Security Overview
Last updated: September 2026
In short: Pupil data is stored in the UK and EU on Google's infrastructure, with some server-side processing that may happen elsewhere under appropriate safeguards. We collect as little as possible - first names, a PIN, and the live answers needed to run a spelling test. There's no advertising and no tracking, and the site loads nothing from outside services while it runs.
Where your data is stored
| What | Where | Provider |
|---|---|---|
| Pupil names, classes, seats, and live spelling test information | London, UK | Google Firebase Firestore |
| Checking that each screen's connection is live | Belgium, EU | Google Firebase Realtime Database |
| Teacher and pupil sign-in | Google infrastructure | Google Firebase Authentication |
| Checking class logins and PINs, and signing devices out | May process outside the UK/EU, with appropriate safeguards | Google Cloud Functions |
| Serving the website | Google infrastructure | Google Firebase Hosting |
Access control
The app uses role-based access. Each role can only see what it needs to:
- Pupils - Sign in with the class login and their own PIN, and only ever enter as themselves. On their waiting and typing screens, a child sees only their own name.
- Teachers - Can see all the pupils' names, status and results in their own class.
- School leads - Can see the classes in their school.
- Sear Education staff - Only where necessary for running the Service or for support.
Login security
- Teachers log in with email and password via Firebase Authentication. It's the same account they use for Mr Sear's MTC.
- Pupils log in with a class login plus their own 4-digit PIN. Class logins and PINs are checked on the server.
- PINs are kept apart: Each pupil's PIN is stored in a teacher-only store, never on the pupil's record.
- Signing devices out: Devices can be signed out through the server, so a pupil's screen does not stay signed in.
- Class passwords are protected: The class password is stored scrambled (hashed), and it is checked on the server rather than in the browser.
- Repeated wrong guesses are slowed down: After several wrong class passwords or PINs, the login is made to wait before it will try again.
- Changing the class password signs every device out, and changing a pupil's PIN signs that pupil out, so an old login stops working straight away.
- Pupil names are shown safely: Names are always displayed as plain text, so nothing typed into a name can run as code on the page.
- Secure connection: The site is only served over an encrypted connection (HTTPS), with the same browser security settings as Mr Sear's MTC.
Live test information
During a live test, the app holds the word the teacher has sent, the words sent so far in that test, each pupil's status, what each pupil typed for the current word, whether it was right, when they started typing, and whether their screen is connected.
This live information is cleared when the teacher ends or resets the test. Mr Sear's Spelling does not keep a long-term history of spelling results on the server. The teacher can download the current test's results as an Excel file to their own computer.
Spelling learning information is kept separate from Mr Sear's MTC. Spelling does not read or change MTC's maths results.
Teacher account records
Your teacher account is the same shared account used by Mr Sear's MTC. How records about that account are kept is explained in the Mr Sear's MTC Privacy Policy.
Third-party services
The app uses these external services:
- Google Firebase - Database, authentication, hosting, and server-side functions
- Zoho Mail - Sends invitation emails to teachers from the shared account system (teacher email addresses only)
Fonts, icons and libraries (including the Excel export and the QR code) are served from the Mr Sear's Spelling site itself, so no scripts or fonts are loaded from outside services while the app runs. There is no advertising and no tracking.
Data protection
For how we handle data on your school's behalf, see our Data Processing Agreement and Privacy Policy.
Contact
If you see an unexpected class, pupil, or account, stop using that screen and tell your school lead. If you have security questions or need to report a concern:
Sear Education
Email: info@mrsearmtc.uk