Kudopop privacy notice
Last updated: October 2026 Version: 1.0.0
This privacy notice explains how Kudopop processes personal data when teachers, schools, and pupils use the platform, and when visitors view our public website.
1. Who we are and our role
Kudopop is developed and operated by Terry James Thorpe Publishing (enkeltpersonforetak, Org. nr. registered in Norway).
Depending on how you interact with Kudopop, our role under the General Data Protection Regulation (GDPR) differs:
- For school and pupil use: The school owner (the municipality, county council, or independent school board) is the Data Controller (behandlingsansvarlig). Kudopop processes pupil and classroom information solely as a Data Processor (databehandler) under a binding Data Processing Agreement.
- For teacher accounts and direct enquiries: Terry James Thorpe Publishing acts as the Data Controller for teacher registration details and direct communications with us.
If you have questions about privacy, email our data protection team at [privacy@kudopop.com](mailto:privacy@kudopop.com).
2. Personal data we process
We apply the principle of data minimisation (GDPR Article 5) strictly:
Pupil information
Kudopop is designed specifically to function without collecting direct personal identifiers from children:
- Fictional nicknames: Pupils are represented by generated names such as Rocket Waffle or Solar Lynx. Real names stay on paper in the teacher's classroom and are never sent to our servers.
- No accounts or credentials: Pupils do not create accounts, enter email addresses, or set passwords.
- Classroom progress: Points earned, routine tick-offs approved by the teacher, flame counts (days with checked work), and Kudoki unlocked on the Explore map.
- Camera scanning: When a pupil scans a QR code to join on a tablet or laptop, the camera stream is decoded entirely within the local web browser. No photos or video frames are ever recorded or transmitted.
Teacher information
- Account details: Email address and a cryptographically hashed password managed by Supabase Auth.
- Classroom configuration: Class names, custom routine definitions, rewards created for the class shop, and approval timestamps.
- Optional profile information: An optional teacher display name.
Technical and connection data
- Access logs: Standard server logs (IP address, user-agent, timestamp) necessary to maintain service availability and security. Logs are rotated and purged automatically.
3. Cookies and browser storage
Kudopop does not use advertising cookies, marketing pixels, or commercial tracking scripts.
We use browser `localStorage` strictly for essential application functions:
| Key | Purpose | Duration |
|---|---|---|
| `appLanguage` | Remembers your chosen language (`en`, `nb`). | Persistent until cleared in browser settings. |
| `appTheme` | Remembers your light or dark appearance choice. | Persistent until cleared in browser settings. |
| `kudopop-auth` | Stores the active authentication session so devices remain signed in. | Session lifecycle / until manual logout. |
| `kudoPupilSound` | Remembers audio effect preference (`on`, `off`). | Persistent until cleared. |
| Functional UI keys | Remembers non-personal layout states (such as desk folding or tutorial seen flags). | Persistent until cleared. |
4. Sub-processors and data location
All pupil and classroom data is stored and processed exclusively within the European Union / European Economic Area (EU/EEA).
Our primary infrastructure partners are:
- Supabase Inc.: Core database hosting (PostgreSQL), authentication, and realtime message synchronization, hosted in AWS Dublin (`eu-west-1`), Ireland.
- Vercel Inc.: Static website asset delivery and Content Delivery Network (CDN) with primary European compute routing in Dublin (`dub1`).
Our complete, maintained list of infrastructure providers and geographic locations is published at [/subprocessors](/subprocessors). We commit to providing school controllers with 30 days' advance notice before engaging any new sub-processor.
5. Retention and deletion
- Class deletion: When a teacher or school administrator deletes a pupil, class, or account, all associated tasks, cards, and points are permanently removed from the active database immediately via database cascade rules.
- Nightly token purge: Temporary join sessions and stale device tokens are purged automatically every night.
- Activity history: During the current pilot phase, Explore map activity records (dice rolls and landmarks) cascade with pupil deletion. As noted in our school readiness baseline, the formal long-term retention schedule for historical activity data is finalised in consultation with participating school controllers before general municipal release.
6. Your rights
Under GDPR Articles 15 to 22, teachers and guardians (via the school controller) have the right to:
- Request access to personal data stored about them.
- Request correction of inaccurate information.
- Request erasure of personal data (the right to be forgotten).
- Restrict or object to certain processing activities.
Because the school or municipality is the Data Controller for pupil data, pupil requests should be directed to the school or its Data Protection Officer (personvernombud). We will assist the school in fulfilling any data subject requests promptly.
For teacher accounts, contact us directly at [privacy@kudopop.com](mailto:privacy@kudopop.com).
You also have the right to lodge a complaint with the supervisory authority: Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway (www.datatilsynet.no).