For schools, districts, and families

District Privacy & Security

Last updated: September 5, 2026

Current position: ZoodleBug has implemented and tested technical and operational controls designed to support California AB 1584, SOPIPA, FERPA school-service requirements, and COPPA school-authorized educational use. We do not sell student information or use it for targeted advertising. District-specific approval remains subject to review and execution of the district’s required agreement.

Privacy commitments

School control

When a school uses ZoodleBug, the school remains in control of its pupil records and directs their educational use.

Educational purpose only

Student-linked information is used to provide accounts, learning activities, progress, games, security, and authorized support.

No advertising or sale

ZoodleBug does not sell student information, use it for targeted advertising, or create unrelated commercial student profiles.

Data minimization

Sponsored students use made-up usernames. Account creation does not request a student’s real name, personal email, birthday, school, phone number, or location.

Restricted visibility

Sponsored student accounts are excluded from public leaderboards and public content sharing by default.

Access and deletion

Verified requests can be made for access, correction, export, or deletion. Authorized educator deletion produces a completion receipt.

Student account model

Children cannot independently create persistent ZoodleBug accounts. A verified educator may create a pseudonymous sponsored-student account only after confirming authorization from a school, district, or other educational agency. ZoodleBug also supports limited no-login activities and short-lived classroom tournament guest access as described in the Privacy Policy.

Information and purpose

Information category	Purpose
Pseudonymous account identifiers, role, sponsor, and authentication records	Authentication, account security, and access control
Learning progress, scores, settings, responses, and activity results	Provide educational activities and save authorized progress
Multiplayer or tournament participants, game state, results, and timestamps	Operate shared educational games and classroom tournaments
Request details and technical/security metadata	Respond to verified requests, protect the service, troubleshoot, and prevent abuse

Security safeguards

ZoodleBug uses HTTPS, managed authentication, verified-educator controls, role-based access, restricted database and storage rules, server-side functions for sensitive operations, managed secrets, logging, backups, release checks, rollback procedures, and an incident-response process. Security details that could weaken those safeguards are not published.

Retention, deletion, and requests

Account-linked records are designed to be removed after a verified account deletion or according to the applicable district agreement.
Short-lived operational records follow documented retention periods; certain security evidence and irreversible deletion receipts may be retained longer for legitimate security and accountability purposes.
Automated destructive retention remains disabled until inventory counts and applicable district requirements are reviewed.
Parents, eligible students, educators, and schools may submit verified requests through the Privacy Request form.

Service providers

Provider	Purpose
Google Firebase / Google Cloud	Hosting, authentication, databases, storage, Cloud Functions, and operational logging
Cloudflare	Domain and security services, including Turnstile anti-abuse verification
Resend	Private delivery of contact and privacy-request email

ChatGPT may be opened as a separate, user-selected external service for educator prompt assistance. ZoodleBug does not automatically transmit student information or educator content to ChatGPT in the reviewed flow.

District readiness

Review area	Current status
Public privacy notice and request channel	Live and tested
Verified-educator student provisioning and restricted student visibility	Live and tested
Role-based database rules and sponsored-student deletion	Live and tested
Data inventory, retention schedule, security program, and incident process	Documented
District DPA or CA-NDPA, security questionnaire, retention deadline, and incident-notice deadline	District-specific review required

Contracting note: ZoodleBug is ready to review and sign a district’s required data privacy agreement and complete its security questionnaire. This page is a transparency resource; it does not replace the district-vendor contract required for a particular implementation.

Documents and official references

Download District Readiness Brief (PDF)

Contact

Operator: Tim Bedley / ZoodleBug
Privacy email: privacy@zoodlebug.com
Mailing address: 31165 Temecula Pkwy, Suite G3, Unit #2120, Temecula, CA 92592
Telephone: 951-878-9140
Online request: Privacy Request form