Everything we check, everything you can see, and the things we decided not to know.
Most of this page is about instructors, because that is the question you actually have. The last part is about your child, because the safest information is the information nobody ever collected.
Five checks, before a single booking
An instructor may submit a verification. An instructor may never approve one — that separation is enforced in the database, not by a policy someone remembers to follow.
Criminal history check, and a sex-offender registry search
Run through the Texas Department of Public Safety, alongside a national criminal database and federal and state sex-offender registry search. Done before an instructor can be listed, not after their first booking. It carries an expiry date, and a lapse is flagged for review the day it happens.
Government photo identity
The person who passed the criminal history check is the person who turns up. Matching those two is the entire point of this step.
General liability insurance
Held by the instructor, in their own name. FRAP does not insure your child, and we would rather say so than let you assume otherwise.
Current first aid certificate
Required for in-person activities. For online tutoring it does not apply, and we do not pretend it does.
Teaching credential, where one applies
A conservatory diploma, a coaching license, a teaching qualification. Many excellent instructors hold none, so this is shown when present rather than required.
A lapsed check does not stop a booking. It stops the session. When a session is started, the database works the instructor’s status out again from their actual checks — it does not read a stored flag that somebody might have forgotten to update — and refuses to open the room if any of the five is missing, expired or still under review. Refusing is the default, and it takes a valid check to get past it rather than an oversight to be caught.
Above the schedule. Above the price.
This is the screen where you decide whether we are legitimate, so the order of it is not an aesthetic choice. Checks and renewal dates first, what your child would earn second, the cancellation terms third, and the money last.
At the foot of it is the whole of what that instructor is ever shown about your child: a first name, a last initial and an age in years.
Drawn from the design — the app is in build, and no instructor shown anywhere on this site is a real person.
Activity
Vetting is a claim. Approval is a constraint.
Checks tell you who an instructor is. They do not tell you that you agreed to this particular adult teaching your child. That second thing is a separate condition, it is yours to give, and it is checked inside the function that opens the video room rather than in the interface — where a bug becomes a safeguarding incident.
Approval is per adult, per child, per subject
Not a blanket agreement to the platform. A parent approves this particular adult to teach this particular child this particular subject, at a level and in a format, before a first session — and the approval does not silently widen when any of those change.
A substitute is a different adult
The failure most platforms have: a substitute walks in and the lesson proceeds. Here substitution is its own event with its own consent state, so no approval exists for it — the session cancels with a full refund rather than quietly going ahead with someone you never approved.
Your consent ledger is append-only
Every grant, decline, revocation and expiry, in order, exportable by you. Corrections are new entries with a reason, never edits — the same discipline as the record itself. It protects your child, and it protects us the first time something is disputed.
The parent is told which of the two conditions failed, and why. The session does not quietly proceed with someone else in the room.
Enforced in the database, inside the function that opens the video room. Never in the interface, where a bug becomes a safeguarding incident.
The shortest list we could design.
A safeguard you can switch off is a setting. A field that does not exist cannot be leaked, exported, subpoenaed or sold — so wherever we could remove the data instead of protecting it, we removed it.
What an instructor is shown
That is the whole list. It is not a filtered view of a bigger record — instructors have no permission on the child record at all, and read a separate view with no further columns in it to expose.
What FRAP never collects
An instructor is never shown a date of birth — and neither are we. The product does not have a field for one. It stores a birth month and a year, and only to work out an age in whole years, which is the only thing an age gate needs. A column that does not exist cannot leak, cannot be subpoenaed and cannot be sold.
Why the hours cannot be faked
A record anyone can quietly edit is not a record. Verified hours have one writer and one code path.
One writer
Hours are created only when an instructor closes out a finished session, and only for the children marked present. A child who was absent earns nothing.
Never edited
Nobody can change or delete a Passport entry afterwards — not the instructor, not you, not FRAP staff, not the database owner.
Corrections are visible
A genuine mistake is fixed by posting a correction that points at the original and carries a reason. The original entry stays where it is.
The AI will not do your child’s homework, and it cannot touch the record.
FRAP has an AI homework helper for math and biology, grades 3–12. It is the most attention-grabbing thing on this site and the one we are most careful about, so here is what it cannot do before anything about what it can.
It cannot write to the record
Not a policy — the only code path that creates a verified hour requires a human provider closing out a session they taught. AI practice is practice.
It never gives the final answer
Restate, name the method, show an analogous example, check the child’s own working. The hint level is a field in the response schema, which can be audited, rather than a line in a prompt, which can be argued with.
It is off until you turn it on
Per child, grades 3–12. Not opted in means the feature is not there at all — hidden, not greyed out.
Every transcript is readable by you
Permanently, with no private mode and no toggle. The interface carries a standing line telling the child that a grown-up can read this.
It cannot leave the subject
It opens from a worksheet or a topic and stays inside the curriculum node it came in through. Off-topic input is redirected rather than answered.
Distress goes to a person
A disclosure of harm ends the session with one short caring line and raises a flagged alert to the parent and a human queue. The helper does not counsel and does not continue.
How the helper is built, and the claim we are holding back →
You can take it all back at any time.
Deleting your account deletes the household, the children on it and their Passports. It is a button inside the app, not an email to support and a wait. If you would rather keep the record and leave, you can export a Passport first.