Privacy Policy

1.Who operates MyCodePad and how to contact us

MyCodePad is an online coding platform for students, teachers, tutors and schools. It is operated by To be confirmed: registered legal name of the MyCodePad operator ?, a Sole trader registered in England and Wales under company number Not applicable — MyCodePad is operated by a sole trader, who has no Companies House registration.

For the personal data described in this policy, the operator is the controller except where a school is the controller — see section 2.

Our registration with the Information Commissioner's Office is To be confirmed: ICO data protection fee registration number ?. Where the operator is established outside the UK, our Article 27 representative is To be confirmed: UK or EU representative, if the operator is established outside the UK ?.

2.What this policy covers, and who is the controller

This policy covers the MyCodePad website, the browser-based Python IDE and HTML editor, accounts, classes, assignments, saved work, school administration and paid subscriptions.

Who is legally responsible for a given piece of processing depends on who decided it should happen, and that is not the same answer for every feature. Two situations arise.

1. MyCodePad is the controller. For running and securing the platform itself — creating accounts, authenticating sign-ins, taking payments for individual subscriptions, sending service emails and protecting the service from abuse — the operator decides why and how the data is processed.
2. A school is the controller.Where a school uses MyCodePad for its pupils, the school decides that its pupils will use the platform, which classes exist, what work is set and who may see it. For that processing MyCodePad acts as a processor on the school's instructions, and the terms in our School Data Processing Agreement apply. Pupils and parents should also read their school's own privacy notice.

3.Information you give us when you register

Creating a MyCodePad account requires a name, an email address and a password. You also choose whether the account is for a student or a teacher.

That is the whole of registration. We do not ask for a date of birth, a postal address, a phone number, a school email domain or a photograph. Profile pictures are chosen from a fixed catalogue of illustrated avatars, so no image is ever uploaded and no picture of you is stored.

Afterwards you may add or change a display name and an avatar, and students and teachers may join a class or a school by entering a code. Joining is how your account becomes linked to a teacher or a school; we never infer a school from your email address.

4.Account, sign-in and session information

Your password is stored only as a cryptographic hash. Nobody at MyCodePad can read it, and we will never ask you for it.

When you sign in we create a session record containing a session token, its expiry time, and the IP address and browser user-agent of the device the session was created from. These exist so that you stay signed in and so that unusual access can be investigated.

Requesting a password reset creates a short-lived token that expires after one hour. Completing a reset signs out every other session on the account, because a forgotten password may be a compromised one. Changing your password from the account area does the same.

Email addresses are not currently verified, which means an account can be created against an address its owner does not control. We are treating this as a gap rather than a feature.

5.The code, projects and files you create

Everything you write in a MyCodePad editor is saved to your account: the contents of each file, its name, which editor it belongs to and which folder it sits in.

Your work is private to you by default. The people who can see a pupil's files are the pupil themselves and the teacher who owns the class the file belongs to — plus, for a school account, that school's administrators through the school dashboard. Other students never see each other's work.

When a teacher marks or corrects your work

A teacher can mark a file as done, leave comments on it and, if they choose, edit the code directly. A correction is never silent: the file records which teacher made it, their name, when it happened and which lines changed, and your own version from immediately before the correction is kept so your work cannot be destroyed. You can reply to a comment with one of a small set of reactions, including asking for more help.

Running code

Python runs inside your own browser using the Pyodide runtime, in a sandboxed worker. Your program and anything it prints are not sent to us in order to run. HTML previews render in a sandboxed frame that cannot reach the rest of the page, its cookies or your session. The runtime itself is downloaded from the public jsDelivr CDN, which sees your browser's IP address as part of that download.

Publishing a file as a link

You can publish one of your files as a public link. Anyone holding that link can read that file without an account. Share pages are excluded from search engines, but the link itself does not expire and cannot be password protected, so it should be treated as public once given out. You can revoke a link at any time, which disables every copy of it.

6.Class, school and teaching records

Teaching requires knowing who is in which class. We record enrolments, the teacher who owns each class, school membership with its role, and which invite code a member redeemed.

A school membership carries a role — student, teacher or school administrator — and a status. Removing somebody from a school marks their membership as removed rather than erasing it, so the record of who was in the school when remains accurate. Leaving a school is therefore not the same thing as deleting data.

Teachers additionally generate:

• A private library of reusable files and folders, with task instructions, topic, difficulty, year group and learning objective.
• Worked solutions attached to tasks. These are teacher-only and are never included in any response sent to a student.
• Daily starter quizzes for a class, and the resulting pupil answers, scores, totals, the frozen record of a pupil's first attempt, and the times each starter was opened and submitted.

7.Subscriptions, billing and payments

Payments are processed by Stripe. Card numbers and other payment credentials are entered with Stripe directly and never reach MyCodePad's servers or database.

When you start a subscription we pass your billing email address to Stripe Checkout. In return we store, against your account or your school: the plan, its status, the billing interval, Stripe's customer, subscription and price identifiers, the end of the current billing period and whether a cancellation is scheduled. We also record the identifier of each Stripe event we have processed, so a retried notification cannot apply the same billing change twice.

Where a school or a teacher pays for your access, no card is requested from you at all and there is nothing on your account to bill.

8.Support, diagnostics and security logs

If you contact us for support we hold your message and the address you sent it from for as long as it takes to deal with it and to handle any follow-up.

For security, failed attempts to use a class join code are recorded against both the account that tried and the IP address it came from, so that a code — which anybody holding it can use — cannot be found by guessing. Successful joins are not recorded this way.

Application errors are logged by our hosting provider as part of running the service. Email delivery failures are logged without the recipient address or the message content outside of local development.

9.Summary of the personal data we hold

The table below is generated from the actual database schema, so it can be checked against the product rather than taken on trust.

10.Why we process your data, and our lawful basis

UK GDPR requires a lawful basis for every purpose. The purposes below are the ones the product actually serves; the basis assigned to each is a legal determination that has not yet been confirmed by an adviser.

Where we rely on legitimate interests, you have the right to object. Where we ever rely on consent, it will be asked for separately and specifically, and you will be able to withdraw it as easily as you gave it. Accepting our Terms of Service is not consent to any processing of personal data.

11.Who we share data with

We do not sell personal data, we do not share it with advertisers and there is no advertising, marketing or behavioural tracking technology anywhere in the product.

Data is shared only in these situations:

• With your teacher and your school.A pupil's work, marking status, comments and starter results are visible to the teacher who owns their class, and to administrators of the school that pupil belongs to.
• With service providers. The companies listed in the next section process data on our behalf and under contract.
• With anyone you give a link to. Only where you have deliberately published a file as a public link.
• Where the law requires it,or to establish, exercise or defend legal claims, or to protect someone's vital interests.
• In a business transfer, if the service were ever sold or reorganised. You would be told before your data became subject to a different privacy policy.

12.Service providers and international transfers

These are every provider that receives personal data, identified by reading the application code rather than from a vendor list.

13.How long we keep your data

We keep personal data for as long as your account exists, and then for the periods set out below. Some of those periods have not yet been set.

What we can state from how the product behaves today:

• A file you delete is removed from the database, and so is the public share link attached to it — a revoked or orphaned link resolves to nothing.
• Deleting a class removes the class and its enrolments.
• Sessions expire on their own and are revoked in bulk when you change or reset your password.
• Password reset tokens expire one hour after they are issued.
• Being removed from a school marks the membership as removed; it does not delete the member's account or their work.

What is still to be decided:

14.How we protect your data

The measures below are implemented in the product today. We have deliberately not listed anything we cannot point at in the code.

We hold the following security certifications: None held. MyCodePad does not hold Cyber Essentials, ISO 27001 or any other security certification, and does not claim to. No service can be guaranteed absolutely secure, and we do not claim otherwise. If you believe an account has been compromised, contact us at To be confirmed: security and breach notification contact address ?.

15.Your rights over your data

Under UK data protection law you have the rights below. They are free to exercise, and we will respond within one month of receiving a request.

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate. Your name and avatar can be changed yourself in your account settings.
• Erasure — deletion of your data, where no overriding reason to keep it applies. You can ask for this from the Your data tab of your account, which also shows exactly what would happen to each kind of record before you ask.
• Restriction — a pause on processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — the data you gave us, in a machine-readable form.
• Objection — to processing we justify on legitimate interests.
• Withdrawing consent — at any time, wherever we have relied on consent.

To exercise any of these, write to To be confirmed: privacy and data protection contact address ?. We may ask you to confirm your identity before acting, so that somebody else cannot obtain your data by asking.

If your account belongs to a school, the school is usually the controller for your school work. In that case send your request to the school and we will assist them with it; if you send it to us, we will tell you and pass it on.

16.Closing your account, exporting and deleting data

You can download your code at any time from inside either editor, file by file or as a zip archive.

To ask for your account to be erased, use the Your data tab in your account, or write to To be confirmed: privacy and data protection contact address ?. Either way we record the request, give it a reference, and respond within one month. The account area shows you the reference, the date a response is due, and whether we have verified your identity yet.

What erasure actually means depends on what your account is

Deleting an account is not one action, because a single account can hold other people's personal data. A teacher's account points at classes full of pupil work; a school administrator's account may be the one the school itself was created under. We therefore treat the following as different things, and the account area shows you which one applies to you before you ask:

Across all of them, any public share links you have published are revoked first, before anything else happens, because that is the only step that stops your data continuing to leave the platform while the rest of the request is worked through.

What we check before acting

We ask you to confirm your identity, proportionately to what is being asked — we will not demand identity documents where confirming control of your account email is enough. Where somebody asks on a child's behalf, we separately establish that they are entitled to: the product holds nothing linking a parent to a pupil, so that check is To be confirmed: how a parent or guardian's authority to act for a child is established ?.

Once an account is erased, data is retained for To be confirmed: retention period for account and work data after an account is closed ?, except for records we must keep by law — see section 13. Billing and tax records are the main example: we cannot delete an invoice on request. We also keep a record of the request itself, including your name and email so the record still means something after the account has gone, for To be confirmed: retention period for the erasure request record itself ?.

Cancelling a paid subscription is separate from closing an account: a cancelled subscription leaves the account in place on the free tier. Cancellation is handled through the Stripe billing portal linked from your billing page. Being removed from a school is separate again — it marks your membership as removed and leaves your account and your work in place.

17.Children and young people

MyCodePad is used in schools, so we expect many of our users to be children. The ICO's Age Appropriate Design Code applies to us, and the following is an honest account of where we stand against it.

What is already true of the product:

• Registration collects the minimum we can run an account on: a name, an email address and a role.
• Files are private by default. Nothing a pupil writes is public unless they publish it themselves.
• There is no advertising, no marketing, no behavioural tracking and no profiling anywhere in the platform.
• Teacher corrections to a pupil's code are always attributed, and the pupil's own prior version is preserved.
• AI help is a teacher-controlled feature that can be switched off for a class, and is delayed so that pupils attempt problems themselves first.

What is outstanding, and which we are not going to describe as finished:

• Age assurance. The minimum age for an independent account is 13. A child under 13 must be given an account by their school rather than registering themselves. That is our policy, but nothing in the product enforces it: we collect no date of birth and no age band, so we cannot currently identify which of our users are children, and we assume some are.
• A child-facing privacy notice. This policy is written for an adult reader. A short, plain version for pupils is still to be written.
• Public sharing. A published link does not expire and cannot be password protected. Whether pupils should be able to publish at all is under review.
• A data protection impact assessment. Our DPIA status is To be confirmed: whether a DPIA has been carried out, by whom and when ?. No assessment has been completed, and we make no claim that one has.

If you are a parent or carer and want to know what we hold about your child, the quickest route is usually through their school, because for school work the school is the controller. You can also write to To be confirmed: privacy and data protection contact address ?.

18.Cookies and similar technologies

MyCodePad sets one cookie, and it exists to keep you signed in. There are no advertising cookies, no cross-site trackers and no third-party marketing tags.

Some preferences are kept in your browser's own local storage rather than sent to us. They never leave your device and we cannot read them. The complete list, taken from the code:

Why there is no cookie banner

Because nothing here is used for advertising, analytics profiling or tracking you across sites, there is nothing to ask consent for beyond what is strictly necessary to provide the service you asked for, and the remaining items store only your own interface preferences on your own device. Adding a consent banner would be decorative, and a decorative banner trains people to dismiss the real ones.

We use Vercel's page analytics in production. It is cookieless and does not build a profile of you or follow you to other sites.

19.Automated decision-making, profiling and AI features

No decision with a legal or similarly significant effect on you is made by automated means, and we do not profile users.

Starter quizzes are scored automatically, and files carry a marking status. Both are shown to the pupil and to their own teacher. Nothing is inferred, ranked or predicted from them, and no access, grade or account outcome follows automatically from either.

What the AI features send, and where

Three features call a large language model through Vercel's AI Gateway, which currently routes to OpenAI:

• Error help. Sends the code in the file you are working on, truncated to 8,000 characters, together with the error message your program produced. It is unlocked only after a delay set by your teacher, and teachers can switch it off for a class entirely. Your name, email address and account identifier are not included in the prompt.
• Task generation. Sends the topic, difficulty, year group and learning objective a teacher typed in. No pupil data is involved.
• Starter generation. Sends the same kind of teacher-supplied lesson metadata to produce quiz questions.

The hint you receive is cached in your own browser so that reopening a file does not spend another request.

20.Complaints, and the Information Commissioner's Office

If you are unhappy with how we have handled your personal data, please tell us first so that we have the chance to put it right. Our complaints process is To be confirmed: internal complaints process and escalation route ?.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at any time, and you do not have to come to us first.

21.Version, effective date and changes to this policy

This is version 0.1 — draft for legal review. It has no effective date because it has not yet been reviewed or published.

When we change this policy we will update the version and the effective date at the top of the page. For a material change — a new purpose, a new category of recipient, or a change to a lawful basis — we will email account holders in advance where we can, and notify schools through their administrator, rather than relying on you noticing a new date.

Previous versions are available on request from To be confirmed: privacy and data protection contact address ?.

Every item below is marked somewhere in these documents and must be resolved before any of them is published or relied upon. They are listed here as well so the list can be worked through in one pass.

1. 01

   Registered legal name of the MyCodePad operator

   UK GDPR Article 13 requires the identity of the controller. Only the operator knows whether MyCodePad trades as a limited company, a sole trader or a partnership.

2. 02

   Registered or trading postal address

   Article 13 requires contact details for the controller, and schools need a service address for a signed DPA.

3. 03

   Privacy and data protection contact address

   Data subject rights requests need a route that is actually monitored.

4. 04

   Security and breach notification contact address

   Article 33/34 breach handling and the DPA both depend on a reachable security contact.

5. 05

   General support contact address

   Referenced by the Terms for service and billing queries.

6. 06

   Whether a Data Protection Officer has been appointed, and their contact details

   Article 37 requires a DPO in some cases. Processing children's data at scale makes this a decision that must be taken deliberately and recorded, not assumed either way.

7. 07

   ICO data protection fee registration number

   Most UK controllers must pay the data protection fee and register. The number must not be invented, and registration status must be confirmed before it is claimed.

8. 08

   UK or EU representative, if the operator is established outside the UK

   Article 27 may require a representative. Depends on where the operator is established.

9. 09

   Governing law and jurisdiction for the Terms

   A jurisdiction clause is a commercial and legal decision, and consumer protection rules limit what can be imposed on UK consumers.

10. 10

    Statutory cancellation / cooling-off position for individual subscriptions

    The Consumer Contracts Regulations give a 14 day right to cancel distance contracts, with specific rules where a digital service starts immediately. How this is handled must be confirmed before it is described.

11. 11

    Refund policy beyond statutory rights

    No refund logic exists in the billing code. Any discretionary refund promise is a commercial commitment.

12. 12

    VAT registration status and whether listed prices include VAT

    Stripe is configured with plain GBP amounts and no tax behaviour, so the published prices cannot be described as VAT-inclusive or exclusive until this is confirmed.

13. 13

    Support response target, if any is offered

    Several plans advertise "priority support". What that means in practice is a commitment that has to be set deliberately.

14. 14

    Internal complaints process and escalation route

    Referenced by both the Terms and the Privacy Policy, and expected by schools procuring the service.

15. 15

    Retention period for account and work data after an account is closed

    Erasure is now requested through the account area and carried out by hand against a recorded plan, so there is a process — but no decision has been taken on how long anything is kept before that plan runs, or whether a grace period applies in which a request can be reversed.

16. 16

    Retention period for the erasure request record itself

    Each request stores the subject's name and email so the record still means something after the account is deleted, which is what lets MyCodePad show a regulator the request was handled. That record is itself personal data and cannot be kept forever without a stated period.

17. 17

    How a parent or guardian's authority to act for a child is established

    The request form accepts a parent or guardian as the requester, and the product holds nothing that links a parent to a pupil. The check is therefore a documented human procedure, and acting on an unverified claim would disclose or destroy a child's data on a stranger's say-so.

18. 18

    Backup retention window and the point at which deletions reach backups

    Set by the database provider's configured plan and by operator choice, and must be read from the live Neon project rather than assumed.

19. 19

    Retention period for billing and tax records

    UK tax law sets minimum record-keeping periods, which interact with deletion requests. The applicable period depends on the operator's legal form.

20. 20

    Retention period for security logs, including failed join-code attempts

    Failed join attempts record raw IP addresses and are not pruned by any code in this repository.

21. 21

    Whether dormant accounts are deleted, and after how long

    Storage limitation requires data not to be kept indefinitely without reason. No dormancy policy is implemented.

22. 22

    Period within which school data is returned or deleted at the end of a contract

    Article 28(3)(g) requires the processor to delete or return personal data at the end of the service. The window is a contractual term.

23. 23

    Vercel deployment region(s)

    Determines where the application runs and whether a transfer outside the UK occurs. Must be read from the live Vercel project configuration.

24. 24

    Neon database region

    Determines where personal data is stored at rest. Must be read from the live Neon project.

25. 25

    Transfer mechanism relied on for any processing outside the UK

    The UK Addendum to the EU SCCs, the IDTA or adequacy may apply. Which one, for which provider, is a legal determination.

26. 26

    Deadline for notifying a school of a personal data breach

    Article 33(2) requires notification "without undue delay". A specific number of hours is a contractual promise that the operator must be able to meet.

27. 27

    Audit and inspection arrangements offered to schools

    Article 28(3)(h) requires audits to be permitted. The practical form — questionnaire, report, on-site — is negotiated.

28. 28

    Notice period before a new subprocessor is added

    Article 28(2) requires the controller to have an opportunity to object to changes.

29. 29

    Whether a DPIA has been carried out, by whom and when

    Processing children's personal data at scale is likely to require a DPIA under Article 35. No assessment is recorded in this repository.