Kudopop

Kudopop for schools and school owners

This page is for headteachers, municipal school owners (skoleeiere), ICT coordinators, and Data Protection Officers (personvernombud) reviewing Kudopop.

In Norway, Datatilsynet expects school owners to understand their software suppliers' security and privacy work and obtain evidence before deploying systems for children. Kudopop is designed from the database up to make that scrutiny straightforward.

The school-use baseline

Kudopop is currently in pilot with test classrooms and invited teachers. The product operates under clear architectural boundaries:

  • No school classes yet: No school uses Kudopop in its teaching. The database holds test data, teacher demonstration classes, and a few children trying it out, registered only under a made-up nickname.
  • Controller and processor roles: The school or municipality (kommune) is the Data Controller (behandlingsansvarlig) for all classroom activity. Terry James Thorpe Publishing (ENK) is the Data Processor (databehandler).
  • Data residency: All database storage, authentication, and live synchronisation take place within the European Union (AWS Dublin, Ireland, via Supabase).
  • Zero tracking SDKs: Kudopop loads no commercial advertising networks, no Google Analytics, no Meta pixels, and no session-replay tools. Fonts and videos are self-hosted.

Privacy by design and default

Classroom tools frequently collect excessive identifying data about children. Kudopop takes the opposite approach:

1. Fictional pupil identities

Pupils never enter an email address, phone number, or password. When a teacher adds a pupil, Kudopop generates a two-word fictional nickname (such as Rocket Waffle or Cosmic Otter) and a visual companion avatar.

The mapping between a child's real name and their Kudopop nickname is printed by the teacher and stays on paper in the physical classroom. Kudopop's servers never receive or store the child's legal identity.

2. Device access via QR badge or class code

Pupils join using an ephemeral class code or by scanning a printed QR badge using the device camera. The camera is accessed via modern web standards (`Permissions-Policy: camera=(self)`) solely to decode the join token. No images or video streams are ever transmitted to our servers or saved.

3. Positive-only classroom mechanics

Classroom reward systems can harm motivation if points are deducted as a punitive measure. In Kudopop:

  • Earned progress is never removed as punishment. The underlying database schema rejects negative adjustments.
  • Class stars come from approved cards and belong to the whole class. If one pupil is late or misses a routine, classmates are never penalised and the public screen never singles anyone out.
  • Front-of-class displays show only celebrations, routine completion progress, and class games. Teacher notes, individual check queues, and sensitive settings are strictly isolated to the teacher's personal screen.

Database security and row-level isolation

Kudopop enforces security at the PostgreSQL database level using Row Level Security (RLS):

  • Pupil device isolation: A pupil's signed-in session can only select and update their own assigned task rows. They have no permission to read classmate records, other classes, or teacher notes.
  • Classroom boundaries: Teachers can only access classes they personally created or where they have been explicitly added as a verified co-teacher.
  • Automated test suite: Every migration and policy change is verified by an automated regression test suite consisting of over 1,600 tests, including direct SQL transaction rehearsals.

Data processing agreements and procurement

Before onboarding a live class with real pupils, school owners need formal documentation:

  1. Standard Data Processing Agreement (DPA): We provide a standard DPA drafted in accordance with Datatilsynet's school guidelines and standard Norwegian municipal templates (standard databehandleravtale).
  2. Technical and Organisational Measures (TOMs): A complete appendix detailing encryption standards (TLS in transit, AES-256 at rest), daily automated backups, role-based access control, and incident handling protocols.
  3. Sub-processor visibility: We maintain an open, public register of all third-party infrastructure providers at [/subprocessors](/subprocessors) with a commitment to 30 days' advance notice before any changes.

To request our standard DPA package, schedule a technical walkthrough, or ask questions for your Data Protection Impact Assessment (DPIA / PVK), contact our school team at [schools@kudopop.com](mailto:schools@kudopop.com) or [support@kudopop.com](mailto:support@kudopop.com).

Incident management and vulnerability disclosure

In the event of a security incident or data breach affecting personal data, Kudopop notifies affected school controllers without undue delay, and within 72 hours at the latest, so that the school can meet its own deadline under GDPR Article 33.

If you are a security researcher or school ICT specialist and discover a vulnerability, please report it directly to [security@kudopop.com](mailto:security@kudopop.com). We acknowledge reports within 24 hours and do not use legal threats against responsible disclosures.