Three Emails That Made Us Rebuild Permissions: Sharing a Student Profile with Mom, a Tutor — or the Kid

Three emails shaped this feature more than any roadmap workshop did.

The first was from a mother who put it plainly: "I'm not trying to run my husband's account. I just want to see how the kids are doing without texting him for screenshots." The second came from a parent who'd hired a tutor and discovered the only safe options were terrible — either the tutor practiced inside the family account (a stranger living inside your login) or the parent relayed assignments by hand. The third was from a family whose sixth grader wanted her own login "like a real account" — but twelve months of practice history lived in the parent's account, and nobody wanted to start from zero.

All three were the same underlying gap: a student profile could belong to exactly one account, and everyone else had to either log in as you or see nothing. Today that's fixed. You can share any student profile with another Bright Drill account — by email — at three levels, and take the access back at any moment. Here's how we thought about it, because the levels are the feature.

Three levels, three real situations

Viewer — for the second parent (or a grandparent). They see progress, results, the error notebook, and the plan. They change nothing. This is the "I just want to know how the kids are doing" tier, and it's deliberately read-only down to the database, not just the interface.

Tutor — for the professional you hire. A tutor gets everything a Viewer has, plus the ability to actually work: create practice sets, mock exams, and study journeys, and assign them with deadlines. Anything a tutor creates is stamped with who made it, so the family always knows what came from whom. And a boundary we're fond of: a tutor's AI usage draws from the tutor's own plan, not yours. They're a professional with their own account; their tools bill to them.

Co-owner — for the student's own account. This is the tier for the sixth grader with her own email. She gets nearly everything the owner can do on her own profile — practice, plans, notebook, friends — from her own login. The history comes with her, because it's the same profile. And it quietly solves the sibling problem: when each child uses their own account and sees only their own shared profile, the "keep the six-year-old out of the ten-year-old's streak" PIN dance on the family tablet becomes optional instead of load-bearing. The PIN stays for the one-device shared-login world; separate logins make it the backup, not the fence.

One rule spans all three levels: only the owner manages sharing. A co-owner child can't kick the tutor out, a tutor can't invite colleagues, and nobody can re-share a profile beyond the person it was shared with. Deletion stays with the owner too. Access can be delegated; accountability can't.

Designed so you don't have to be careful

Permission systems fail when they make the safe thing annoying. So the defaults do the guarding:

• Sharing is an invitation, not an instant grant — the other account has to accept, and the invite link only works for the email it was sent to. A typo means a dead invite, never a stranger with your kid's data.
• Revocation is instant. The moment you remove someone, their next page load is their last — no lingering sessions, no "I'll get to it." Expiry dates (say, 90 days for a seasonal tutor) do this automatically.
• Privacy has hard lines. AI-coach conversations stay within the family — a Viewer never sees them, and a Tutor sees only threads they started themselves. Sharing grants are capped per plan, and everything lives in one Shared access page: who has access to what, at which level, expiring when.

You'll find it all without hunting: a Share button sits on every student card on the dashboard, the same panel lives inside each profile's edit screen, and the header menu has Shared access for the account-wide view. The person you invited gets a clean pending-invite card and, after accepting, a profile that's always clearly labeled — a banner says who shared it and what they can do, so nobody ever wonders which hat they're wearing.

Shipped because you asked, improved because you will

Profile sharing went from request to release in a couple of months, and it will keep evolving the same way — finer-grained controls, a richer view of who did what, the details families ask for as real households use it. That's the operating mode here: BrightDrill ships improvements continuously, and the fastest path into a release is still a parent or tutor telling us what's awkward.

If any of those three emails could have been written from your kitchen table, the fix is ready: dashboard, Share button, email, done. And if the level you need isn't quite the level we built, say so — we're listening, and history says we move.