Online, one to one — and the hours land in the same record as the swimming.
The first two academic subjects alongside activities. A tutored hour is attested by the human who taught it, exactly as an activity hour is, and it is written to the Activity Passport the same way. Everything else on this page exists to make that hour safe to buy.
None of this has launched. This page describes what launch includes, in definite terms because it is being built to this specification — not because anyone is using it today.
We don’t replace the paper. We wrap it.
Two people looking at the same sheet is a working teaching medium, and we are not going to break it. What is broken is not the paper — it is that the sheet arrives from a tutor’s personal mailbox, carries no record, and comes back as nothing.
No worksheet leaves a tutor’s personal mailbox.
That single change closes the direct adult-to-child email channel — the largest unguarded surface in online tutoring, and one that sits outside every safeguarding policy in this category. It is the reason the loop is worth building at all; the print-and-photograph steps are the part that makes it usable.
Assign, in the app
The tutor attaches the worksheet to a scheduled session. There is no step in this loop where a sheet is sent from a personal mailbox.
Stamp and generate
FRAP regenerates it as a print-ready sheet with a header band, a six-character code and a QR. US Letter by default, A4 as an explicit option rather than a guess from locale.
Deliver where printing happens
In the app and by email both, far enough ahead that a parent has time to print. Nobody prints from a phone, and a sheet that arrives five minutes before the call is a sheet nobody has.
Work on paper
Deliberately untouched. A child writing by hand retains more than one typing, and a tutor watching a pencil move sees the mistake happen.
Photograph it back
The parent or student photographs the finished sheet in the app. The QR identifies which worksheet and which session, so it files itself rather than asking anyone to remember.
Mark and file
The tutor marks it with comments, and it attaches to that session’s Passport entry as evidence. The hours were already attested at close-out; the sheet backs them up. It does not create hours.
Everything the header band carries
That is the complete list, and it is short for a structural reason rather than a policy one. The schema has no surname and no date of birth, so the print template cannot render either onto a sheet that ends up on a kitchen table. A field that does not exist cannot be printed.
It will not do your child’s homework, and it cannot write to the Passport.
Those two sentences are the product; everything else is how they are enforced. It is a homework helper for math and biology, grades 3–12 — not a chat companion, and never written or drawn as one.
The hint ladder
Restate the question
What is the question actually asking you to find? Nothing is solved here — the child is made to say what the problem is.
Name the method
This is a proportion: two ratios set equal to each other. The technique is named; applying it is still the child’s job.
Show an analogous worked example
A different question of the same shape, worked through end to end. Close enough to learn the move from, far enough that copying it does not answer the homework.
There is no fourth rung.
The answer is not the last step of the ladder, and it is not anywhere else on the screen either. The child’s own working is what gets checked.
The hint level is a field in the response, not a line in a prompt. A structured output can be audited; a paragraph of instructions can be argued with.
It is not a chat box
The child never starts from a blank field. They open the helper from a worksheet or a topic, and the scope of that session is set by the TEKS curriculum node they came in through rather than by what they type. Frisco ISD teaches to TEKS, so “stay in the curriculum” is a retrieval constraint against a citable node — not an instruction the model can be talked out of.
Distress is escalated, never handled
If a child discloses harm or distress, the helper does not counsel and does not continue. One short caring line, the session ends, and a flagged alert goes to the parent and to a human queue with a defined response time. It is a safeguarding route with a person at the end, not a chat feature.
Limits we have not set yet
There is a daily message cap per child, and the number is [UNKNOWN] — it is set before launch and tuned on real usage. No price is ever shown to a child.
Six things it will not do
It cannot write to the Passport.
AI practice is not verified hours. Only the human who taught a session can add to the record. That is the line the whole product rests on: the moment an AI can write to it, the record is worth nothing to a university and the differentiator goes with it.
It never gives the final answer.
Restate, name the method, show an analogous example, check the child’s own working — and the child has to attempt something between rungs. The hint level is a field in the response schema, which can be audited, rather than an instruction in a prompt, which can be argued with.
It never leaves the subject.
It opens from a worksheet or a topic and stays inside the TEKS curriculum node it was opened from. No general knowledge, no advice, no opinions, no links. Off-topic input is redirected rather than answered.
It never implies privacy.
A permanent line in the interface says that a grown-up can read this. No private mode, no toggle, no exception, and every transcript stays readable by the parent.
It is off until a parent turns it on.
Per child, grades 3–12. Not opted in means the feature is not there at all — hidden, rather than visible and greyed out.
It is not a companion.
No face, no name, no personality, no small talk. The buddy a child picks is a cosmetic; the helper is a tool. If the thing a child confides in wears the costume of the pet they chose, that is a different product with a different risk profile.
On what happens to your child’s questions
There is a claim we intend to make here about how a child’s questions are used in model training. It is written and it is not published, because it is not yet confirmed in writing by the people who can confirm it.
[held pending written confirmation — lane G]
We would rather have a gap on this page than a sentence we cannot evidence. A privacy claim is the worst kind to get wrong.
“Every teacher is vetted” is a claim. This is a constraint.
A session cannot start unless verification is current and a parent has approved this adult, for this child, for this subject. Both conditions, every session, checked inside the function that opens the video room — never in the interface, where a bug becomes a safeguarding incident.
The parent is told which of the two conditions failed, and why. The session does not quietly proceed with someone else in the room.
Enforced in the database, inside the function that opens the video room. Never in the interface, where a bug becomes a safeguarding incident.
If either condition fails
The session is blocked and the payment is refunded in full, and the parent is told which of the two conditions failed and why. The substitute case is the one most platforms get wrong: a different adult walks in and the lesson proceeds. Here a substitution is its own event with its own consent state, so there is no approval row for it and the session does not start.
An expiring check is not a silent gap
A nightly sweep turns an approaching expiry into a suspension and a notification: affected approvals are revoked, future sessions are suspended, and every affected parent is told. Approval requests batch and respect quiet hours. Suspensions and expiries never batch — those go immediately, at any hour.
What the approval screen shows
The adult
Name and photo, the subject and level, and the format — online one-to-one, or in person.
Each verification, with the date it runs out
Not a green tick. A tick says trust us; a date says when. The check set is read live rather than from a stored flag.
What this adult can see about your child
First name, last initial, age in years. That is the entire list, and it is on the approval screen because it is the part most platforms leave off.
Three answers, weighted the same
Approve, decline, or ask a question first. A consent flow with one obvious button is not consent.
Six moments you are asked — and what happens if you don’t answer
Silence is never taken as a yes. Every row below has a defined outcome for not responding, and none of them is “the session goes ahead”.
A first booking
You are approving: This adult, this child, this subject and level, this format
The booking is held rather than confirmed, and the slot auto-releases after 48 hours.
A substitute tutor
You are approving: A different adult than the one you approved
The session cancels with a full refund. It does not quietly proceed with someone else in the room.
A change of subject or level
You are approving: The new scope
Sessions continue in the scope you already approved, and no further.
A change of format
You are approving: In person to online, or group to one-to-one
It reverts to the format you approved.
A check expires and is renewed
You are approving: The renewed check
That provider stays suspended for your child until you approve again.
Turning the study helper on
You are approving: The helper, for this child
It stays off.
Your consent ledger is append-only
Every grant, decline, revocation and expiry, kept in order and exportable by you. Corrections are new entries carrying a reason, never edits — the same discipline as the record itself. It protects your child, and it protects us the first time something is disputed.
Tutoring opens in Frisco, Texas with the rest of it.
None of it exists yet. This is what launch looks like, described in definite terms because we are building it — not because anyone is using it today. There are no tutors on this page for the same reason: we would rather show you the mechanism than a person we invented.