Legal

Privacy policy

Last updated 7 November 2026. Applies to learning.nyuchi.com and to the Toddle Enhancement Extension.

Who we are

Nyuchi Africa (Private) Limited, trading as Nyuchi Learning, registered in Zimbabwe; the site and the extension are run by its development division, Nyuchi Web Services, in Harare. For anything in this policy, write to privacy@nyuchi.com.

The extension

Each of the following is a statement about how the software is built, not a promise about how we intend to behave. They can be checked against the extension itself.

It runs only on Toddle.

The extension is declared against https://web.toddleapp.com only. It has no access to any other website, and takes no action anywhere else.

It reads; it does not write.

It reads what Toddle already lets you see, through Toddle's own interface, reusing the session you are already signed in with. Every request it may send is listed word for word in the extension, and anything else is refused. Write operations are blocked outright rather than merely avoided, so it cannot change your gradebook even by accident. On the home page and the Attendance dashboard it adds a few fields to Toddle's own request instead of sending a second one, and takes them out again before Toddle's page sees the answer. Its message buttons open Toddle's own chat window and send nothing themselves: a message is sent, if at all, by you, through Toddle, under your school's messaging rules.

What it reads, feature by feature.

Toddle answers with what the signed-in teacher's own account may see, and no more. The gradebook tools, when a teacher expands an assessment: its assessment tools as Toddle defines them (rubric criteria, descriptors and levels, grade scales and their colours, checklist items, scores, standards and learning goals), and each assigned student's name, email, student ID, submission status and results, including written responses and comments. No descriptor or level is written in the extension. The home page: each class's staff, to show its primary teacher and the My classes filter. A student's profile page: the teachers of each of the student's classes. The Attendance dashboard: each student's year group and the names of the periods, from Toddle's own request, and the primary teacher of the class each student is in now, for the “Now: class · teacher” line. The student sidebar, when a teacher opens a student or a class: the student's name, photo, year group and age (the date of birth is used to work out the age and is never shown), email, student ID and enrolment date; their family accounts and contacts, with names, relationships, phone numbers and emails; their homeroom advisor; the school's additional profile fields, of which only Student Group and Room number are ever shown; today's timetable and attendance marks; their active flags (see the next point); and the teachers of each class, of today's blocks and of the homeroom, with their display titles, roles and emails, and their photos where Toddle gives them, which the sidebar's staff view shows when a teacher's name is clicked (it asks Toddle for nothing more).

Student flags: Toddle's own are never hidden, and a teacher can conceal them for a shared screen.

The extension does not hide Toddle's own student flags: they show as Toddle shows them, including in Toddle's student popover, with their links and documents. A teacher can choose to conceal flags, for a screen a class or a visitor can see, with the free flag switch in Toddle's top bar or the extension's menu. A new install starts with flags shown. A teacher who updated from version 0.8.2, where flags were hidden by default, or who had hidden them, has them concealed after the update until they choose to show them. A concealed flag is a faint grey smudge with no colour, and its words cannot be read from across a room, though it can still show that a student has a flag. Nothing on the page brings a concealed flag back. In the student sidebar, "Show flags" shows one student's flags when you need them. The sidebar asks Toddle for a student's active flags each time it opens, and keeps them only while that student's sidebar is open. Concealing changes only what is drawn on the screen, never Toddle's data. The flag switch is free and always will be.

Your Toddle sign-in stays with Toddle.

The extension never asks for your password and never stores it. To ask Toddle as you, it notes the sign-in headers from Toddle's own requests, and the academic year Toddle is showing. The headers are held in the tab's memory, in one script inside Toddle's page: the extension's other parts never see them, they are never stored, and they are sent nowhere but Toddle's own interface. The academic year number is kept in Toddle's site storage (see below) so the sidebar asks for the right year, and is sent nowhere but Toddle.

Exactly what leaves your device.

Nothing it reads from Toddle goes anywhere but back to Toddle. There is no account, no analytics, no telemetry, no tracking, no advertising and no remote code. The extension makes these requests and no others: read-only requests to Toddle's own interface, with your Toddle session; student photos, loaded from the address Toddle gives for each one, wherever Toddle serves them, as Toddle's own page does; the feedback form, only when you press Send (and a Toddle compatibility report, the same way, only when you press Send report or have switched on sending them automatically); only while there is a licence key, the daily check for cancelled keys, which carries nothing; and, only when you open the one-time link from your licence email (or paste it into the licence page), one request that exchanges it for your key. The last three are described below. Anything else happens only when you do it: saving an Excel or CSV file, opening an email or phone link, or sending a message in Toddle's own chat. Like any web request, each one lets the server that receives it see your IP address and browser type. One thing more leaves your device, and not to us: with Chrome sync on, Chrome carries your licence key to your other computers through your own Chrome account. The extension itself never sends the key anywhere, Nyuchi included.

Outside connection one, only when you choose it: feedback.

The toolbar menu has a Send feedback form. Press Send and it sends what you typed — a topic, your message, and an email address only if you enter one — plus the extension's version number, to our feedback form, processed by Formspree. Nothing from Toddle is ever included: no student data, no page address, no licence key. If you never press Send, nothing is ever sent. The detail is below.

Toddle compatibility reports go the same way, only when you send them or switch that on.

Toddle changes its pages without notice, so the extension checks, in your own Toddle tab as you use it, that each feature still finds what it relies on in Toddle's page, and the licence page shows the result: each feature working, working with Toddle changed, or paused because Toddle changed. Nothing probes Toddle from our servers. A compatibility report says only what changed in the structure of Toddle's page, masked: a key's format such as <digits>__evaluationStatus__<digits>_RUBRIC, field names and counts, with the page's address as a pattern with every id masked, the extension's version, Chrome's major version and the time to the minute. It never holds student data: no names, emails, marks, comments, ids or free text, and no account, school or licence. Copy report puts it on your clipboard. It is sent through the same feedback form, with no email address, only when you press Send report on the licence page, or, if you switch on Automatically send compatibility reports (off unless you switch it on), by itself when something changes, at most once an hour. It is never sent from a Toddle page or by the background worker.

The welcome page sends nothing.

When you first install it, the extension opens a welcome page. That page is part of the extension itself, not a website, and loading it contacts nothing.

What it stores: settings and licence details, and no student data.

In Chrome's storage for the extension, on your device: your switches (the extension on or off, student flags, the student sidebar, My classes, primary teacher names, gradebook tools, and student details on the Attendance dashboard); your licence key, if you entered one or added it from a claim link; the result of the last check for cancelled keys (whether the key in use is on the list, the list's date, when the check was made, and the fingerprint of the key it is about, never the list itself); the email address of the Toddle account last seen signed in, with the time, so the extension can check who a licence is for; and the Toddle compatibility record (for each thing a feature relies on in Toddle's page, whether it was last found, missing or changed, when, and its masked shape: no student data), with your choice whether to send compatibility reports automatically (off unless you switch it on) and which report was sent last, and when. That email is read on every Toddle page, with or without a licence key, and stays on the device. The licence key, and nothing else, is also kept in Chrome's synced storage for the extension, so Chrome carries it to the other computers signed in to the same Chrome account, unless sync, or a school's Chrome policy, turns that off. That is Chrome's own sync, through your Google account; the extension never sends the key to Nyuchi. A key carries the buyer's email address, so that travels with it. The newest key wins on every computer, and removing it on one removes it on all of them. Who a key is for, and the result of the check for cancelled keys, stay on each computer. A school's licence set by its IT through Chrome policy is different: the extension reads it from the policy on each managed browser, and never copies it into its own storage or into Chrome's sync. In the browser's storage for Toddle's own site: tee-blur-flags (gbx-hide-flags in versions before 0.9.0), whether flags are concealed, so they are concealed before the page is drawn; tee-course-view, whether you chose My classes in the home page filter; and tee-academic-year, the number of the academic year Toddle last asked for. An older copy of the switches there, tee-settings, is cleared. Nothing it reads about students, classes, results or attendance is ever written to storage.

What it holds in memory, and for how long.

Answers from Toddle are held in the Toddle tab's memory, never written to storage, until the tab is closed or reloaded or the browser quits. Moving between Toddle pages without a reload does not clear them. A student's or a class's details are reused for at most 5 minutes, and a student's day for at most 2, before Toddle is asked again. A student's flags are never reused, and are kept only while that student's sidebar is open.

Your licence is checked on your machine, not by asking us.

A licence key is a signed statement that the extension verifies locally. It carries the buyer's email address. A key may also name who it is for: the buyer's email, or for an organisation licence the school's email domain. Where it does, the extension compares that with the Toddle account signed in, inside the browser only, and sends it nowhere. Activating a key you paste contacts nothing, which is why it works without a connection; a key added from a claim link is fetched once (outside connection three, below) and then checked in exactly the same way. The extension never sends the key to Nyuchi. A school's organisation licence is set by its IT as Chrome policy for the extension, and is checked the same way (signature, expiry, the Toddle account's domain, the list of cancelled keys); the licence and welcome pages say it is provided by your school and never show it. An organisation key cannot be typed or pasted in: it is refused and not stored, and one stored by an earlier version is removed, from that browser and from the Chrome account's synced copy.

Outside connection two, only while there is a licence: a daily check for cancelled keys.

At most once a day, and only while there is a licence key (one you entered, or your school's, set through Chrome policy), the extension's background worker makes one plain request to https://licenses.nyuchi.com/v1/revocations (versions before 0.9.0 asked licences.nyuchi.dev, the same server); a key just entered is checked within 5 minutes. It sends no licence key, no identifiers, no cookies and no Toddle data. It downloads a list, signed by Nyuchi, of the fingerprints (SHA-256 hashes) of cancelled keys, checks its own key against that list on your machine, and keeps only the result. Cloudflare, which runs the server, sees your IP address as with any web request; Nyuchi does not log it. If the list cannot be fetched, the last result stands, so a network outage never switches a licence off.

Outside connection three, only when you use a claim link: your licence, fetched once.

A licence email carries a one-time link, not the key. Open it in Chrome and click Add it to Chrome on our licence claim page (https://licenses.nyuchi.com/claim). That page, and no other website or extension, can hand the link to the extension: the manifest names it alone, and the extension checks where the message came from and that the link's code has exactly the right shape, and does nothing with it but open its own licence page. The licence page then sends the link's code, and nothing else (no email, no cookies, no other key, no Toddle data), in one request to https://licenses.nyuchi.com/v1/claims/redeem, which returns your licence key once; the key is checked and stored on your machine exactly as a typed key is. The link works once, for 72 hours, and our licence server keeps only a fingerprint (hash) of its code. If you opened the link somewhere else, you can paste it into the licence page instead. Cloudflare, which runs the server, sees your IP address as with any web request. Keys from earlier emails can still be pasted.

Exports are local.

The gradebook exports, an Excel workbook (gradebook-expanded.xlsx) or a CSV file (gradebook-expanded.csv), are generated in your browser and saved by your browser, to wherever your downloads go. They do not pass through any service of ours. Every text is written as text, so nothing from Toddle can run as a formula. Once saved, a file is yours, under your school's own rules for files.

Removing it removes what it stored.

Uninstalling the extension deletes everything in its own storage on that computer. The three small values on Toddle's site stay until the browser's data for web.toddleapp.com is cleared; none of them is about a student. Removing a licence key deletes the key (on every computer signed in to the same Chrome account, so remove the licence before uninstalling if you want it gone from your Chrome account too); the last check's result and the Toddle account's email stay until the extension is uninstalled. A school's licence set through Chrome policy is not offered for removal in the extension; it is the school's IT that sets the policy.

The extension's feedback form

This is one of the extension's three connections outside Toddle (the others are the daily check for cancelled keys and adding your licence from a claim link), and it only happens when you make it happen. Since version 0.8.1 the extension's toolbar menu has a Send feedback form.

• When. Only when you press Send. Opening the form, typing in it or closing it sends nothing, and nothing is ever sent in the background.
• What. Exactly what you typed — the topic, your message, and your email address only if you enter one — plus the extension's version number, so we know which release you mean.
• What it never includes. Nothing from Toddle: no student data, no page address, no class or school details, and not your licence key. Please leave student names out of what you type, too.
• Where it goes. To Nyuchi's feedback form, which is processed by Formspree, a form service acting on our behalf. It is the same service and the same form as this website's feedback page, and it is handled the same way once it reaches us.
• Why. To read what you tell us, reply if you asked us to, and decide what to fix or build next. We do not add you to a mailing list or share it.
• How long. Feedback is kept only as long as we need it to act on it. You can ask for yours to be deleted at any time by writing to privacy@nyuchi.com.

Toddle compatibility reports

Since version 0.12.0 the extension checks, in your own Toddle tab as you use it, that each feature still finds what it relies on in Toddle's page, and the licence page's Toddle compatibility card shows the result. A report of what changed goes to us through the same feedback form, and only this way:

• When. Only when you press Send report on the licence page, or, if you switch on Automatically send compatibility reports (off unless you switch it on), by itself when something changes, at most once an hour. It is never sent from a Toddle page or by the background worker. Copy report only puts it on your clipboard.
• What. What changed in the structure of Toddle's page, masked: a key's format such as <digits>__evaluationStatus__<digits>_RUBRIC, field names and counts, the page's address as a pattern with every id masked, each feature's status, the extension's version, Chrome's major version and the time to the minute.
• What it never includes. Student data: no names, emails, marks, comments, ids or free text. No account, no school, no licence, and no email address.
• Where it goes, and why. To the same feedback form, processed by Formspree, so we can see what Toddle changed and fix the feature it affects. Nothing probes Toddle from our servers: every check is made in your own session.

The daily check for cancelled keys

The extension's second connection outside Toddle, from version 0.8.2.

• When. At most once a day, and only while there is a licence key: one you entered, or your school's, set through Chrome policy. A key just entered is checked within 5 minutes. Without a licence it never happens.
• What is sent. One plain request to https://licenses.nyuchi.com/v1/revocations, from the extension's background worker (versions before 0.9.0 asked licences.nyuchi.dev, the same server). It carries no licence key, no identifiers, no cookies and no Toddle data.
• What comes back. A list, signed by Nyuchi, of the fingerprints (SHA-256 hashes) of cancelled keys. The extension checks its own key against the list on your machine, and keeps only the result.
• Who sees what. Cloudflare, which runs the server, sees your IP address, as with any web request. Nyuchi does not log it.
• If it fails. The last result stands, so a network outage never switches a licence off.

Adding your licence from a claim link

The extension's third connection outside Toddle, from version 0.12.0. Your licence email carries a one-time link, never the key.

• When. Only when you open that link in Chrome and click Add it to Chrome on our licence claim page, or paste the link into the extension's licence page.
• Who can hand it over. Only that page, https://licenses.nyuchi.com/claim. It is the one page the extension lets message it, and no other website or extension can. The extension checks where the message came from and that the link's code has exactly the right shape, and all it does with it is open its own licence page.
• What is sent. The licence page sends the link's code, and nothing else (no email, no cookies, no other key, no Toddle data), in one request to https://licenses.nyuchi.com/v1/claims/redeem.
• What comes back. Your licence key, once. It is checked and stored on your machine exactly as a typed key is, and then follows your Chrome account like one.
• How long the link works. Once, for 72 hours. Our licence server keeps only a fingerprint (hash) of the link's code. Keys from earlier emails can still be pasted.
• Who sees what. Cloudflare, which runs the server, sees your IP address, as with any web request.

A school's organisation licence does not come this way. Its IT sets it as Chrome policy for the extension, the extension reads it from that policy, and a teacher never sees or pastes it; an organisation key typed into the extension is refused.

In Firefox

The extension is also on Firefox Add-ons. It is the same extension, built from the same code, and everything on this page applies to it in the same way, with these differences:

• Claim links. The licence claim page cannot hand a link to the extension in Firefox, so you paste the link from your licence email into the extension's licence page. The request it makes is the same one, carrying the link's code and nothing else.
• Storage and sync. Where this page says Chrome's storage, in Firefox it is Firefox's storage for the extension. If you use Firefox Sync, Firefox may carry your licence key to your other computers through your own Firefox account; the extension never sends it anywhere.
• Schools. A school's IT sets the licence and the modules for every teacher through Firefox enterprise policy (policies.json) instead of Chrome policy. The extension reads it on the computer, and nothing about it is sent anywhere.
• What Mozilla is told. The listing declares that the extension collects nothing by itself, and that feedback and Toddle compatibility reports, which you choose to send, contain technical information and never student data.

Security

The statements above are enforced in the software and held in place by tests that fail if the extension asks for a new permission, sends anything anywhere it is not meant to, or sends a query that is not on its fixed, read-only list. It has had two adversarial reviews. Every finding of the first, on 1 October 2026, was fixed in version 0.8.2; every finding of the second, on 6 October 2026, of the code for version 0.8.4, a test release, was fixed in that release, and the fixes are in version 0.16.0, on the Chrome Web Store. The Security page sets out the security model, how it is tested, what the reviews found, the limits no extension can remove, and how to report a vulnerability.

Are you a processor of our students' data?

No. A data processor receives personal data and does something with it on the controller's behalf. We receive none: the extension reads what your browser has already loaded from Toddle, renders it differently on that same screen, and transmits none of it. Feedback a teacher chooses to send from the extension's menu carries only what they typed, never anything from Toddle; a Toddle compatibility report carries only the masked structure of Toddle's page, never student data; the daily licence check sends nothing at all; and redeeming a claim link sends only the link's code. Your school remains the controller of its data, and Toddle remains its processor, exactly as before the extension was installed.

If your data protection officer would like that in writing against a specific framework, or wants to review the code before approving it, write to us — we would rather answer the question properly than have you take a web page's word for it. A data processing agreement is available on request.

This website

It is a set of static pages served by Vercel. Vercel processes the request in order to serve it and keeps operational logs, as any host must.

If you use the feedback form on this website, what you type — the topic, your message, your email address if you give one, and the page you came from — is sent through Formspree, a form service, and recorded as an issue in Nyuchi's private GitHub repository for the extension, where only our team can see it. We use it to reply to you and to decide what to build; we do not add you to a mailing list or share it. Feedback is kept only as long as we need it to act on it; ask us at privacy@nyuchi.com and we will delete it sooner. Feedback sent from inside the extension goes to the same form — see the extension's feedback form.

Your choices, and what they control

The first time you visit, a banner asks. Nothing optional is switched on until you switch it on, and you can take all of it, some of it, or none. Ignoring the banner leaves you exactly where refusing does.

Changing your mind costs one press. Cookie choices at the bottom of any page reopens the panel with your current answers, and withdrawing is as easy as agreeing was. We keep a record of what you chose and when, because the law puts the burden of showing that on us rather than on you — it is stored in your own browser, alongside the choice itself.

Every cookie and stored value, with what sets it and how long it lasts, is listed in the cookie policy.

This is written to meet the two laws we hold ourselves to (see the law we follow): Zimbabwe's Cyber and Data Protection Act [Chapter 12:07], and the EU and UK GDPR. They agree on the substance, so one approach serves both: nothing optional before you ask for it, each purpose chosen separately, refusal as easy as agreement, withdrawal at any time, and a record we can produce.

Google Analytics is not loaded until you agree. Until you choose Analytics, your browser does not fetch Google's analytics tag and sends Google Analytics nothing, and no analytics cookie is set. If you reject it, that stays true on every page. Once you agree, the tag loads, sets its cookies and records the pages you view. If you withdraw later, the page you are on keeps the tag it already loaded, with its cookies switched off, until you leave that page; no page after it loads the tag. Google Fonts is separate, and described below.

None of that is true of the extension. It contains no analytics, and nothing it reads leaves your browser; its only outside connections are the feedback form, when you press Send (and compatibility reports, the same way), the daily licence check, and redeeming a claim link, all described above. This is the website measuring the website. If the distinction matters to you — and for anyone assessing the software for a school, it is the part that matters — the extension section above is the one to read.

Fonts are loaded from Google Fonts, so your browser fetches them from Google and Google sees your IP address in doing so.

The support messenger is opt-in. There is a Support button in the corner of every page. Until you press it Intercom loads nothing and sets no cookie of its own — the analytics above is separate, and has its own choice. Press it and the messenger loads from Intercom, which at that point sets its own cookies, can see which pages you have open while you use it, and holds the conversation on our behalf so we can answer you. We chose to load it on demand rather than on arrival precisely so that reading this site costs you nothing.

If you buy a licence

This is the one place we hold personal data about you, and it is worth being exact about it, because it is easy to confuse with what the extension does.

• We hold your email address and your order. We need them to issue your licence, to let you renew, and to give you an invoice.
• Your payment goes to Buy Me a Coffee, not to us. It processes the order, with Stripe handling the card, and passes us your email address and what you bought so we can issue your licence. We never see your card details.
• Your key contains your email. A key may also name who it is for: your email address, or for an organisation licence the school's email domain. Where it does, the extension compares that with the Toddle account signed in, inside your browser only. The key is stored in your own browser (or, for a school, read from its Chrome policy) and checked there — the extension does not send it to us or to anyone else, not even in the daily check for cancelled keys.
• We do not market to you off the back of it. Buying a licence does not put you on a mailing list.

We keep order records for as long as tax law requires us to, and no longer for any other purpose.

Email

If you email us we keep the email, because that is what email is. We use it to answer you and to keep a record of support requests. Support runs on Intercom, so Intercom processes those conversations on our behalf. We do not add you to a marketing list off the back of a support question.

Who is responsible, and on what basis

For the personal data Nyuchi holds — licence purchases, feedback, support conversations and this website's analytics — Nyuchi Africa (Private) Limited is the data controller, under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] and under the EU and UK GDPR. Our legal basis for each use is:

• your consent for this website's analytics and the support messenger, which you can withdraw at any time (GDPR Article 6(1)(a));
• the contract with you to issue, deliver and support a licence you buy (Article 6(1)(b)), and the law for the records a business must keep (Article 6(1)(c));
• your request when you send feedback or write to us: our legitimate interest in reading and answering what you choose to send (Article 6(1)(f)). You can ask us to delete it at any time.

For student data in Toddle, the school is the controller; the extension's processing happens on the school's own devices and Nyuchi receives none of it. The data handling page lists what we hold, the services that process it for us, and how long it is kept, and student privacy covers FERPA, COPPA and data processing agreements.

The law we follow

Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] applies to us because Nyuchi Africa (Private) Limited is a Zimbabwean company. Its data protection authority is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

The EU and UK GDPR are the most widely used standard for personal data, so we apply them to everyone, wherever you live, not only to people in Europe. Where the two laws differ, we follow the stricter one.

Where your data goes. Nyuchi is in Zimbabwe, and the services that process data for us (listed on the data handling page) are mostly in the United States. So data you send us may be processed outside your country. Zimbabwe does not have an adequacy decision from the EU or the UK, so for data that comes to us from there we rely on the safeguards each service provides for international transfers, such as standard contractual clauses in its data processing terms. Ask us and we will tell you which applies to each service. None of this involves student data from the extension, which does not leave the teacher's browser.

Your rights

Whatever country you are in, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct it if it is wrong or incomplete;
• delete it, unless the law requires us to keep it;
• stop or limit how we use it while a question about it is settled;
• give it to you, or to someone you choose, in a common machine-readable format;
• stop using it where we rely on our legitimate interests;
• withdraw your consent at any time, without affecting what was done before you withdrew it.

We make no decisions about you by automated means alone, and we do not profile you. Write to privacy@nyuchi.com. There is no charge, and we answer within one month.

You can complain to a regulator, though we would like the chance to put it right first. In Zimbabwe, that is POTRAZ. In the UK, it is the Information Commissioner's Office (ICO). In the EU and EEA, it is the data protection authority where you live, work, or where you think the problem happened.

If something goes wrong

If a breach affects personal data we hold, we will tell POTRAZ within 24 hours of finding it, as Zimbabwe's Act requires; tell the EU or UK regulator within 72 hours where the GDPR requires it; and tell the people and schools affected without undue delay. The data handling page says what we will tell you. The extension holds no student data, so a breach on our side cannot expose student data from Toddle.

Changes

If what the software does with data changes, this page changes with it and the date at the top moves. A change that widened what we collect would be announced, not slipped in.