Privacy.

Who we are.

I’m Mark Morren. I design and build small software tools for schools under the Morren name at morren.uk. I work on this as a sole maker alongside my day role as Digital Development Officer for the City of Edinburgh Council.

Data Controller: Mark Morren, Edinburgh, Scotland.
ICO registration: pending — registration being confirmed before any public data collection begins.
Contact for privacy matters: [email protected]

morren.uk is a personal project. It is independent of and not affiliated with my employer (City of Edinburgh Council) or any other organisation. The Council has no role in the operation of these tools, and no Council data is processed through morren.uk.

I don’t have a Data Protection Officer (not required for a sole trader at this scale), but I use AEGIS — a specialist data protection adviser — to review my privacy documentation and practices.

What this notice covers.

This notice applies to:

• The morren.uk website itself
• All publicly accessible Morren web tools (Visual TT, SFL Tracker, iPad Dashboard, LC Tracker, Class Points Tracker)
• Morren iOS apps (StoryBuilder)

It does not apply to: third-party websites linked from morren.uk; internal tools not publicly accessible; or school information systems that schools manage independently.

Where a school deploys a Morren tool and enters data about their staff or pupils, the school is the data controller for that information. This is explained further in each tool’s section below.

This website.

Contact

The contact link on this site opens your email client with my address ([email protected]). Emails go directly to my inbox — there is no server-side form, no database, and nothing stored outside my email account.

I keep what you send only as long as I need to reply and follow up. I don’t add you to any list, and I don’t share your message.

Lawful basis: Legitimate interests (Article 6(1)(f)) — responding to genuine enquiries is a reasonable purpose.

Analytics

This site uses Cloudflare Web Analytics, which is cookieless and first-party. It tells me how many visits each page gets and which pages are popular. It does not set cookies, does not track you across sites, and collects no personal data.

Because no cookies or personal data are involved, no consent banner is required or shown.

No cookies

morren.uk places no cookies of any kind. There is nothing to accept or decline.

The tools.

Each tool is described below with its own data handling summary. The five web tools listed on this site are all free to use by school staff for professional purposes.

Visual TT

Visual TT is a timetable planning tool for school staff. Teachers enter lesson names, room names, class names, and timetable slots to build a visual schedule.

Data collected: timetable entries you type in — lesson names, rooms, class group labels. No pupil names. No personal photos.

Storage: Cloudflare Workers and KV storage, hosted on Cloudflare’s global network. Data is stored against your session and persists until you clear it or it expires. The app includes a service worker for offline use — timetable data is cached locally so the app works without a connection after the first visit. A JSON backup/restore option is available in Settings.

Lawful basis: Legitimate interests (Article 6(1)(f)) — a professional tool for school staff managing their own timetable.

Transfers: Cloudflare Inc. is a US company. See Section 9.

SFL Tracker

SFL Tracker is a teacher dashboard for tracking pupil progress against the Scottish Framework for Learning — assessments (SWST, SWRT, maths), SHANARRI indicators, and intervention records.

Data collected: pupil names (as entered by the teacher), class group, assessment scores, SHANARRI indicators, intervention notes. No photographs, no special category data by design. Surnames are not required and teachers are encouraged to use first name only.

Storage: entirely on your device. SFL Tracker uses sql.js WebAssembly SQLite — all data is held in a portable .db file that never leaves your device. No data is ever sent to any server. To use your data on another device, save the .db file to your own cloud storage or shared drive; the sync happens through your storage, not through Morren infrastructure.

Lawful basis: Legitimate interests (Article 6(1)(f)) for the tool’s operation. Schools rely on their own lawful basis (usually public task, Article 6(1)(e)) for processing pupil data.

Transfers: none. SFL Tracker is fully offline — no pupil data is ever transmitted to or held by Mark Morren.

iPad Dashboard

iPad Dashboard is a fleet management tool for school IT teams. You import a CSV export from your Jamf MDM system and it builds a visual overview of your iPad fleet — device models, status, school allocation, and provisioning progress.

Data collected: Jamf CSV data you upload — device names, serial numbers, asset tags, and any user assignment fields in your export (which may include staff names).

Storage: entirely on your device. iPad Dashboard is a single HTML file that processes your CSV locally in the browser using SQLite-WASM. No data is ever sent to any server. I receive nothing.

Controller/processor note: Because I receive no data from this tool, you are the sole data controller for your import. My role is tool provider only.

Transfers: none. The tool is fully offline.

LC Tracker

LC Tracker is an internal team workload and task tracking tool used by me and a small group of colleagues. It is publicly accessible at the URL above but designed for a named team only.

Data collected: team member names, task descriptions, school partnership records, workload allocations.

Storage: Firebase Realtime Database, project lc-tracker-e0b3f, operated by Google LLC.

Lawful basis: Legitimate interests (Article 6(1)(f)) — coordinating a small professional team.

Transfers: Firebase is a Google service operated from the US. See Section 9.

Team members are informed of this processing when they join the team.

Class Points Tracker

Class Points Tracker is a classroom behaviour and reward tool that lets teachers award points to groups and maintain a class leaderboard.

Data collected: pupil display names (first name and last initial only, e.g. “Alex J.”) and points totals. No email addresses, no accounts, no photographs, no dates of birth, no special category data.

Pupils do not have accounts. They do not log in. Teachers do not have accounts.

Storage: entirely on your device. Class Points Tracker uses sql.js WebAssembly SQLite — all data is held in a portable .db file that never leaves your device. The board view (projector display) communicates with the teacher view via BroadcastChannel — tab-to-tab in the browser, no server involved.

Transfers: none. Class Points Tracker is fully offline — no data is ever transmitted to or held by Mark Morren.

Lawful basis: Legitimate interests (Article 6(1)(f)) for the tool’s operation. Schools rely on their own lawful basis (usually public task, Article 6(1)(e)) for processing pupil data.

StoryBuilder (iOS)

StoryBuilder is a creative writing app for iOS, currently available via TestFlight for beta testers.

Data collected by me: none. All stories and content you create in StoryBuilder are stored on your device and, if you have iCloud enabled, in your personal iCloud account. I have no access to content created in the app.

If a school deploys StoryBuilder through Apple School Manager or MDM, the school manages the iCloud and data context for their pupils. Apple’s privacy policy governs iCloud sync.

Children’s data.

Several tools are used in schools, where children’s data may be processed. I have designed these tools with children’s privacy as a first concern:

• Pupils do not have accounts in any Morren tool.
• Where pupil data is entered by a teacher, only the minimum necessary is collected — typically first name and a class group.
• No photographs, biometric data, dates of birth, or special category data about children is collected by any Morren tool.
• All Morren tools store pupil data locally on the teacher’s device. No tool currently transmits pupil data to Morren infrastructure.

These principles reflect the spirit of the UK Information Commissioner’s Children’s Code (Age Appropriate Design Code), even where the tools are designed for teacher use rather than direct pupil access.

Special category data.

None of the Morren tools are designed to collect special category data — health information, ethnicity, religion, biometric data, or similar. If a teacher enters free-text notes that happen to include such information, it is their responsibility to ensure this is covered by their school’s data protection policies.

If you believe a tool is prompting or encouraging the collection of special category data, please let me know at [email protected].

For schools.

Several Morren tools process personal data on behalf of schools. Where this is the case, the school is the data controller and Mark Morren acts as a data processor under UK GDPR Article 28. This means the school retains control over the data; Mark processes it only on the school’s instruction.

All current Morren tools store data locally on the teacher’s device. No tool currently requires a controller/processor relationship. This section will be updated if a cloud-backed tool is introduced.

Data Processing Agreement

No DPA is currently required for any Morren tool, as no tool transmits or stores personal data on Morren’s infrastructure. If a cloud-backed tool is introduced in future, a DPA will be required before any school formally deploys it. Contact [email protected] with any questions.

No DPA required for

• Visual TT — no pupil personal data is processed
• iPad Dashboard — fully offline; no data is ever transmitted to or held by Mark Morren
• SFL Tracker — fully offline; no data is ever transmitted to or held by Mark Morren
• Class Points Tracker — fully offline; no data is ever transmitted to or held by Mark Morren
• LC Tracker — internal team tool; not used for school-controlled data

Hosting and data residency

morren.uk and all web tools are hosted on Cloudflare Pages (Cloudflare, Inc., US). No pupil data is transmitted to Cloudflare infrastructure — all tools that handle pupil data store it locally on the teacher’s device.

Full details of all processors and transfer safeguards are in Section 8 below.

Third-party processors.

I use the following companies to provide infrastructure. Each has a Data Processing Agreement in place with me.

No data is sold, rented, or shared with any third party for their own purposes. No advertising networks. No data brokers.

International transfers.

Some of the processors above are US companies. Under UK GDPR, transfers of personal data outside the UK require appropriate safeguards.

• Cloudflare, Firebase, Apple: covered by the UK-US Data Bridge, where applicable. No pupil data is transmitted to Cloudflare — all tools that handle pupil data are fully offline.
• iPad Dashboard: no transfers at all (fully offline).
• SFL Tracker: no transfers. Fully offline — data stays in a local .db file on the teacher’s device.
• Class Points Tracker: no transfers. Fully offline — data stays in a local .db file on the teacher’s device.

I have reviewed each processor against the ICO’s transfer risk assessment guidance and maintain records of these assessments.

Your rights.

Under UK GDPR, you have the following rights in relation to your personal data. To exercise any of them, email [email protected]. I will respond within one calendar month.

• Right of access You can ask what personal data I hold about you and receive a copy of it.
• Right to rectification You can ask me to correct inaccurate data or complete incomplete data.
• Right to erasure You can ask me to delete your personal data. I will do so unless there is a legitimate reason to retain it (for example, an ongoing legal obligation).
• Right to restriction You can ask me to pause processing your data while a concern is being investigated.
• Right to data portability Where processing is automated and based on consent or contract, you can ask for your data in a machine-readable format.
• Right to object Where I rely on legitimate interests as a lawful basis, you can object to that processing. I will stop unless I can demonstrate compelling legitimate grounds.
• Automated decision-making None of the Morren tools make automated decisions with legal or otherwise significant effects on individuals.

Pupil data rights: all Morren tools store pupil data locally on the teacher’s device. Mark Morren holds no pupil data and cannot fulfil pupil data rights requests directly. Any such requests should be directed to the school, who control the data.

Complaints.

If you’re unhappy with how I’ve handled your data, please email [email protected] first — I’d always rather sort things directly.

If you’re not satisfied with my response, you have the right to complain to the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this notice.

I review this notice at least annually and whenever a significant change is made to a tool or the way data is processed. The “last updated” date below shows when this version was published. Where changes are material, I’ll post a brief note on morren.uk.