a school uses the service for a purely educational purpose and no commercial purpose, the school may consent on behalf of parents, as COPPA permits.
- Parents may review their child's data, have it deleted, and refuse any further collection — write to us and say so.
- If we learn we have collected information from a child under 13 without the required consent, we delete it.
Written data retention policy
The amended COPPA Rule requires a written retention policy rather than merely a practice. Personal information is kept only as long as reasonably necessary for the purpose it was given for; the periods are in section 3; nothing is retained for a secondary purpose such as analytics, resale or model training.
Written information security program
Consistent with the amended COPPA Rule — effective 23 June 2025, with full compliance required from 22 April 2026 — we maintain a written information security program, scaled to the size of this practice as the Rule permits:
- Minimisation. We ask for a name, an email and a message. There is no field we do not need.
- Short retention. Enquiries expire after 90 days; sessions after 30.
- Credential hygiene. Session tokens are stored hashed. We never handle your Google password.
- Transport security. Everything is served over HTTPS, and browsers are told to insist on it.
- Script control. Every page carries a Content Security Policy: the browser runs only our own scripts and the services named in this policy, which protects the sign-in items kept on your device from injected code. The Differential Equations course relaxes it only as far as the Desmos calculator needs to run.
- Abuse controls. The contact form is rate-limited and bot-checked, so the enquiry store cannot be filled with junk holding other people's data.
- Annual risk assessment. At least yearly, and whenever a feature changes what we collect, we review what is collected, where it goes, how long it lives and who can reach it.
Adam Staples is responsible for this program.
8. Your rights
You may ask us to show you what we hold, correct it, delete it, or send it to you in a portable form. Write to the address below and we will act within 45 days. If we refuse a request we will say why, and you may appeal by replying to that decision.
Signing out ends your session yourself, straight away. Deleting your synced progress is done on request for now — there is no delete button yet — and a deletion covers every copy we hold, including any older-format copy of your Differential Equations progress.
Residents of California, Colorado, Connecticut, Virginia and other states with comprehensive privacy statutes have these rights by law; we extend them to everyone, because operating two standards would be more work than doing it properly once.
9. Security incidents
If we become aware of a breach affecting personal information, we will notify affected people and, where student data is involved, the relevant school, without undue delay and consistent with applicable law.
10. Other Staples Education products
The Interactive Quiz App is a separate, local-first product with its own architecture and its own privacy policy. It stores your material on your own device by default and does not share a database with this site. The Differential Equations course links each unit to a practice quiz there; following one opens that site, and the link carries only which quiz to open — nothing about you.
11. Technical detail
For readers who want to check. Every name here is checked against the site's code on each build (scripts/audit_egress.js), so this list cannot quietly fall behind what the pages do.
Outside addresses your browser may contact
- Google Sign-In:
accounts.google.com; profile pictures:googleusercontent.com - Cloudflare Turnstile:
challenges.cloudflare.com; Web Analytics:static.cloudflareinsights.com,cloudflareinsights.com; cdnjs:cdnjs.cloudflare.com - Desmos:
www.desmos.com - YouTube:
www.youtube.com,www.youtube-nocookie.com,i.ytimg.com - The booking link:
tinyurl.com, which forwards to Wyzant
These are the only outside sources the pages are permitted to load from; the Content Security Policy blocks anything else.
Outside addresses our server contacts
www.googleapis.com— Google's published sign-in keys, to check a sign-inchallenges.cloudflare.com— to confirm a contact form's bot checkapi.brevo.com— to deliver an enquiry to us as an email
What is stored in your browser
ode_google_credential— the sign-in token Google issued, while you are signed inode_cloud_session— our session token with your name, email and picture link, while you are signed in- Keys beginning
ode_— Differential Equations progress, settings, your theme choice and (ode_ink::) your drawings - Keys beginning
vc_— Venture Capital progress, settings and (vc_ink::) your drawings
Cookies
g_state— on this site, set by Google's sign-in code where it loads; up to 180 days; prompt state only- YouTube's own cookies, on
youtube.com, once you start a video
What is stored on our server
lead:records — contact form enquiries, deleted after 90 dayssession:records — a hash of each sign-in session token, with account identifier and email, expired after 30 daysprogress:records — synced course progress, per course, with account identifier and email, until you ask us to delete it
12. Changes
Material changes are reflected in the date at the top of this page.
13. Contact
Staples Education — addstaples@gmail.com
For a Data Processing Agreement, a FERPA or COPPA question, or a data request, use the same address and say which it is.