The short version
- The free device build keeps everything on the device it was entered on. Nothing is uploaded to us.
- A hosted school account stores the school's data on our servers in the United Kingdom (Microsoft Azure, London). We are the school's processor under a written data processing agreement; the school stays the controller.
- The app contacts no third party. No analytics, no advertising, no tracking, no AI service, no fonts or code loaded from anyone else. The browser is told to enforce this.
- This website (the pages about ClassDrop, not the app) uses cookieless Cloudflare Web Analytics to count visits. No cookies are set anywhere.
- We do not sell, share, or reuse children's data for product development, advertising or AI training, and commit to that in writing with every school.
1. Who we are and what this covers
ClassDrop is made by Primary Coding League CIC, a community interest company in the UK. This notice covers three things: the website at classdrop.co.uk, which describes the product; the ClassDrop app at classdrop.co.uk/app, which teachers, pupils and parents use; and hosted school accounts, where a school's ClassDrop data is kept on our servers so that it syncs between devices.
It is written for the adults who decide whether a school uses ClassDrop, for the parents and staff whose data a school might enter into it, and (in section 8) for the children who use it.
2. Roles: who is responsible for what
A school decides why and how its pupils' data is processed, so for anything entered into ClassDrop by a school, the school is the controller under UK GDPR. If you are a parent or pupil with a question about your own data in ClassDrop, your school is the right first contact, and this notice is written to help the school answer you.
For a hosted school account, Primary Coding League CIC is the school's processor, acting only on the school's documented instructions under Article 28 UK GDPR. Every hosted school signs our data processing agreement before its data reaches us. It lists what we process, where, for how long, our security measures, and every other company involved.
For the website itself, and for any enquiry you send us, Primary Coding League CIC is the controller.
3. Where the data actually is
3.1 The device build
Used without an account, ClassDrop is a single-page application served as static files. Everything a teacher, pupil or parent enters is stored in that browser's own storage on that device (IndexedDB, falling back to localStorage). Nothing is sent to us.
We checked this rather than claiming it: in device mode the app makes no request that transmits user-entered data anywhere, and the page carries a Content Security Policy that tells the browser to refuse any connection except to classdrop.co.uk and, for hosted accounts, api.classdrop.co.uk.
| Data at rest | In the browser profile on the device used |
|---|---|
| Data in transit | No personal data is transmitted |
| Backups | None. Clearing the browser's site data erases everything. The app has a manual export |
| Shared devices | Anyone using that browser profile can open the data. Sign-in is a demonstration account picker, not authentication |
3.2 Hosted school accounts
When a school signs up for a hosted account, its ClassDrop data is stored on our servers and each device keeps a working copy that syncs with them. Staff sign in with email, password and two-step verification; pupils on class devices with a class code and PIN; parents with a code the school prints.
| Where | Microsoft Azure, UK South region (London): the application server, a PostgreSQL database for records, and blob storage for photos, video and voice notes. Nothing leaves the United Kingdom |
|---|---|
| In transit | HTTPS only, TLS 1.2 or later, between the app and api.classdrop.co.uk |
| At rest | Database and media storage encrypted by the platform. Passwords and PINs stored only as scrypt hashes; sign-in tokens only as SHA-256 hashes |
| Backups | Automated database backups with point-in-time restore for 35 days; media soft-deleted for 35 days before it is gone. Restore is tested each term |
| Who can see it | Only people the school has given access to, by role: staff see their school; a pupil or parent receives only that child's own work, the class's shared folder and classmates' point totals; safeguarding records go only to the designated safeguarding lead and the member of staff who reported them, and every read is logged. Our own access is limited to named staff with multi-factor authentication, used for operating the service, never for looking at a school's records |
| Shared devices | A pupil's sign-in lasts one day, and a class device signs itself out after 20 idle minutes and wipes its local copy |
4. What personal data ClassDrop can hold
Taken from the application's own data structures. A school controls which modules are switched on, so a school that does not use a module collects none of that module's data. In a hosted account we store exactly these records for the school, plus staff email addresses, hashed credentials, and a log of sign-ins and of who read safeguarding records.
| Module | Personal data | About whom |
|---|---|---|
| Accounts and classes | Names, role, school, class membership, parent–child links, join codes | Staff, pupils, parents |
| Work and hand-ins | Pupil work: text, photographs, video, voice recordings, drawings. Images and voice often identify a child directly | Pupils |
| Feedback and discussions | Teacher comments, stickers, voice notes, pupil discussion posts and the moderation log | Pupils, staff |
| Gradebook, markbook, reports | Grades, levels, comments, attainment, end-of-year report content, attendance figures | Pupils |
| Behaviour points | Awards and totals per child, awarding staff member, timestamps | Pupils, staff |
| Reading | Reading log entries, books borrowed and returned, ratings, dates | Pupils |
| Times tables | Every answer with the time taken, derived fluency, predicted check scores, and per-pupil access arrangements (which may indicate a special educational need) | Pupils |
| Seating and class screen | Seating positions, keep-apart pairs, group arrangements | Pupils |
| Safeguarding | Concern records: category, narrative, body map, actions, decisions, outcome, case notes and audit trail. This is special category data and may include data about criminal offences | Pupils, family members named, reporting staff |
ClassDrop does no automated decision-making with legal or similarly significant effects. Predicted multiplication-check scores are an estimate shown to a teacher alongside the amount of practice behind them, never used to place, group or assess a child automatically.
5. Who else is involved
The app itself makes no request to any third party: not for fonts, not for analytics, not for the libraries that render a PDF or Word document. All of it is served from our own domain. A child using ClassDrop discloses their IP address to nobody but the site itself and, for a hosted account, our own API.
For hosted accounts, these companies are involved, all listed as sub-processors in the data processing agreement, which we update with 30 days' notice to schools:
| Company | What they do | Where | School data? |
|---|---|---|---|
| Microsoft (Azure) | Hosts the server, database, media store and backups | UK South, London | Yes, all of it, encrypted, in the UK |
| GitHub (Pages) | Serves the app's program files to browsers | Global content delivery | No. School data never passes through it |
| Cloudflare | Counts visits to the website pages, without cookies | Global | No. Not used in the app |
| Microsoft 365 | Hosts our hello@classdrop.co.uk mailbox for support correspondence | United Kingdom | Only what a school chooses to email us. We ask schools not to email pupil data |
The website
The pages about ClassDrop (this page and the front page, not the app) use Cloudflare Web Analytics to count visits. It is cookieless, sets no identifier, and does not track individuals across sites. Visitors to those pages are adults reading about the product, not children using it. Cloudflare receives the visitor's IP address in the course of serving the beacon, as any web server does.
Cookies
Neither the app nor the website sets cookies. The app stores its data and, for a hosted account, its sign-in token in the browser's storage, which is not a cookie and is sent only to our own API with each request.
6. Children
ClassDrop is designed for primary-aged children, so the ICO's Age Appropriate Design Code applies to it. In plain terms:
- No advertising, anywhere in the product.
- No third-party tracking or profiling.
- No AI features. No pupil data is sent to any AI service. If that ever changed it would be a material change needing the school's prior agreement and a fresh data protection impact assessment.
- No selling or sharing of data, and no reuse of children's data for product development, analytics or AI training. This is written into every school's data processing agreement.
- No nudge design. Leaderboards can be switched off per class; there are no streaks, coins or collectables designed to extend use.
- Shared devices are treated as shared. A pupil's sign-in ends by the next morning and a class device signs itself out after twenty idle minutes.
7. Retention, access and deletion
- Device build: data stays in the browser until someone clears it. There is no automatic retention rule. The school's own retention schedule governs. The "Reset demo data" button, or clearing the browser's site data for classdrop.co.uk, erases everything on that device.
- Hosted account, while it runs: records are kept until the school changes or deletes them. Deleted records leave a marker with no content for 90 days so that every device catches up, then that goes too. Photos and files no one refers to any more are removed automatically. Sign-in and safeguarding access logs are kept for six years, then purged. Staff and parent sign-ins last 30 days, pupils' one day.
- Hosted account, when it ends: the school can export everything beforehand from within the app. We keep the school's data for 90 days after the subscription ends, so a school that renews late loses nothing, then delete it, backups included as they expire. A school can ask us to delete sooner.
- Safeguarding records cannot be deleted from within the product, by design, because they must usually be retained for many years. When a pupil is erased, their safeguarding records are kept and only the designated safeguarding lead can decide their fate.
- Subject access and erasure: the school office can download everything held about one pupil as a single file, erase a pupil, issue a new parent code, export the whole school, or delete the school, from within the app. Each of these is logged.
8. For children: what happens to your work
When you use ClassDrop, your work, your answers and your reading log are saved so that your teacher can see them. If your school has a ClassDrop account, they are kept on a computer in the United Kingdom that only your school can open. They are not sent to any other company, and nobody uses them for adverts.
Your teacher can see your work, because it is their job to help you. Your parents may be able to see it too. Your classmates can only see the things you choose to put in the class's shared folder. Nobody else can.
ClassDrop has no adverts, and it never tries to keep you playing longer than your teacher wants. If you walk away from a class iPad, it signs you out by itself. If something in ClassDrop worries you, tell your teacher.
9. Your rights
Under UK GDPR you can ask to see the personal data held about you, have it corrected, have it erased, and object to or restrict its processing. For data a school has entered into ClassDrop, make your request to the school, which is the controller and holds the data; the school has the tools to answer it from within the app, and we help the school where it needs us to. For anything we hold about you as a website visitor or correspondent, contact us (section 11). You can also complain to the Information Commissioner's Office at ico.org.uk.
10. Security
The site and the API are served over HTTPS only. The app carries a browser-enforced Content Security Policy that blocks connections to any domain but ours. The libraries the app uses are served from our own domain and kept patched. Staff accounts have two-step verification; new passwords are checked against a list of common choices; repeated failed sign-ins are slowed down. Every request to our API is checked against the person's role before anything is returned, and removing a person from the school's records withdraws their access at once.
If we become aware of a personal data breach affecting a school's data we tell the school within 24 hours, so that the school can meet its own 72-hour duty to the ICO, and we support its investigation. Our incident procedure, backup arrangements and security measures are set out in Annex B of the data processing agreement. Cyber Essentials certification and an independent security review are planned; neither is a legal requirement, and we will publish the dates when they are booked.
If you find a security problem, please tell us first: our contact details are published at /.well-known/security.txt.
11. Contact and changes
Primary Coding League CIC, a community interest company registered in England and Wales, company number 16512013, registered office Avenue Bernard, Brackley, NN13 6LN. We are registered with the Information Commissioner's Office as a data controller, registration number ZC005345. We are not required to appoint a statutory Data Protection Officer; our data protection lead is Charlie Mackenzie, reachable at hello@classdrop.co.uk for anything about this notice, a rights request about data we hold, or to report a breach.
We will update this notice when ClassDrop changes in a way that affects personal data, and the date at the top will change with it. Items marked confirm are genuinely unresolved; please treat them as open until they are settled in writing.