Data protection, security and accessibility for UK schools

Edition: United StatesUnited KingdomIreland

Updated 9 October 2026

Summary

SpeakPad is an AAC app for iPhone and iPad. Everything a pupil creates or says in it stays on the device, or in the iCloud account the device is signed in to. We have no servers that receive pupil data, no user accounts, and no analytics, advertising, tracking or crash-reporting code in the app. We cannot see, export or delete anything on your devices, because none of it ever reaches us.

No sign-up, login or account of any kind.
The app’s privacy manifest declares no collected data types and no tracking.
Speech is generated on the device. Nothing a pupil says is sent anywhere.
Your device management service can turn off iCloud backup and usage recording on every iPad and lock the caregiver settings behind one PIN.
Listed in Apple’s Kids Category, which bans third-party analytics and advertising.

What data exists and who can see it

Data	Where it is stored	Who can access it
Profile name and optional photo for each communicator	On the device	Staff who pass the caregiver gate on that device
Boards, words, personal photos and recorded voice clips	On the device	Staff who pass the caregiver gate
Usage records: word taps and spoken sentences, with times	On the device, only while usage recording is on	Staff who pass the caregiver gate. Your device management service can turn recording off with `recordUsage`.
Automatic backups (the five most recent)	The iCloud account the device is signed in to, such as a school’s Managed Apple Account	The account holder. Not SpeakPad. Turn off with `allowICloud`.
Exported `.speakpad` backup or board files	Wherever staff choose to save or send them	Whoever staff share them with
Pro purchases and licences	Apple (App Store, Apple School Manager)	Apple and the purchasing organisation. The app checks the licence on the device.

Data is protected at rest by iOS Data Protection, the device’s built-in encryption. Deleting a profile in SpeakPad removes its boards and records from the device; deleting the app removes everything stored on the device. Backups in iCloud are removed by the account holder in iCloud settings.

Network connections

SpeakPad works fully offline. It connects to the internet only in these cases, none of which carry pupil data to us:

Connection	When	What is sent
Apple iCloud	Automatic backup, if the device is signed in to iCloud and `allowICloud` is not false	The backup, to the device’s own iCloud account, handled by Apple
Apple App Store (StoreKit)	Buying, restoring or checking a Pro licence	Purchase requests, handled by Apple
Apple iCloud sharing (CloudKit)	Only if staff share a communicator's boards with colleagues	The shared boards, photos, goals, sessions and notes, to the iCloud accounts of the people invited. Never usage history, and never to us.
`voices.speakpadapp.com`, hosted by Cloudflare	Only when a member of staff chooses to download an optional SpeakPad voice	A request for the voice file. No personal data, and we keep no record of who downloaded it.

To allow-list SpeakPad on a filtered network, permit Apple’s standard iCloud and App Store services and, if you want the optional voices, voices.speakpadapp.com.

Your school is the controller of any personal data on its devices, including the data SpeakPad stores there. SpeakPad (the developer) does not receive, store or otherwise process pupil personal data, so we are not a processor for your school and an Article 28 processing agreement is not needed. If your data protection officer would still like that in writing, we will sign a statement confirming it, or review your school’s or trust’s own agreement.

Apple acts for you when you use iCloud, Managed Apple Accounts and Apple School Manager, under your organisation’s agreement with Apple. If you would rather keep backups off iCloud altogether, set allowICloud to false through your device management service; boards can still be exported to a file you control.

Subject access, correction and erasure requests are handled on the device: staff can view, export, edit or delete a profile and its records in SpeakPad. There is nothing held by us to search.

Answers for your DPIA

What personal data is processed?: A display name and optional photo for each communicator, the words and photos on their boards, optional recorded voice clips, and, if usage recording is on, a record of word taps and sentences with times. No special category data is requested, although a communication record can reveal things about a pupil’s needs.
Where is it stored, and is it transferred outside the UK?: On the device. If iCloud backup is on, Apple stores the backup in the device’s iCloud account under your organisation’s agreement with Apple. SpeakPad transfers nothing.
Who has access?: Staff who pass the caregiver gate on the device. Communicators can only use their boards; settings, editing, records and purchases sit behind the gate, which your device management service can set to one PIN.
How long is it kept?: Boards, profiles, goals and notes until staff delete them or remove the app. Usage records for the profile’s retention period, 90 days by default; staff can lengthen it or keep them indefinitely. iCloud keeps the five most recent backups.
Is there profiling, automated decision-making, advertising or tracking?: No.
Can a pupil’s data move with them?: Yes. Export the profile as a .speakpad file and restore it on a family iPad or at the next school, free and without a licence.

The Children’s code

SpeakPad was built for children, and its design matches the ICO’s Age appropriate design code:

High privacy by default: no account, no data sent to us, nothing to switch off before use.
No profiling, no nudging, no advertising: none of these exist in the app. Purchases and settings sit behind a caregiver gate the child does not use.
No geolocation and no connected toys: SpeakPad never asks for location.
Data minimisation: usage recording can be turned off on the device or by your device management service.
Parental controls: staff and parents can see what is recorded, and the child’s words and boards remain theirs to export.

For the Department for Education’s digital and technology standards, SpeakPad needs no school network services beyond Apple’s, stores nothing with us, and its accessibility report is below.

Security questionnaire answers

Short answers to the questions most school and trust questionnaires ask. We will complete your own questionnaire on request.

Do you host or store customer data?: No. SpeakPad has no backend that receives customer data. Optional voice files are served from Cloudflare and contain no personal data.
How is data encrypted?: At rest by iOS Data Protection on the device. iCloud backups are encrypted by Apple in transit and at rest. Voice downloads use HTTPS.
Authentication and access control?: No accounts. Caregiver functions are behind a gate that can be a four-digit PIN set by device management (gatePIN), with Face ID and Touch ID unlock able to be turned off (allowBiometricUnlock).
Third-party code and sub-processors?: One open-source library for reading and writing backup archives (ZIPFoundation), which makes no network connections. No SDKs for analytics, advertising, attribution or crash reporting. Apple provides iCloud and the App Store; Cloudflare hosts the optional voice files.
Logging and monitoring?: The app sends no logs or telemetry. Usage records exist only on the device, for staff to read.
Vulnerability reporting?: Report to security@speakpadapp.com. We acknowledge within 48 hours and give an initial assessment within 5 business days.
Penetration testing and certifications?: No third-party penetration test or certification (such as Cyber Essentials) has been carried out. With no server holding customer data, the app’s attack surface is the device itself, which your device management service controls.
Data retention and deletion at the end of a contract?: Nothing to return or delete on our side. Remove the app, or delete profiles, on your devices, and remove iCloud backups in the device’s iCloud account. Licences end with their term, and exporting a profile as a .speakpad file stays free.
Business continuity?: SpeakPad runs offline with no service of ours in the loop, so it keeps working if our systems are unavailable. Each profile can be exported to a file the school holds.

Accessibility conformance report

A self-assessment of SpeakPad 3.0 for iPhone and iPad against WCAG 2.1 Level AA, applied to a native app as described in WCAG2ICT, the standard that EN 301 549 uses for software and that the UK’s public sector accessibility regulations rely on. It follows the structure of the VPAT 2.5 but has not been checked by a third party. Evidence comes from Xcode Accessibility Inspector audits, VoiceOver and Switch Control reviews, and automated interface tests. Testing with physical switches and with Apple’s Eye Tracking on a real device is still in progress, so those are reported as not yet verified.

Criteria	Level	Remarks
1.1.1 Non-text content	Supports	Every symbol button has a text label that VoiceOver reads; decorative images are hidden from assistive technology.
1.3.1 Info and relationships	Partially supports	Buttons, headings and lists expose their roles. Some audit findings on caregiver screens are still open.
1.3.4 Orientation	Supports	Boards can follow the device in either orientation. A board can be locked to one orientation where a fixed motor plan or keyguard makes that essential.
1.4.1 Use of color	Supports	Word categories use color plus shape badges, and Differentiate Without Color is honoured.
1.4.3 Contrast (minimum)	Partially supports	Most text meets 4.5:1; some audit findings about text and contrast are still open.
1.4.4 Resize text	Partially supports	Caregiver screens follow Dynamic Type. Board labels have their own size setting so that buttons never move; at the largest sizes some labels are capped to keep the grid stable.
2.1.1 Keyboard	Partially supports	All communication is reachable with Switch Control and with SpeakPad’s own scanning. Full Keyboard Access has not been fully evaluated.
2.2.1 Timing adjustable	Supports	Scanning speed, dwell time and hold durations are adjustable; nothing times out the user.
2.3.1 Three flashes	Supports	No flashing content. Reduce Motion is honoured.
2.5.1 Pointer gestures	Supports	Every action works with a single tap; no multi-finger or path gestures are required.
2.5.3 Label in name	Supports	Accessible names come from the visible labels, so the words on screen are the words to use with Voice Control.
3.1.1 Language of page	Supports	Speech and labels follow the chosen language, including two languages at once in bilingual mode.
3.2.1 / 3.2.2 Predictable focus and input	Supports	Tapping a word speaks it or opens its folder; settings never change on focus.
4.1.2 Name, role, value	Partially supports	Standard controls expose name, role and value. Some audit findings on caregiver screens are still open.
Physical switches and Apple Eye Tracking	Not yet verified	Implemented and tested in software; hardware validation on a real iPad is in progress.

Accessibility features available at no cost: Switch Control and in-app scanning (row-column, linear and group), dwell selection for head tracking and pointer access, Touch Accommodations, VoiceOver, Personal Voice, Assistive Access, adjustable button and label sizes, and a scanning highlight color. Report an accessibility problem to support@speakpadapp.com.

Supplier and purchasing details

Supplier: Jonathan Mullan, the developer listed on the App Store, trading as SpeakPad.
How do we buy?: The app is free. SpeakPad Pro Edition, the same app with Pro included, is bought once per iPad through Apple School Manager or Apple Business, which handles invoicing and VAT. Annual Pro licences for pupil iPads are bought the same way once Apple opens volume purchasing on 22 October 2026. Prices for your country are shown in the App Store; the schools page explains which to choose.
Contact: support@speakpadapp.com. Please don’t include pupil names or personal information.