The Microphone Is Not in the Cast List: Auditing Your Child's School App Before Christmas

By the second week of December, the school-gate phone is doing overtime. There is the reminder about Christmas jumper day, a push alert about a change to pick-up, a link to pay for the panto trip, and a permission slip for the Nativity that needs signing before Friday. None of that is unreasonable. What is worth a second look is the app that delivers it — and the list of permissions it has collected along the way.

At McAfeeCom UK, we are not suggesting every school app is up to something. Most are ordinary communication tools wrapped in a login screen. But December is a sensible moment to check what you have agreed to, because the next few weeks bring a rush of photos, shared folders, calendar invites and messages from people who only need a narrow slice of your attention.

Why the school-gate app suddenly wants everything

Many UK schools use platforms such as ParentPay, Schoolcomms, Arbor, Class Charts or ClassDojo, and some use several at once. They are convenient. They also sit on a phone that knows where you are, who you ring and what you photograph. When an app asks for access to location, contacts, microphone or photos, it is not necessarily being nosy — but it should be able to explain why the Nativity notice needs it.

The key test is simple: does this permission help the school do the thing I actually need, or is it there because the app was built to collect more by default? A permission that is never used is still a permission you have granted.

The permissions that rarely need to be on

Start in your phone settings, not inside the app. On iPhone, look under Settings, then the app's name. On Android, open Settings, then Apps, then the app, then Permissions. You are looking for the same short list.

Location. A school app may want location for directions or a geofenced check-in, but most parents do not need to hand over precise location to read a newsletter. Set it to Never, or at most While Using the App with precise location switched off. If the app only needs to know you are near the school for pick-up, ask whether approximate location would do.

Contacts. There is almost no routine school-communication reason to upload your address book. Turn it off. If a feature breaks, ask the school or provider what specifically needs contacts and whether there is an alternative.

Microphone. The microphone is not in the cast list. Unless you are recording a voice note for a teacher, a parent-facing school app does not need it in the background. Set it to Ask or Never.

Camera and photos. You may want to upload a absence note or a doctor's letter. That needs access to a single photo, not the whole camera roll. On both iOS and Android you can often choose selected photos rather than granting full library access. Prefer that.

Bluetooth. A school app rarely needs Bluetooth to deliver a permission slip. Turn it off unless you have been given a clear reason.

Tracking and personalised ads. If the app offers a choice, say no. A school communication tool should not be building an advertising profile of your family.

Notifications. Keep these on if you rely on pick-up messages, but review them. A barrage of non-urgent alerts makes it easier to miss the one that matters.

What schools should be able to justify

Schools in the UK handle personal data under the UK GDPR and the Data Protection Act 2018. In most cases the school is the data controller and the app provider is a processor acting on the school's instructions. That means the school should be able to tell you what data is collected, why, how long it is kept and who can see it.

A good privacy notice will not be a single paragraph buried in a newsletter. It should cover the app, the provider, the categories of data, the retention period and the school's data protection officer or contact. It should also make clear that consent for photos and videos is separate from consent for ordinary school communication. You can agree to receive messages without agreeing to have your child's face in a public album.

Sensible questions to put to the school office or the data protection lead include: Which app is being used for what? Is the provider acting only on the school's instructions? What happens to the data when the contract ends? Can we opt out of photo sharing without missing essential notices? Who can view the class album, and does the link expire? These are ordinary procurement questions, not accusations.

The nativity photo album problem

The Christmas play is where privacy gets fuzzy. A well-meaning parent takes photos, creates a shared album, and sends a link to the class group. Suddenly images of children are in a cloud folder with no clear owner, no expiry date and no easy way to remove them.

Ask the school how it handles Nativity photos before the event. A closed album with named access and an expiry date is better than a public link. If the school uses the app to share images, check who can download them. If you are the one sharing, avoid surnames in filenames, avoid public social media posts, and do not upload images of other people's children without their parents' agreement. If you would rather your child was not photographed, tell the school early and in writing. Schools should have a process for that, and it should not mean your child misses the play.

A five-minute December audit

Open the school app and your phone settings side by side. Switch off location, contacts, microphone and Bluetooth unless you have a specific reason to keep them. Change photo access to selected images only. Review tracking and ad settings. Check the app store privacy label and the school's privacy notice. Update the app, then check the permissions again, because updates sometimes reset choices.

If something looks excessive, ask the school rather than deleting the app in frustration. A short email to the office or the data protection lead is usually enough. If you are not satisfied, the Information Commissioner's Office has guidance for parents and schools. You do not need to become a data protection expert to ask a sensible question before the angel Gabriel takes the stage.

December is busy enough. A few minutes now means the only thing arriving unannounced is the mince pie rota, not a request for your contacts list.