Everything we check, everything you can see, and the things we decided not to know.
Most of this page is about instructors, because that is the question you actually have. The last part is about your child, because the safest information is the information nobody ever collected.
Five checks, before a single booking
An instructor may submit a verification. An instructor may never approve one — that separation is enforced in the database, not by a policy someone remembers to follow.
Criminal background check
Run before an instructor can be listed, not after their first booking. It carries an expiry date, and a lapse is flagged for review the day it happens.
Government photo identity
The person who passed the background check is the person who turns up. Matching those two is the entire point of this step.
Public liability insurance
Held by the instructor, in their own name. Frap does not insure your child, and we would rather say so than let you assume otherwise.
Current first aid certificate
Required for in-person activities. For online tutoring it does not apply, and we do not pretend it does.
Teaching credential, where one applies
A conservatory diploma, a coaching licence, a teaching qualification. Many excellent instructors hold none, so this is shown when present rather than required.
Every check carries an expiry date, and somebody watches them. Our internal review tool works out each instructor’s real status from their checks rather than trusting a stored flag, and puts anyone whose check has lapsed — or who is still taking bookings on one — at the top of the queue. Renewal is chased before the date, not after it.
The shortest list we could design.
A safeguard you can switch off is a setting. A field that does not exist cannot be leaked, exported, subpoenaed or sold — so wherever we could remove the data instead of protecting it, we removed it.
What an instructor is shown
That is the whole list. It is not a filtered view of a bigger record — instructors have no permission on the child record at all, and read a separate view with no further columns in it to expose.
What Frap never collects
An instructor is never shown a date of birth. [upgrade when the month+year migration lands]
Why the hours cannot be faked
A record anyone can quietly edit is not a record. Verified hours have one writer and one code path.
One writer
Hours are created only when an instructor closes out a finished session, and only for the children marked present. A child who was absent earns nothing.
Never edited
Nobody can change or delete a Passport entry afterwards — not the instructor, not you, not Frap staff, not the database owner.
Corrections are visible
A genuine mistake is fixed by posting a correction that points at the original and carries a reason. The original entry stays where it is.
You can take it all back at any time.
Deleting your account deletes the household, the children on it and their Passports. It is a button inside the app, not an email to support and a wait. If you would rather keep the record and leave, you can export a Passport first.