Security and data protection

For school leaders, data protection officers and IT teams: how UDoodle keeps pupils’ work and personal data safe, in plain English. Our Privacy Policy and Data Processing Agreement give the full detail.

Last updated: 10 November 2026

1. At a glance

No pupil emails or passwords. Pupils sign in by tapping their name on a class tablet, or with their sign-in card or 4-digit code.
Pupils see only their own work and the shared whiteboards their teacher adds them to.
No adverts, no tracking cookies, no selling data, and pupils’ work is never used to train AI.
Our own servers. UDoodle runs on servers that we own and run ourselves in the Channel Islands, under Guernsey’s data protection law, which the UK and the EU recognise as giving adequate protection. No outside company hosts pupils’ work.
Backed up every night to a second server that we own, with a standby copy ready to take over if the main server fails.
Your school stays in control. You decide who is added, who can see their work, and when it is deleted.

2. Who can see pupils’ work

A pupil’s notebooks can be seen by:

the pupil;
their class’s teachers, unless the class’s owner turns this off for that pupil;
on a school plan, the school’s UDoodle admin, who sets up the school’s classes;
up to two parents or guardians per pupil, if a teacher invites them. They can look but not change anything, and they see only their own child’s work.

Pupils can’t see each other’s notebooks, and nobody outside your school can find or open them. Every request is checked by the database itself, so each person can reach only what they are allowed to, whatever device or link they use.

The people who run UDoodle can reach account data only to provide support, fix problems, keep the service secure or meet a legal duty. They sign in with one-time codes, and changes they make to accounts are logged.

3. How pupils and staff sign in

Staff sign in with a one-time code sent to their email, so there are no passwords to guess, reuse or leak.
In class, pupils tap their name on a tablet their teacher has set up for the class. A tablet joins a class only with a code from the teacher, or when the teacher lets it in, and a lost tablet can be switched off for the class straight away.
Anywhere else, pupils scan the QR code on their own sign-in card or type their 4-digit code. Codes and card keys are stored encrypted (AES-256), and too many wrong codes lock the account for a while.
On shared devices, a pupil is signed out after 10 minutes without use, so the next child can’t carry on in their notebooks.

4. How the data is protected

Everything travels over an encrypted connection (HTTPS).
Each school’s classes, pupils and notebooks are kept apart by rules in the database, which checks every request.
Repeated attempts to guess codes, sign in or set up tablets are limited.
Visitors reach our servers only through Cloudflare, which protects them from attacks.
Our servers check themselves regularly and email us if something needs attention. UDoodle is also checked every minute from outside our own systems, and you can see the result at status.udoodle.co.uk.

5. Backups and keeping UDoodle running

Every night a copy of UDoodle’s data is saved to a second server that we own, also kept in the Channel Islands, which only we can sign in to. Each copy is kept for 30 days.

We also keep a regularly updated, encrypted copy of the database on separate hardware, so that if the main server fails we can bring UDoodle back with up-to-date work.

If a tablet loses its connection, pupils can keep writing: their work is kept on the tablet and uploads when the connection comes back. Teachers can download any notebook as a PDF at any time.

6. Keeping and deleting data

Pupils who leave are archived first, so their work can still be read, and their teacher can then delete them for good.
When a school closes its account, we keep everything for 30 days in case it changes its mind, then delete it permanently. Copies leave our backups within a further 30 days.
A free trial that isn’t upgraded becomes read-only, and is deleted 90 days later.
If a paid plan lapses, nothing is deleted: notebooks stay readable and can still be downloaded.

Our Privacy Policy lists exactly what we keep and for how long.

7. Who else is involved

Pupils’ work and details are stored only on our own servers, and no outside company stores them for us. Three providers help in limited ways:

Cloudflare carries the encrypted connection between devices and our servers, and protects them from attacks. Pupils’ work and details pass through its network on the way, but aren’t kept there.
Resend delivers our emails, which only ever go to adults. An invitation to a parent or guardian names the pupil and their class, so that they know which child it is about.
PayPal takes payments, and sees only the details of the person paying. We never see card or bank details.

Section 6 of our Privacy Policy lists them, and we keep that list up to date.

8. If something goes wrong

If we ever find a breach affecting a school’s data, we will tell the school straight away, so that it can meet its own duties, and the Office of the Data Protection Authority within 72 hours where the law requires it.

If UDoodle isn’t working, status.udoodle.co.uk shows what is happening. It runs separately from UDoodle, so it stays up even when UDoodle is down.

If you find a security problem in UDoodle, please tell us at [email protected].

9. Paperwork for your school

Data Processing Agreement: our Data Processing Agreement sets out our commitments as your processor. It applies automatically when your school uses UDoodle, and we can send you a signed copy if you need one.
Data protection impact assessment (DPIA): we are happy to help. Email us your questions or your school’s questionnaire, and we will answer them.
Your privacy notice: your school’s own privacy notice should mention UDoodle. You can draw on our Privacy Policy, which describes what we hold.
Any other questions: email [email protected]. UDoodle is built and run by a school IT manager, so we know what your data protection officer is likely to ask.