Privacy policy

Who is responsible

classroom.pet is operated by Edinplay Limited, company number SC881471, at 10 Eastern Avenue, Largs, North Ayrshire, KA30 9EG, United Kingdom. Contact [email protected] for privacy matters.

For school-directed pupil and classroom use, the school or its responsible education authority is the data controller: it decides why the information is used. Edinplay provides the service as its processor under documented instructions. This also applies when an authorised teacher manages a personal teacher account for a school class.

Edinplay is the controller for its own adult registration, business relationships, support correspondence and service-security administration. The same adult may appear in both school-managed classroom records and Edinplay's business records for different purposes.

Before real pupil use, the school and Edinplay must agree the processing terms, the school's retention instructions and the appropriate privacy assessment. The school must provide its own notice and identify its lawful basis. A school may rely on a public task or another appropriate basis; this notice does not choose that basis on the school's behalf. Where feelings or energy information reveals health information, the school must also identify the applicable special-category condition. A signup authority checkbox is not consent to all processing.

Information we use and where it comes from

• Adults: the email address and password you provide at registration; authentication and recovery records; account roles, class assignments, account allocation and teaching preferences. PocketBase stores password hashes for authentication. Invitation records include the invited email, sender, acceptance status and dates.
• Pupils: a generated classroom username, class membership, account identifier and a random six-digit PIN. We do not collect a separate pupil name. Any name-to-username list is kept by the school outside the service. Pupils do not need an email address. PocketBase stores a password hash for PIN authentication. A separate recoverable PIN is kept so assigned teachers can view and print login cards.
• Pets and activities: pet/habitat choices, progress, XP, rewards, unlocked collectible cards, training and activity records linked to a pupil account. The saved game includes activity dates and counts, pet progress, training and unlocked cards. The browser calculates rewards and uploads its current game state; the database does not keep a separate event-by-event reward history. A check-in can award XP, but its session identifier is not saved with the pupil game.
• Classes and check-ins: generated class codes, time zones, login windows, question choices, schedules and display settings; answers processed during submission, temporary participation records, and published class totals as explained below.
• Technical information: sign-in/session identifiers, request and error information, security counters and device-storage settings. Hosting and authentication services may process IP addresses, user-agent/browser information, request times and service logs.
• Support and referrals: your contact details, message and relevant account context when you contact us; referral codes linked to personal accounts and correspondence about any agreed benefit. Do not include unnecessary pupil details.

We receive information from you, the school and its authorised staff, pupils using the service, and the service providers that deliver sign-in and hosting. Pupil usernames are generated independently of names, birthdays or other pupil attributes. These accounts are pseudonymous personal data, not anonymous accounts. The application does not ask pupils for a home address, date of birth, contact email, photograph or medical record.

Adult sign-in details and the required registration fields are needed to create and administer an account. A pupil needs a classroom account to save pet progress. Pupils can choose "Prefer not to say" or close a check-in. Neither signing up nor answering a check-in subscribes anyone to marketing.

Why we use it and our lawful bases

On the school's instructions, we provide classroom accounts, pet activities, check-ins, class summaries and classroom administration. The school establishes the lawful basis for that use and explains it in its own notice.

• Adult accounts and requested services: performance of our agreement with an adult account holder, or steps they request before entering it. When an adult acts for a school rather than personally contracting, our legitimate interest is administering that school relationship and providing its authorised staff with access.
• Support, product feedback and referrals: our legitimate interests in responding to enquiries, resolving problems, improving the service from feedback and administering agreed referral arrangements. Contract applies where the request is needed to perform our agreement with that person.
• Service protection: our legitimate interests in preventing unauthorised access, investigating faults and maintaining a secure service. This includes limited diagnostics and login-abuse controls, not advertising profiles.
• Legal obligations: where we must keep or disclose particular information to meet an applicable legal requirement, such as responding to a binding legal request.

We do not use pupil information for advertising, sell it or use it to train AI models. The application does not make solely automated decisions with legal or similarly significant effects about pupils. It calculates game rewards and class statistics automatically; those are not individual wellbeing diagnoses or risk scores.

How check-ins protect privacy, and their limits

A pupil submits an answer using their current login. The application checks their class and the check-in window, records temporary participation to prevent repeated submissions, and updates the class counters in the same operation. It does not keep a permanent answer row named after the pupil.

Teachers see results only once a session has closed and at least five pupils have participated. A teacher can close a session early. The published totals are fixed, and every chosen feeling or energy category shows its exact count, including one. Teachers cannot view named answer histories, named completion lists or the working counters.

This is not complete anonymity. The operator processes identity and answer together during a request; infrastructure processes connection and timing information. A small group, a count of one or things someone already knows about the class may let them infer an answer. A five-person threshold does not remove that risk.

On successful closure, the temporary participation markers and working counters are removed. A failed closure can leave them pending a retry. Published totals remain with the class. Because they contain no pupil-to-answer link, we cannot retrieve an individual answer from a published summary or subtract it when a pupil is deleted.

Use these results for class conversations, not individual assessment or safeguarding alerts. A child needing help should speak to a trusted adult directly.

Who can access information

Assigned teachers can manage their class's pupil accounts, view and print login details, and see released class summaries. School administrators manage accounts, allocations and teacher access; an administrator role alone does not grant access to a class's pupil list or results. Pupils access their own game data, not teacher analytics or other pupils' accounts.

Authorised Edinplay personnel and service providers may process information where needed to operate, support and secure the service. Application access controls do not mean that the operator can never access data. We may disclose information where legally required, or where necessary and lawful to investigate misuse or protect rights and safety.

Service providers and international processing

PocketBase runs authentication, the database and server logic on a server operated for Edinplay. The production hosting provider, server location and outgoing email provider must be confirmed in the school processing schedule before launch.

Cloudflare hosts and delivers the website and handles web requests and associated technical information. A database server's location does not mean all processing stays in that country: provider networks, support and subprocessors can process information internationally.

Contact Edinplay for the hosting and email providers, their processing terms and the applicable international transfer safeguards. Cloudflare publishes its data-processing terms and subprocessors. Provider terms do not replace the school's agreement with us.

If you email us, your message is processed through our business email service as well as your own provider. Please keep pupil information out of ordinary support email. The beta's provider and retention schedule must cover the selected email service before real pupil information is used.

Device features and security

The optional noise meter analyses microphone sound levels locally in the browser and does not record or upload audio. It needs browser permission. If left enabled, it can restart on returning to the classroom pet page while permission remains allowed. Pause it to stop this, or revoke microphone permission in your browser.

Pupil text-size and font choices stay in the browser tab, not the online pupil profile. Other browser settings can remain on a shared device after sign-out. Our cookies and browser storage policy gives names, lifetimes and controls.

We use authenticated access, class and account permissions, restricted database access and transport encryption. The application's diagnostic messages avoid passwords, tokens, PINs and check-in answers. Hosting logs are separate. No service can guarantee absolute security; tell us promptly about suspected unauthorised access without emailing credentials.

How long information stays

• Pupil accounts and game records: kept while the school needs the account, until an authorised pupil/class deletion or the school's agreed end-of-service deletion instructions are carried out. There is no automatic age-based or school-year-end deletion. The school should review its pupil roster when pupils leave.
• Class summaries: kept with the class until it is deleted or an agreed school retention instruction is carried out. Deleting one pupil does not remove their contribution from an existing summary. Changing the school-year filter only changes what the charts display.
• Temporary check-in records: removed when the session is successfully closed, as described above. Late submissions are rejected at the deadline; the scheduled cleanup runs once a minute while PocketBase is running.
• Adult accounts, memberships and invitations: kept to administer access until the relevant account or relationship is removed. Invitation links expire after seven days, but the invitation record is not automatically deleted on expiry.
• Support, feedback and referral correspondence: needed to resolve the request and any connected follow-up, complaint or dispute. Any longer retention must be justified by that purpose or an applicable legal obligation, rather than keeping correspondence indefinitely by default.
• Security and provider records: sign-in, infrastructure and diagnostic records have separate lifecycles. Application PIN-attempt counters are reset on successful login or a PIN reset, and replaced when a later failed attempt starts a new counting window. They do not have a guaranteed 24-hour deletion deadline.

Deleting live application records does not itself erase provider logs or any recovery copies. Provider log, recovery-copy and business-email retention must be recorded in the beta processing schedule before real pupil use; we do not promise an unverified erasure period.

Deleting or leaving an account

Assigned teachers can delete pupils using the pupil-management controls. Deletion removes the pupil's live account, credentials and linked game records. Authorised school administrators can delete classes, which also removes their pupils and class summaries.

Adults can request deletion through the account controls. A solely owned personal teacher account's classes and pupils are removed with it. School owners and owners of shared personal accounts must arrange ownership transfer first; removing a teacher does not delete school classes merely assigned to them. Contact us if deletion cannot complete or for school-wide return and deletion arrangements.

Ask for a copy of information you need before deleting it. Clearing browser storage or signing out does not delete online records, and online deletion does not clear every entry on a device.

Your rights and how to use them

Depending on the information and lawful basis, you can request access, correction, erasure, restriction or a portable copy of information. These rights have conditions and exemptions. Where processing relies on consent, it can be withdrawn without affecting earlier lawful processing.

Your right to object: you can object to processing based on legitimate interests, for reasons relating to your situation. Contact us and explain what processing concerns you so we can consider your request.

For pupil and school-controlled records, contact the school's privacy lead. For Edinplay-controlled records, or if you are unsure, email [email protected]. A parent or representative can ask on a child's behalf where authorised; the rights belong to the child. We may need proportionate checks of identity and authority. Do not send passwords, PINs or identity documents with your first message.

We normally respond to rights requests within one month. If a lawful extension or clarification is needed, we will explain it. Requests are normally free. We assist schools with requests for information we process for them.

Complaints and updates

Email us with "Privacy complaint" to raise a concern. We acknowledge complaints within 30 days, investigate without undue delay, keep you informed and explain the outcome. You can also contact the Information Commissioner's Office, including if you are unhappy with our response.

We update this notice when the service or its handling of information changes. The date above identifies this version. Material changes will be brought to affected adults' attention; schools should explain relevant changes to pupils and families.