Privacy Policy

Common Denominator is a registered 501(c)(3) tax-exempt organization. Our employer identification number is 75-3062601. We provide free math tutoring for New York City middle school students, in person and online.

Our mailing address is P.O. Box 2009, New York, NY 10163. You can email [email protected] or call 201-241-2910.

In this policy, “Common Denominator,” “we,” and “us” mean Top Honors Inc., doing business as Common Denominator.

This policy covers:

• Visitors to the public pages on cdmath.org.
• People who send a volunteer inquiry, join the mailing list, or ask about a school partnership.
• Donors who open our donation form from this site.
• Volunteer tutors, school coordinators, and program staff who have an account.
• Students and families whose information a partner school or a parent or guardian shares with us so a student can receive tutoring.

The public site includes our home page, program information, news, mailing list, volunteer inquiry, and school partnership inquiry. Accounts for tutors, school coordinators, and administrators are created by invitation.

Website visits

When you browse cdmath.org, our hosting provider receives ordinary technical information, including your IP address, browser type, and the page you request. We use that information to operate the site, protect it, and fix errors. The public site does not use advertising cookies or third-party analytics.

If a sign-in step or a page in the signed-in area fails, the browser can send us a short error report with the page address and technical details. We use the IP address of that request, and of repeated sign-in attempts and public form submissions, to limit abuse. Those rate limits are held in memory for a short time. They are not written to the program database.

Public forms

The forms on the public site collect only what you type into them.

• A volunteer inquiry includes your first name, last name, email address, an optional phone number, and your answer to why you want to tutor. We email a confirmation to you and send the inquiry to our staff.
• A mailing-list signup includes your first name, last name, and email address. We email that signup to our staff so we can send you program news and updates.
• A school partnership inquiry includes your first name, last name, email address, an optional phone number, the school name, your relationship to the school, and your message. We email a confirmation to you and send the inquiry to our staff.

We keep a copy of each of those emails, including the personal information in the message. Our email provider delivers them.

Donations

The Donate link and the background-check administrative fee open a donation form hosted by Zeffy. Zeffy collects payment information. We do not receive your card number. Zeffy may share with us the name, email address, and donation details we need to record the gift or confirm the fee. Payment details are handled under Zeffy's privacy policy.

Accounts

We create an account when we invite someone to join as a tutor, a school coordinator, or a member of program staff. An invitation includes the email address and the role. After you sign in, your profile can include your name, phone number, mailing address, a short bio, and a profile photo.

If you sign in with a password, we store a one-way hash of that password. We cannot read your original password from that hash. If you turn on two-factor authentication, we email you a one-time code when you sign in and when you turn the feature off. Password-reset and email-change tokens are stored as hashes until they expire or are used.

If you sign in with Google, we receive the email address, name, and profile image on that Google account, plus the account identifier and tokens needed to keep the connection. Google sign-in works only for an email address that already has a Common Denominator account. Google describes its own practices in the Google Privacy Policy.

You can ask to change the email address on your account. We send a confirmation link to the new address and a notice to your current address. The change takes effect only after the new address is confirmed.

Volunteer onboarding

If we invite you to continue after a volunteer inquiry, the application in your account asks for the information we need to decide whether you can tutor children. Applicants must be at least 14 years old.

The application asks for contact and identity information, your background and experience, your availability and tutoring preferences, an emergency contact, and the screening answers we use to protect students. Applicants who are 18 or younger also provide a parent or guardian's contact information. You acknowledge the agreements that apply to volunteering, including a media waiver for photographs and video of volunteers used for program promotion and fundraising.

Onboarding can also include references, a government-issued photo ID, a background check, signed program agreements, and other documents we request. An administrator emails you a login for the background-check service we use. You complete the check there. There is a one-time administrative fee, paid on the Zeffy donation form. When you certify the application or sign an agreement, we keep a record of that action. A program administrator may sign an agreement on a tutor's behalf, and we record which administrator did so.

Students and families

Students do not create accounts on cdmath.org. A partner school, its coordinators, or our staff enter the student information we need to enroll the student and run tutoring. Program staff may keep internal notes about an application.

Before tutoring begins, the school provides a student application that a parent or guardian completes and signs. That form includes family contact information, information about the student that we need in order to tutor safely, and the parent or guardian's choices and certification. The school may also provide assessment results, which we use to plan individualized instruction.

During the program we record the student's participation, including the cohort and tutor assignment, attendance, and session notes. Coordinators and staff can see the attendance and session notes for sessions at their school.

We also keep contact information the partner school provides.

Program records

We record which curriculum modules a signed-in user opens. We keep an audit log of actions in the program. The log includes the actor's name and email address and a record of the change, which can include the personal information that was updated.

We keep a copy of operational email we send, such as invitations, password setup, session reminders, absence notices, and student application decisions sent to coordinators. A message about a session or an application can include the student's name. Our email provider delivers those messages.

After a cohort accepts a tutor, school coordinators for that school and the other tutors in the cohort can see that tutor's name, email address, photo, and bio. Tutors in a cohort can see the first name, last name, and grade of students in that cohort. They can record attendance and session notes for the students they tutor.

Program staff can export reports for internal operations. Those reports can include the program records described in this policy.

We use information to:

• Operate the website and the tutoring program.
• Review volunteer inquiries and school partnership inquiries.
• Send mailing-list updates to people who ask for them.
• Invite users, sign them in, and protect accounts.
• Screen volunteers who will work with children.
• Match tutors and students, schedule sessions, and track attendance and progress.
• Send the operational messages the program requires.
• Confirm donations and background-check fees.
• Prepare internal reports for program staff.
• Share aggregate program information with current and prospective funders. Aggregate information does not identify a student.
• Keep the records we need for child safety, nonprofit administration, taxes, and legal claims.
• Detect, investigate, and prevent abuse of the site.

We share personal information with:

• Program staff who need it to run Common Denominator.
• A partner school and its coordinators, for the students and cohorts at that school.
• Tutors, limited to the cohort information described above.
• The service providers in this policy, so they can perform services for us.
• The background-check service we use, for volunteer screening.
• Zeffy, when you choose to donate or pay the background-check fee.
• The meeting service named in a virtual session link, when someone joins that meeting.
• Current and prospective funders, in aggregate form that does not identify a student.
• A partner school, a public authority, or another person when we believe disclosure is required by law, needed to protect a child, or needed to protect the rights, safety, and integrity of the program.

We do not sell personal information. We do not share personal information so advertisers can target people on other websites. We do not use student information to market to students or families.

Student information we receive from a partner school, or from a parent or guardian form collected for that school, is used to provide free math tutoring and to administer that school's participation in the program.

Tutors, coordinators, and staff can see the student information their role requires. Volunteers who will see confidential program information sign a confidentiality agreement and a child protection policy before they work with students.

We do not sell student information. We do not use it for marketing or advertising. A service provider may process student information only to host the program, store documents, deliver email, or keep operational logs. We do not authorize a service provider to use student information for its own marketing.

A parent or guardian who wants to review a child's education records should start with the child's school. You may also contact us about the student information we hold. We will work with the partner school on a request to access, correct, or delete that information. We may retain records we are required to keep for child safety, school administration, or law.

If we learn of unauthorized access to student information, we will notify the affected partner school and take the further steps required by law.

Photographs and recordings of children require prior written consent from a parent or guardian. The student application collects that consent. It describes the purposes for the images, and a parent or guardian may decline the images, the use of the student's first name, or both. Our child protection policy requires images of children to be respectful and appropriate for an educational setting. Volunteers do not photograph children on personal devices unless Common Denominator has authorized it and the consent form allows it. Authorized images are turned over to Common Denominator and removed from the personal device.

cdmath.org is written for volunteers, donors, schools, and families. It is not a site for children under 13 to use on their own. Children do not register for accounts. Partner schools and parents or guardians provide student information. Children do not submit that information by signing up on the website.

Volunteer applicants must be at least 14 years old. Applicants who are 18 or younger provide parent or guardian contact information as part of the application.

If we learn that we have collected personal information directly from a child under 13 through the website, we will delete it. Email [email protected] if you believe that has happened.

Volunteer screening includes a government identification image, date of birth, criminal-history information, and answers about substance-abuse treatment and conditions that could affect safe tutoring. We use this information to decide whether an applicant can volunteer with children, to meet our background check policy, and to protect students.

Access to screening records is limited to staff who review applications and to the systems that store those records. Background-check results, identification images, and related correspondence are kept confidential.

The student application also contains sensitive information, including health conditions and an optional ethnic background question. On the website, student files can be opened only by the school's approved coordinators and by program staff. Tutors cannot open student files through the website.

We use cookies only so invited users can sign in. Our public pages do not set cookies of their own.

• A session cookie holds the signed-in session. It is httpOnly, so page scripts cannot read it. On the production site it is sent only over HTTPS.
• A security token cookie protects the login and sign-out forms against forged requests from other sites.
• During Google sign-in, short-lived cookies carry the sign-in state and the page to return to. The cookie that records that you are logging in expires after five minutes. The cookie that stores the page to open after you sign in expires after fifteen minutes.

These cookies are set by the sign-in system and are httpOnly. We use cookies to keep you signed in. We do not use them to advertise to you on other websites. If your browser blocks cookies, the signed-in areas of the site will not work.

We use the following providers to run cdmath.org and the tutoring program.

• Google provides Google sign-in and Google Drive storage for uploaded documents, signed records, and profile pictures.
• Zeffy processes donations and the background-check administrative fee.
• A background-check service screens volunteers. We email you the login for that service when you reach that step. The service processes the information you submit there under its own instructions and privacy terms.
• Zoom, or another meeting service named by the school or by our staff, may host a virtual tutoring session. We store the meeting link or the in-person location on the cohort record. Information created inside the meeting is handled under that service's privacy policy. Zoom describes its practices in the Zoom privacy policy.

LinkedIn is linked from our footer. We do not send your information to LinkedIn when you view our pages. If you open that link, LinkedIn's privacy policy applies to your visit there.

The website is served over HTTPS. Access inside the program depends on your role. Passwords are stored as hashes. Two-factor authentication is available by email. Documents and profile pictures are stored in Google Drive and opened through the application, which checks your role before it returns a file. Data moves between the application, the database, Google, and our email provider over encrypted connections.

No method of storage or transmission is perfectly secure. Use a strong, unique password for your account. Email [email protected] if you believe your account has been compromised.

We keep information for as long as we need it for the purposes in this policy. That includes operating the program, protecting children, keeping volunteer screening and incident records, administering the nonprofit, meeting tax and legal duties, and resolving disputes.

When a person leaves the program, staff may archive the account. An archived person cannot sign in. We keep the account record, including a snapshot of the person's role, so we can restore the account or keep a record of past participation. A student can also be archived. An archived student leaves the active roster, and the student record remains.

Staff can also delete a user, student, school, cohort, or session record. When a deleted record has its own uploaded files, we delete those files from Google Drive. Deleting a user also deletes the copies of email we sent to that address. Deleting a coordinator or tutor account does not delete student records, student documents, or session notes. Audit log entries keep the name and email address of the person who took each action.

Public inquiries and mailing-list signups stay in our email records. You can ask us to stop mailing-list messages. We will still keep operational records we need for the reasons above.

When a school partnership ends, the school may ask us to return or delete student information we no longer need for the program. We will return or delete what we can. We will keep records we are required to retain.

Email [email protected] to ask what personal information we hold about you, to correct it, to ask us to delete it, or to stop mailing-list messages. We will respond to a request about your own information. For student information that came from a school, we will respond together with that school, including when a parent or guardian makes the request.

We may decline a request when we need the information to operate the program, protect children, comply with the law, or establish or defend a legal claim. After you sign in, you can update your profile, password, photo, and two-factor setting yourself.

You can also delete your own account from your profile page. That removes your account, your profile photo, your pending invitations, and the copies of email we sent you. For a tutor, it also removes your application, references, signed agreements, and the documents in your volunteer file. Student records are not removed. Student documents a coordinator uploaded stay with the student, and session notes a tutor wrote, attendance, and session records remain without a link to the deleted account. Audit log entries that record your past actions keep your name and email address. The last remaining administrator cannot delete their own account.

If you use Google to sign in, you can also review the Common Denominator connection from your Google account.

Our pages link to Zeffy, LinkedIn, and, for some cohorts, a video meeting. Those sites collect information under their own privacy policies once you leave cdmath.org. This policy covers information collected on cdmath.org and in the tutoring program we operate here.

We will post any update on this page and change the effective date. If a change materially affects how we use student information received from a partner school, we will also tell that school.

Privacy questions and requests go to: