What Mynk is

Mynk is the web application these pages describe. It is also titled Tutoring Notes. It helps private tutors run a shared whiteboard session, record it, and draft the notes. When a note is finalized, the parent and student can see the notes and the lesson replay in their account.

What data we collect

• Account information: email address, hashed password, and optional display name when you create a tutor account.
• Optional phone number (tutor/admin accounts only, collected only if you enable two-factor authentication via text message — never required).
• Session notes: student names, session dates, topics, homework, assessment, plan, and links you enter.
• Session audio recordings from a whiteboard session (stored in Vercel Blob — see below).
• Whiteboard session data: timestamped stroke logs, optional PDF / image inserts, and a session snapshot used for the parent replay surface.
• Parent or guardian email addresses you enter for that student, including for an invite or an optional reminder.
• Outbound email logs (subject, recipient, body text, share link) retained for delivery troubleshooting.
• Feedback submissions (message, optional contact email, and submitter IP address retained for abuse prevention on the public form).
• Waitlist entries (email and optional name) submitted through interest forms or contact, retained for outreach.
• Gmail OAuth tokens if you use “Connect Gmail” (see Google account and Gmail below).
• Google Calendar OAuth tokens if you use “Connect Google Calendar” (see Google Calendar below).
• Calendar subscription feed token — an opaque secret URL we generate if you use the ICS/webcal subscription feed (see Calendar subscription feed below).
• Standard technical logs (IP address, user agent, timestamps) collected by our hosting provider for security and reliability.
• LearnerProfile information: a student’s name entered when creating a student profile. For students under 13, this is personal information subject to COPPA protections.
• Session transcripts automatically generated from session audio by the OpenAI transcription service (see below). Transcripts are derived from and linked to the session audio recording.
• Parent or guardian contact information collected during the account-claim and consent flow for students, including for verifiable parental consent purposes for students under 13.

How we use your data

Your data is used solely to operate the product: signing you in, storing and displaying notes / audio / whiteboard sessions, generating share links, and sending the email updates you choose to send. We do not sell Google user data, and we do not sell personal information to data brokers, advertising platforms, or cold callers.

Sharing, disclosure, and recipients

We share or disclose information only as needed to run the product, as described below.

• Google. When you connect a Google account, use Gmail, or connect Google Calendar through the app, data needed for that feature is processed by Google under Google's terms and your Google account settings (OAuth tokens, API calls to send mail you initiate, Calendar API calls the product documents, and metadata Google logs as part of those APIs). We do not control Google's servers; we follow Google's applicable API and limited-use requirements for data we receive from Google APIs.
• Infrastructure and service providers. Tutoring Notes runs on hosted infrastructure and uses subprocessors that each handle a specific slice of the product:
  • Vercel — application hosting + serverless functions (US region).
  • Neon — PostgreSQL database (US region).
  • Vercel Blob — object storage for session audio and whiteboard snapshots (US region).
  • OpenAI — AI note generation and audio transcription. See AI note generation section below.
• People you direct us to contact. When you send an email or share content from the app (for example a session update to a parent's address), the recipient receives the information you chose to send.
• Legal and safety. We may disclose information if required by law, regulation, legal process, or to protect the rights, safety, and security of users, the public, or our services.
• Business transfers. If we are involved in a merger, acquisition, or asset sale, user information may be transferred as part of that transaction; we will require the successor to honor commitments consistent with this policy or notify you as applicable law requires.

Google account and Gmail (Connect Gmail)

When you click “Connect Gmail,” the app requests permission to send email on your behalf using the Gmail API (gmail.send scope) and to read your email address (userinfo.email scope). These permissions are used exclusively to send an optional reminder from your Gmail account when you click Email a reminder in the app. The parent or student already sees the notes and the lesson replay in their account when you finalize a note. We do not read, search, index, modify, or delete any of your existing emails. Google user data we receive through Gmail APIs is used only to provide the user-facing email- sending feature you asked for, consistent with Google's applicable API and Limited Use requirements.

We store a refresh token so the app can send on your behalf without asking you to sign in each time. OAuth tokens and related credentials are kept in server-side configuration or secure database storage, never embedded in web pages or public repositories. You can disconnect Gmail at any time from Settings → Email, which deletes the stored token; you can also revoke access directly from your Google Account security settings.

Google Calendar (Connect Google Calendar)

When you click “Connect Google Calendar,” the app requests permission to access your Google Calendar using the Google Calendar API (calendar.events.owned scope) and to read your email address (userinfo.email scope) only. When a connection is active, we create, update, and delete events on your primary Google Calendar that correspond to scheduled tutoring sessions you manage in the app. We do not use push notifications, webhooks, two-way sync, or CalDAV for Google Calendar, and we do not modify calendars you do not own. If Google Calendar write fails, your in-app schedule still saves — calendar sync is best-effort. Google user data we receive through Calendar APIs is used only to provide the scheduling features you asked for, consistent with Google's applicable API and Limited Use requirements.

We store a refresh token so the app can sync without asking you to sign in each time. OAuth tokens and related credentials are kept in server-side configuration or secure database storage, never embedded in web pages or public repositories. You can disconnect Google Calendar at any time from Settings → Calendar integrations. Disconnect deletes the stored token on our servers and makes no further Google Calendar API calls; it does not remove events that were already written to your Google Calendar — you can delete those in Google Calendar if you choose. You can also revoke access directly from your Google Account security settings.

Calendar subscription feed (ICS / webcal)

If you copy the calendar subscription URL from Settings → Calendar integrations, your calendar app (for example Apple Calendar, Google Calendar via “From URL,” or Outlook) will poll that URL on its own schedule to download an ICS feed of your upcoming scheduled sessions. We do not push updates to your device; the feed is read-only from the calendar app's perspective. Session titles in the feed and in Google Calendar events we create use the student's first name and last initial (for example, “Tutoring — Maya R.”).

The subscription URL acts like a bearer secret — anyone with the link can fetch your schedule until you revoke or rotate the feed token. Because calendar clients poll continuously, Google's, Apple's, and Microsoft's calendar services may fetch this feed on a recurring basis after you subscribe; refresh timing is controlled by each client (Google Calendar typically refreshes external URL subscriptions on the order of many hours, not immediately). Treat the URL like a password and revoke it if it may have leaked.

Live whiteboard session encryption key

For live whiteboard sessions created after this release, our servers generate and store an encryption key used to protect real-time whiteboard sync. The key is encrypted at rest in our database. We provide it only to the signed-in tutor for that session and to the signed-in learner or parent authorized for that session (a parent may join as their child when their account owns the learner profile). We do not publish the key in email or share links. Older sessions created before this release continue to rely on the key in the link the tutor shared.

AI note generation (OpenAI)

When a session is recorded, the audio is transcribed by OpenAI and the notes are drafted automatically. That is part of the session.

OpenAI's API data usage policy states that data submitted through the API is not used to train their models. See OpenAI's API data usage policy for details.

Session audio recordings (Vercel Blob)

When a whiteboard session is recorded, the audio is stored in Vercel Blob (private, US region). Audio is never publicly accessible. Playback goes through the app for the signed-in tutor, parent, or student, not through a public link. Playback uses authenticated, session-scoped URLs served through our application, not direct public blob links.

Recordings are sent to OpenAI via the /v1/audio/transcriptions endpoint for transcription as part of the note generation flow. OpenAI acts as a subprocessor processing audio on our instructions under a data processing agreement; audio data is not used to train OpenAI’s models. Audio is not shared with any other third party.

Audio recordings of tutoring sessions may contain the voices of students, including students under 13. Audio of students under 13 is collected only with verifiable parental consent. Online, if audio recording is off, the child’s voice is left out of the saved recording. The tutor’s microphone can still be saved and transcribed. In person, audio recording off saves nothing, because one microphone would catch everyone in the room. See the Children’s data and parental rights (COPPA) section below for how long we keep that information and how to exercise your rights.

A self-learner agrees to session recording when they set up their account, and can turn live sessions, audio recording, whiteboard recording, or notes off later in their settings. Audio recording off works the same way as for a child.

If a whiteboard session was recorded, the signed-in parent or student can play that audio with the notes. There is no separate switch for including the audio.

Where data is stored

Data is stored in a PostgreSQL database hosted on Neon (US region). The application is hosted on Vercel. Both providers maintain their own security and compliance practices.

Data retention and deletion

We retain data as long as your account exists and as needed to provide the service and meet legal obligations. Tutors can delete individual students and notes from within the app. If you want your account or all associated data deleted, contact us at the email below and we will process the request promptly.

Children’s personal information — retention (COPPA §312.10). Session audio recordings, session transcripts, session notes, LearnerProfile information (name), and parent or guardian contact information for students who are minors are retained for the duration of the active tutor–student relationship while your account remains in use. We may keep session history for a reasonable period after tutoring ends so tutors and parents can review progress. We do not retain children’s personal information indefinitely. Verified deletion requests from a parent or legal guardian (see Children’s data and parental rights below) are honored promptly. Automated retention schedules may be introduced in the future; this policy will be updated when they take effect.

After an account is deleted, we keep a record of the consent choices that were made: which options were on or off, and when. That record does not include the person’s name or email.

Security

We use commercially reasonable safeguards appropriate to the sensitivity of tutoring data and the nature of our hosted software:

• Encryption in transit. All connections to the application use HTTPS (TLS).
• Password storage. Tutor account passwords are hashed with bcrypt before storage; raw passwords are never written to logs or the database.
• Two-factor authentication. Teaching accounts require two-factor sign-in. The code is emailed by default. An authenticator app or a text message is a choice. When SMS two-factor is enabled (the Mynk SMS two-factor authentication program), we send one-time codes via Twilio (a third-party SMS provider) to the US phone number the tutor confirmed at opt-in. Twilio does not receive student session data. We do not sell or share SMS opt-in data or personal information with third parties for marketing purposes.
• Hosting and data stores. We rely on Vercel and Neon's protections for servers, databases, and object storage (access controls, network isolation, and encryption at rest where the vendor provides it by default for the tiers we use).
• Authentication and access. Every tutor request requires sign-in. An organization owner, admin, or scheduler can see learners that organization entered, including learners they did not personally teach. The organization enters the learner. A scheduler sees the name, a short brief, and a short reason when a booking is blocked, and does not see parent email, consent choices, or notes. A private tutor still sees only their own students.
• Secrets and OAuth tokens. API keys, client secrets, and OAuth refresh tokens are kept in server-side configuration or secure storage — not embedded in web pages or public repositories.
• Limited use of Google data. Google user data obtained through Google APIs is used only to provide the user-facing features you asked for (for example sending mail you trigger, or a Calendar connection you initiate), consistent with this policy and Google's applicable Limited Use requirements.

No method of transmission or storage is 100% secure; if you have a specific security concern, contact us using the address below.

Children

Mynk is used by tutors, parents, and students. A session follows the consent recorded for that student. The parent or self-learner records that consent in their account. Minors do not have tutor accounts.

When a parent or a self-learner has finished account setup, consent is recorded in that Mynk account before a live session. A parent records it for a child. A self-learner records it for themselves. A student who has not finished setup does not have that record yet.

Parent or student share links are tokenized and revocable. Opening one requires sign-in to the parent or student account. If you believe a tutor has shared a minor's information without appropriate consent, or that a child's personal information has been collected inappropriately, contact us at the email below and we will address it.

Children’s data and parental rights (COPPA)

Tutoring Notes is a platform designed for K–12 tutoring and knowingly collects personal information from students who may be under 13. We are subject to the Children’s Online Privacy Protection Act (COPPA), 16 CFR Part 312. We require verifiable parental consent before collecting personal information from or about a child under 13.

What children’s personal information we collect and why. For a student under 13, personal information we collect and process includes:

• Session audio recordings. When audio recording is on, this includes the child’s voice. Online, if audio recording is off, the child’s voice is left out and the tutor’s microphone can still be saved. In person, audio recording off saves nothing.
• Session transcripts automatically derived from audio via OpenAI (subprocessor) for note generation and session history.
• Session notes created by or for the tutor summarizing session content, topics, and progress related to the student.
• LearnerProfile information — the student’s name — to identify the student and provide contextual note generation.
• Parent or guardian contact information (email) collected during the account-claim and consent process for communication and consent purposes.

Subprocessors handling children’s data. Session audio is transmitted to OpenAI via the /v1/audio/transcriptions endpoint for transcription only. OpenAI acts as a subprocessor operating under a data processing agreement on our instructions; child audio is not used to train OpenAI’s models. Session data is stored in Vercel Blob (audio files) and Neon (database records), both US-region. A connected Google Calendar, or a calendar app subscribed to the tutor’s feed, receives an event titled with the student’s first name and last initial. A subject or note on that appointment is included on the event.

How we use children’s personal information. Children’s personal information is used exclusively to: deliver the tutoring session recording, transcription, and note-generation service; enable the tutor to review session history and track the student’s progress; and, when a note is finalized, let the parent or student see the notes and the lesson replay in their signed-in account. We do not use children’s personal information for advertising, profiling, or any purpose unrelated to the child’s tutoring sessions.

Retention (COPPA §312.10). Session audio recordings, transcripts, and notes, together with LearnerProfile information (name) and parent contact information, are retained for the duration of the active tutor–student relationship while your account remains in use. We may keep session history for a reasonable period after tutoring ends so tutors and parents can review progress. We do not retain children’s personal information indefinitely. Verified deletion requests from a parent or legal guardian are honored promptly (see Parental rights below). Automated retention schedules may be introduced in the future; this policy will be updated when they take effect.

Parental rights. As a parent or legal guardian, you have the right to:

• Review the personal information we have collected from your child.
• Direct us to delete your child’s personal information.
• Revoke consent and refuse to permit further collection or use of your child’s personal information. Turning a consent off stops that new collection. Online, if audio recording is off, the tutor’s microphone can still be saved.

To exercise any of these rights, contact us at arangarx+tutoringnotes@gmail.com. We will comply with verified requests as required by COPPA (16 CFR §312.6).

Consent revocation and data already collected (two tracks). Session audio recordings, transcripts, and notes are created only with a parent or guardian’s consent. Turning a consent off stops that new collection. Online, if audio recording is off, the tutor’s microphone can still be saved. It does not automatically delete content already created under your prior consent. As a parent or legal guardian, you may request to review or delete your child’s personal information at any time by contacting us at arangarx+tutoringnotes@gmail.com. We honor verified requests as required by the Children’s Online Privacy Protection Act (COPPA).

Educational use by the tutor. With parental consent, a child’s session recordings, transcripts, and notes may be used by the tutor for that child’s instruction — for example, reviewing past sessions to plan future lessons. This consent is part of account setup. Turning a consent off stops that new collection. It does not remove content the tutor already has. A parent can ask Mynk to delete the account and its data. Deleting only some of it is a special request.

Changes

We may update this policy from time to time. The “Last updated” date above will change when we do. Material changes may also be communicated in-product or by email where practical. Continued use of the app after changes means you accept the updated policy.

Contact

For privacy questions, data deletion requests, or concerns specific to Tutoring Notes, email arangarx+tutoringnotes@gmail.com. For general Mortensen Apps inquiries, see www.mortensenapps.com.