Last updated: October 19, 2026.
The principle: this site collects the minimum it needs, and nothing else. All the content, exercise sets, revision sheets, course hubs, blog, can be read without an account. The account is optional, free, and keeps only an email address (with, for those who sign in through Google, the identifier of that account) and what the student does with it: what they tick, their checked answers and points, the nickname, level and courses of their profiles, the exams they note down and, if they send any, their requests for exercises. No sale of data, no advertising, no newsletter.
Person responsible for the protection of personal information
Ahmed Squalli Houssaini, publisher of the site and the person with the highest authority in the business, acts as the person responsible for the protection of personal information within the meaning of Quebec's Law 25. For any question, request or complaint: contact@letuteurscientifique.ca. An answer is given within thirty days, in practice much sooner.
The free account: what is kept, and why
| Information | Why | Required? |
|---|
| Email address | To open your session with a six-digit code or a link sent by email, or through your Google account if you choose it, and to write to you about the account itself (deletion confirmation, warning before erasure for inactivity) | Yes |
| Exercises ticked, sheets read, favourites | To show you where you stand and which chapter to tackle next | That is the service |
| Answers checked on self-checking exercises, with their points | To count the points earned on the first try and mark the exercise done or to review. Without an account, checking happens in your browser and nothing is sent | Only if you check an answer while signed in |
| Requests sent from the box “Something missing?”: the page, the type of request, your text, and my answer | To read your request, answer it, and email you when the exercise is added. Your text is seen only by you and by me, it is never published. No need to write your name or your school in it | Only if you send a request |
| Nickname, level and courses of a profile | To make the dashboard readable. Visible to you only | No |
| Exams you note down: the course, the type (test, midterm, final...), the date and the chapters | To work out the plan up to the exam: where to start each day, at what pace. No grade, no school, no teacher's name. Visible to you only | Only if you note down an exam |
| Your Google account identifier, and the address Google confirms | To recognise your Google account at each sign-in and link it to your account: one verified address, one account, whichever way you sign in | Only if you use “Continue with Google” |
| Date of your consent and version of this policy | To prove consent | Yes |
The account collects no name, no school, no phone number, no date of birth, and no IP address in clear. There is no password. No public profile, no ranking, no sharing between students: nobody but you can see your progress, and this is enforced by the database itself, not only by the interface.
Consent
The account exists only after a box is ticked voluntarily, never pre-ticked, at the first sign-in. Until it is ticked, nothing is done with the address. Consent can be withdrawn at any time by deleting the account, from "My data".
Under 14? Ask a parent to create the account with their own email address.
In Quebec, consent for a minor under 14 is given by the person with parental authority. The address is then the parent's; the workspace remains the student's. From age 14, students exercise their rights over their information themselves.
Several profiles under one account
An account can hold several profiles, for example two children in the same family. The dashboard shows only one at a time: there is no comparative view and no household summary. The account holder can export or delete everything, which is their legal right; they have no monitoring tool beyond that.
Where the data is kept, and who sees it
No information is sold or transferred. The following providers process it to run the service, and only for that:
- Supabase Inc. (United States) hosts the database and the sign-in service. The data is physically stored in Canada, in the Montreal region, encrypted in transit and at rest. Supabase keeps a technical log of sign-ins, with the IP address, for seven days.
- Vercel Inc. (United States) hosts the site and runs the account code. Requests pass through its servers.
- Resend Inc. (United States) carries the site's emails: the sign-in links, the notice that tells me about a request, and the answer I send you. It sees the recipient's address and the content of the message; the notice of a request carries your text, never your address.
- Google LLC (United States), only if you choose “Continue with Google”: Google confirms your address and sends us an account identifier, nothing else. Neither your name nor your photo is requested. In return, Google knows that you sign in to this site, and when; it sees nothing of what you do here. The email code and link always remain available, without Google.
- Google LLC (United States), for Google Analytics 4 audience measurement on public pages, described below. Google Analytics is not loaded on the sign-in pages nor on the account pages.
These providers are located outside Quebec. A privacy impact assessment was carried out before the account went live, as the law requires: information concerned, purposes, recipients, legal regime and protection measures. It concludes that the protection is equivalent, given the encryption, the hosting in Canada, the absence of passwords and the minimisation of data.
How long
- The account and everything in it are kept as long as you use it.
- After 24 months without signing in, the account is deleted automatically. A warning email is sent in the 23rd month.
- A requested deletion is immediate and real: the address, the profiles, the progress, the favourites, the exams and the requests are erased.
- An exam you note down erases itself no later than two months after its date; you can remove it before.
- Your requests are kept with the account and erased with it. As long as it has not been read, you can withdraw one yourself. All that remains is a counter with no personal information, a page, a type of request, a day, a number: it says which pages are missing something, never who asked.
- Technical backups of the database expire within thirty days: deleted data disappears from the backups within that time.
- Sign-in links sent by email expire after one hour and work only once.
The account's cookies
Five cookies, all strictly necessary to the service, so no separate consent: a session cookie, inaccessible to scripts and valid for thirty days; a "signed in" flag that avoids a display shift; the identifier of the active profile; a request cookie, set when you ask for a sign-in code, inaccessible to scripts, which keeps for one hour the page to bring you back to, your "shared computer" choice and your email address, without which the code cannot be checked, and is erased as soon as your session opens; and, only if you ticked that box, a "shared computer" flag, erased when the browser closes, which then makes every other account cookie expire with it. The sign-in service may also set, when a code is requested, a technical cookie that expires after fifteen minutes. The browser also keeps a local copy of what you have ticked, to show it without waiting for the network; it is emptied when you sign out. The draft of a request not yet sent and your light or dark theme choice stay on the device; the draft is erased once sent, and neither holds anything else. None of this is used to track you.
Your rights, and where to click
- Access and portability: "My data", button "Download the file". A complete JSON file, all profiles included, in one click.
- Correction: the nickname, the level and the courses are changed under "Profiles" or on the dashboard; the email address under "My data", with confirmation from both the old and the new address.
- Deletion: "My data", button "Delete permanently". Immediate effect.
- Withdrawal of consent: same as deletion.
- Sign out of every device: "My data", useful after a session on a school computer.
Without access to the account, any request can be made by email to contact@letuteurscientifique.ca, from the account's address. Nobody at the site looks at a student's progress without their explicit request; requests sent from the box, on the other hand, are written to be read, and I read them all; an exceptional access, to understand a failure for example, would be logged with its date and reason.
In case of an incident
Every confidentiality incident is entered in a register, whatever its severity. If it presents a risk of serious harm, the Commission d'accès à l'information du Québec and the people concerned are notified.
Contact form and WhatsApp
When you fill in the contact form, what you enter (name, phone number, email address and message) is passed on by the site's server, without being stored, and forwarded by email to the site publisher through the sending service Resend Inc. (United States). It is used only to answer your enquiry and to follow up on the tutoring, and it is kept for the duration of the tutoring relationship and the exchanges around it. Exchanges over WhatsApp are governed by the terms and privacy policy of WhatsApp (Meta).
Audience measurement
The public pages of the site use Google Analytics 4 (Google LLC, United States) to measure traffic: number of visits, pages viewed, broad source of traffic. This tool places cookies in your browser. The data is used only to improve the site; it is not used for advertising, and it is never linked to an account. You can block those cookies in your browser settings or with the Google Analytics opt-out add-on: the site works perfectly without them.
Updates
This policy may be updated to reflect changes to the site or its providers. The version published on this page is always the one in force; a change that would widen the collection would be submitted for a new consent in the account.
Le Tuteur Scientifique