Who this covers
Noodle is made by Off Script Foundry, Inc., a Delaware corporation (“we”, “us”, “our”). This policy covers the Noodle website, apps and services, and we are the controller of the information described in it. Using Noodle also means agreeing to our Terms of Service.
There are usually two people involved: a parent or guardian who holds the account, and a student who does the learning. This policy is about both of them, and it is written for the parent to read.
- We collect the worksheet photos you take, the answers the student gives, and enough about the account to run it.
- We use it to work out what this student has actually misunderstood, and to build the next lesson from that.
- We do not sell it. We do not advertise to your child. We do not let AI providers train on it.
- You can see all of it, correct it, or have it deleted, whenever you ask.
What we collect
We do not collect location, contacts, or anything from the camera roll beyond the photo you deliberately send us. Noodle carries no advertising SDKs and no third-party analytics or tracking scripts.
Why we use it
- to read the worksheet and find where the student went wrong;
- to build the quest, and to choose what to teach next and what to skip;
- to track mastery, so the student is not re-taught something they have already shown they know;
- to show you, the parent, an honest report of how it went;
- to run accounts, to keep them secure, and to prevent abuse;
- to fix bugs and improve how well Noodle teaches;
- to meet our legal obligations.
If you are in the UK or the EU, our legal bases are: performing our contract with you, your consent for anything relating to a child, and our legitimate interest in keeping Noodle secure and working properly.
What we never do
- We never sell or rent personal information.There is no circumstance in which your family’s data is a product we offer to someone else.
- We never show ads in Noodle, and we never let anyone target your child.
- We never build advertising or marketing profiles out of a student’s work.
- We never let our AI providers train their models on your family’s content.
- We never make a student’s work public. There is no chat, no public profile, no feed, and no way for another user to see what your child wrote.
AI, and the companies that process for us
Noodle sends parts of your content to a small number of vendors that process it on our behalf, under contracts that limit them to that purpose and forbid training on it. Here is the whole list, and exactly what each one receives.
These companies process information in the United States and in the regions their own infrastructure runs in. If we add a processor that receives personal information, we will update this list before it starts.
Children’s privacy
Noodle is meant to be used by children, with a parent’s knowledge and consent. Only an adult can create an account, and a child never holds one of their own.
When you create the account and add a student profile, you are giving us your consent, as that child’s parent or guardian, to collect and use their information as described in this policy. Before we act on a request about a child’s data we may ask you to confirm it, for example by replying from the email address on the account.
We ask for the least we can: a display name, an optional grade level, the worksheets you choose to send, and the answers the student gives. We do not require a child to hand over more information than is reasonably necessary in order to use Noodle.
We do not disclose a child’s information to anyone beyond the processors listed above, and a child cannot share anything publicly through Noodle because there is nowhere in the product to do so.
- review everything we hold about your child;
- have any of it corrected;
- have any of it deleted, up to and including the whole profile;
- refuse to let us collect anything further, while keeping what has already been learned, or ask us to erase that too.
Email contact@offscriptfoundry.com from the address on the account and we will act within 30 days. Deleting a student profile removes that child’s photos, answers and progress.
Who else sees it
The processors in section 5, and nobody else, with three narrow exceptions:
- The law. If we receive a valid legal demand we will comply, and we will tell you about it unless we are legally forbidden from doing so.
- Safety. If we genuinely believe someone is at risk of serious harm, we may share what is needed to prevent it.
- A change of ownership. If Off Script Foundry, Inc. is ever acquired or merged, the buyer takes on the commitments in this policy, and we will tell you before any information moves.
How long we keep it
Deletion is handled by writing to contact@offscriptfoundry.com today; a self-serve control is on the way, and this section will describe it the moment it ships.
How we protect it
- Everything travels over an encrypted connection, and is encrypted at rest.
- Worksheet photos sit in a private bucket that is not publicly readable and is never handed out as a public URL.
- Passwords are hashed with bcrypt and never stored in a readable form.
- Database access is restricted to the service itself and to the few people who need it to keep Noodle running.
- Access rules at the database level stop one account from reading another’s data.
No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your family’s information, we will tell you promptly, tell you what happened, and tell you what to do about it.
Your rights
Wherever you live, you can ask us to show you what we hold, correct it, delete it, send you a copy, or withdraw a consent you previously gave. Email contact@offscriptfoundry.com and we will respond within 30 days.
If you are in California, you have the right to know, to delete, to correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we do not use or disclose sensitive personal information beyond what is needed to provide Noodle, so there is nothing to opt out of. We will never treat you differently for exercising a right.
If you are in the UK or the EU, you have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your national data protection authority.
Cookies
Noodle sets one kind of cookie: the one that keeps you signed in. There are no advertising cookies, no analytics cookies and no third-party trackers, which is why there is no cookie banner in your way.
Where your information goes
We are based in the United States and so are our processors. If you use Noodle from elsewhere, your information is transferred to and processed in the United States, which may have different privacy laws from your own. Where the law requires it, we rely on the European Commission’s standard contractual clauses, or the UK equivalent, to cover that transfer.
Changes to this policy
When this policy changes we will post the new version here and update the date at the top. If a change is material we will email you at least 14 days before it takes effect. If a change affects how we handle a child’s information, we will ask for your consent again wherever the law requires it.
This policy was last updated on 30 July 2026.
Contact
Questions, requests or complaints all go to the same place, and a person reads them.
Off Script Foundry, Inc., a Delaware corporation, United States. Our postal address is available on request.
Email: contact@offscriptfoundry.com