This is the short version. The full detail for schools is in What the extension can and cannot see, and on our privacy policy and security page.
In short
It runs only on Toddle (
web.toddleapp.com), and nowhere else.It reads, it does not write. It reads only what your own Toddle account can already see, through a fixed list of read-only requests. It cannot change anything in Toddle.
Nothing it reads leaves your browser. There is no account, no analytics, no tracking and no advertising.
It stores no student data. What it reads is kept in the page's memory for a few minutes, then dropped. It stores only your settings, your licence key, the email of the Toddle account you are signed in with (to check who the licence is for), and the result of the last cancelled-key check.
Student flags are read only for the student sidebar, for the student it has open, and forgotten when it closes. You can conceal flags across Toddle before you share your screen: see Concealing student flags for a shared screen.
It never sees your password.
Its two connections outside Toddle
Neither ever carries anything from Toddle.
Feedback, only when you send it. The Send feedback form in the toolbar menu sends what you typed and the extension's version number, and only when you press Send.
A daily check for cancelled licence keys, only while a key is entered. It sends no key and no data. If the check fails, the extension keeps working. See How licences work.
Security
The extension has had two adversarial security reviews, on 1 and 6 October 2026. Every finding of the first is fixed in version 0.8.2, and each fix has a test that would fail if the problem came back. The fixes include:
text from Toddle is always shown as plain text, never run as code
a CSV export can no longer carry a spreadsheet formula
your Toddle sign-in is only ever sent to Toddle
other scripts on the Toddle page cannot read the extension's answers
the licence page cannot be opened or framed by another website
What the reviews found, and the limits no extension can remove, are on our security page.
Chrome updates the extension on its own. If your school pins a version, please move to 0.8.2 or later.
For your school
We are not a data processor for your school: we receive no student data. Your school remains the controller of its data, and Toddle remains its processor. If your data protection officer has questions, or wants to review the code, write to us. A data processing agreement is available on request.
Contact
Privacy and data requests: [email protected]
Reporting a security problem: [email protected], with the subject "Security". We acknowledge reports within 3 working days. Please do not include real student data in a report.
Anything else: [email protected]
Toddle is a trademark of its owner. Nyuchi and the Toddle Enhancement Extension are not affiliated with, endorsed by or sponsored by Toddle. A problem with Toddle itself should go to Toddle.