Privacy policy
This policy describes the data practices of the CityTutor Classified website as it is actually implemented: the tuition requirement form, the contact form, the public listings and the private moderation dashboard.
1. Who this policy covers
CityTutor Classified is an independent online platform for publishing tuition requirements. This page is a product-level privacy notice, not a representation of a company registration, office or corporate group.
The operator of this website is the data fiduciary for the information described here, and is accountable for answering privacy requests about it. Requests are acknowledged within 7 days and answered within 30 days. Use the contact form with the category “Privacy request”.
The platform is intended for adults: parents, guardians and tutors. It is not directed at children, and children should not submit information to it.
2. Information we collect
Tuition requirements
- Parent or guardian name (used for moderation, never shown publicly).
- City, locality, class or grade, subjects and tuition type.
- Contact phone number, normalised to an Indian mobile format.
- Optional budget, preferred timing and additional requirements.
- Consent flag, consent notice version, and the time consent was recorded or withdrawn.
- A reference code, moderation status and timestamps (created, updated, published, expires, closed, removed).
- Limited anti-abuse data: a pseudonymous HMAC of the network address and browser identifier, and internal risk flags (for example “repeat phone”).
Contact messages
- Optional name and the email address you provide for a reply.
- Inquiry category, message text and your privacy acknowledgement timestamp.
- A reference code, message status, an internal administrator note, and the same pseudonymous anti-abuse data described above.
Administrator and technical data
- Administrator email, display name and a strong password hash (never the plain password).
- Session records containing a SHA-256 hash of the session token, a CSRF token, expiry times, and pseudonymous network/browser identifiers.
- Audit events for moderation actions, recording the action, actor, record identifier, status change and non-sensitive context.
- Server logs containing event names, timestamps and technical errors. Phone numbers are masked and sensitive fields are redacted; full form payloads are not logged.
3. What becomes public
For an approved, active and unexpired listing, the public pages and API show:
- Class or grade, subjects, city, locality and tuition type.
- Optional budget, preferred timing and the additional requirements text.
- The posted date and, if applicable, the expiry date.
- The number of tutor applications received, as a plain count. No application details or tutor contact information are ever public.
Your name and phone number are never included in public listing responses, and no public endpoint returns a parent phone number under any circumstances. Do not include a child’s full name, exact home address, email address or identity documents in the form.
Contact messages are never public. They have no public read endpoint and appear only in the authenticated moderation dashboard.
4. Consent and withdrawal
The consent checkbox is not preselected. We store the consent state, the version of the notice you accepted, and the time it was recorded. The consent covers how your number is used — messages from CityTutor about the requirement, moderation and post management — not publication, because the number is never published.
You can withdraw consent or ask for a listing to be closed or removed by sending a privacy request and identifying the reference code where possible. Withdrawal does not affect the lawfulness of processing that happened before it.
Requirement posters are designated as responsible for their own data-privacy choices and for the personal information they submit. The website administrator is not designated as responsible for those choices. This does not remove the moderation, security and retention controls described in this notice.
5. Why we use this information
- To publish and moderate tuition requirements and make them searchable.
- To let a parent and tutor contact each other when the parent consents.
- To receive, review and respond to support or privacy messages.
- To prevent spam, duplicates, abuse and security incidents.
- To operate, secure and troubleshoot the website.
- To keep a limited audit trail of moderation decisions.
We do not use the information for advertising, profiling, automated decision-making with legal effect, or sale of personal data.
6. Cookies and third-party services
The public site sets no advertising or analytics cookies and loads no third-party scripts, fonts or trackers. The administrator area uses one essential cookie,cti_admin_session, which is HttpOnly, SameSite=Strict, and Secure in production. It exists only to keep an administrator signed in. Post management uses a second essential cookie,cti_manage, with the same attributes and a 12-hour lifetime. It is created only after a parent signs in with their reference code and password, or with their private management link.
The footer displays an aggregate visitor counter. Each real page load increments a visit total, and a keyed daily hash (HMAC) of the visitor’s IP address is stored for at most 90 days so the same visitor is counted once per day. The raw IP address is never stored, no cookie is set for this counter, and the figures are not used for profiling, advertising or any other purpose.
No payment processor, advertising network, social plugin or external analytics service is used. If the owner later adds one, this policy and the site’s Content Security Policy must be updated first.
Retention at a glance
- Pending requirements: reviewed; rejected records may be removed and purged.
- Published requirements: expire after the duration chosen by the parent (7, 14, 21 or 28 days) counted from approval, then stop appearing publicly. The record is retained privately under the moderation policy.
- Removed records: removed from public access immediately; retained privately for moderation/audit until purged.
- Contact messages: retained while needed to handle the request, then archived or deleted.
- Audit events: retained for accountability with minimal identifiers.
- Visitor counter: totals are permanent aggregates; the daily hashed visitor identifier is deleted after 90 days.
- Backups: follow the host’s rotation schedule; deleted records age out as older backups are replaced.
Your requests
Because requirement posters are designated as responsible for their own data-privacy choices, keep your reference code and only submit information you have permission to share. You can still submit a formal request for access, correction, withdrawal of consent or deletion.
You can submit a request for access to the information you provided, correction of inaccurate details, withdrawal of contact consent, or deletion of a listing or message.
Use the contact form and choose “Privacy request”. Include the reference code if you have it. The operator may need enough information to verify that the request relates to you.
No dedicated privacy email is configured for this deployment; the contact form is the current route.
Some records may be retained where necessary for security, fraud prevention, dispute resolution or legal obligations. Where a legal exception applies, the operator should explain it in response to the request.
Response commitment. The operator is the data fiduciary for this information. A request submitted through the contact form or by email is acknowledged within 7 days and answered within 30 days. If a request cannot be met in full, the answer explains why and what can be done instead.
7. Children’s privacy
Tuition requirements are submitted by adults acting for a student. The form does not ask for the student’s name, date of birth or exact address, and the public listing never shows the parent’s name. Please do not include a child’s full name, school identity number, photographs, medical details or precise address. If such information is submitted, it may be removed during moderation or on request.
8. Security
Passwords are stored only as salted scrypt hashes. Session tokens are stored as SHA-256 hashes, with CSRF protection and strict cookie attributes. Administrative endpoints require server-side authentication and authorization. Public write endpoints are rate-limited and use signed single-use form tokens. Network addresses are stored as keyed hashes rather than raw addresses where anti-abuse records are needed. Production deployment requires HTTPS and restricted database file access.
No system is completely secure. If you believe information has been exposed, use the contact form and choose “Suspicious listing” or “Privacy request”.
9. Where data is stored
Data is stored in the website’s own database and handled by the hosting provider the owner selects. The hosting location and any sub-processors must be confirmed by the owner before launch. Data is not sold or shared for marketing.
10. Changes to this policy
This policy may change when the implementation changes. The “updated” date at the top will be revised only when the content is genuinely reviewed. Material changes that affect consent will be reflected in the form before new submissions are accepted.