Privacy Policy

StudyRoster is a tutoring management service operated by Tabb Labs LLC, a North Carolina limited liability company, at studyroster.com. This policy explains what personal information we collect, how we use it, and your rights with respect to that information.

• Account data: the name, email address, and timezone you provide at signup, and a password if you sign up with one (we store only a cryptographic hash of your password, never the password itself). If you sign in with Google, we receive your email address and basic profile from Google instead.
• Your business records: the information you enter to run your tutoring business, including students and their parents or guardians (names, email addresses, phone numbers), schedules and sessions, session notes, invoices, payment records, packages, and expenses.
• Billing information: payments are handled by Stripe. Your card details never touch our servers; we store only Stripe identifiers (such as a customer and subscription reference, and, if you enable online invoice payments, a reference to your connected Stripe account).
• Operational logs: a minimal internal event log (for example, that a signup or an error occurred) used to keep the service healthy. Email addresses in these log messages are masked.

We use the information you provide to:

• Operate the service (calendar, students, invoices, notes, reports)
• Send session reminders and invoices to the parent contacts you enter
• Send you transactional email and, if you opt in, push notifications about your own schedule
• Communicate with you about your account and the service
• Protect the service from abuse (for example, a bot check at signup)

We do not use your data for advertising, and we do not send it to any AI service.

Some features generate private links (session note sharing, parent views, and invoice payment pages) that can be opened without a login by anyone who has the link. These links use long random tokens that cannot be guessed, and we store those tokens hashed at rest, so they are not readable in our database. You control who receives a link and can revoke shareable links from within the service.

We never sell your data. We use a small set of service providers strictly to run StudyRoster, and we share data with them only as needed to operate the service. Your data is never sent to any advertising network or data broker, and we use no advertising pixels.

• Stripe: subscription billing and, if you enable it, online invoice payments from your clients
• Resend: transactional email (session reminders, invoice delivery, account email)
• Cloudflare: the TLS and secure tunnel that front the application, invoice PDF storage (R2), and the bot check at signup (Turnstile)
• Google: sign-in (we receive your email and basic profile only when you sign in with Google)
• Web push services (Apple, Google, Mozilla): deliver the reminder notifications you opt into, to your own device
• Self-managed infrastructure: the application and its database run on our own self-managed servers, reached securely through Cloudflare. We do not use a third-party cloud database or compute host.

We use only essential authentication and CSRF cookies. We do not use advertising or tracking cookies. For aggregate traffic measurement we use Cloudflare Web Analytics, a privacy-first service that does not use cookies or local storage and does not track or fingerprint individual visitors.

All traffic to StudyRoster is encrypted in transit with TLS. Passwords and shareable-link tokens are stored hashed. Your business records are scoped to your account: they are visible only to you and to the team members you invite, plus the specific pages you choose to share through the links described above.

StudyRoster accounts are for tutors and tutoring businesses, not for children. Information about students, who may be minors, is entered and controlled by the tutor. We process it on the tutor's behalf to provide the service, and the tutor is responsible for having the right to enter it, as described in our Terms of Service.

Subject to applicable law (including the GDPR and CCPA where they apply), you have the right to access, correct, and request a portable export of your personal data, and to request erasure. To exercise any of these rights, email [email protected]. Because we retain certain records to meet legal, tax, and accounting obligations, erasure requests are reviewed and fulfilled by our team on a case by case basis rather than automatically.

If you are the account owner, you can close the account at any time from Settings, under Danger Zone, or by emailing [email protected].

What happens: your account is closed. You immediately lose access, your data is removed from view, and your subscription is canceled.

What we retain: your account data, including students, sessions, notes, and invoices, is preserved on our servers for legal, tax, accounting, and dispute resolution purposes (permitted by GDPR Art. 17(3)(b) and (e)).

Full erasure: if you want your retained data permanently deleted, email [email protected] and we will review the request against our legal retention obligations.

If we make material changes to this policy, we will notify you by email before they take effect.

For privacy questions, email [email protected].