BugBot for school IT teams
Last updated 11 September 2026
Everything runs in the browser. There is nothing to install on student machines, no plug-in, no extension, and no software on the network. The Python runs inside the browser page (WebAssembly), so student code never leaves the machine unless a student is in a class, in which case the last program they ran is saved for their teacher.
Browser requirements
- Any current Chrome, Edge, Firefox or Safari (released in the last two years). Chromebooks are fine.
- WebAssembly, Web Workers and WebGL must be allowed (they are on by default everywhere).
- The first visit downloads the Python runtime, about 12 MB, which the browser then caches. On a slow school connection, opening the lessons page a minute before the class starts helps.
- Local storage must be allowed for bugbotlab.com (progress and the class code are kept there). Private browsing works but forgets progress when closed.
- No pop-ups are needed for students. Teachers signing in with Google or Microsoft need pop-ups allowed for
teach.bugbotlab.com.
Allow-list
If your filter blocks by default, allow these hosts over HTTPS (port 443). None of them require anything other than outbound HTTPS.
| Host | What for | Needed by |
|---|---|---|
bugbotlab.com, www.bugbotlab.com, bugbotlab.web.app | The websites, lessons, competitions, simulator, docs | Everyone |
bugbot-teach.web.app, teach.bugbotlab.com | The teacher tools | Teachers |
firestore.googleapis.com | Class data (live updates use long-polling over HTTPS, no WebSocket required) | Students in a class, teachers |
identitytoolkit.googleapis.com, securetoken.googleapis.com | Sign-in (anonymous for students, accounts for teachers) | Students in a class, teachers |
accounts.google.com, login.microsoftonline.com, bugbotlab.firebaseapp.com | Google / Microsoft sign-in | Teachers only |
www.gstatic.com, fonts.googleapis.com, fonts.gstatic.com | Firebase client library and fonts | Everyone |
cdnjs.cloudflare.com | Open-source libraries: the code editor (CodeMirror), the 3D view (three.js), markdown | Everyone |
cdn.jsdelivr.net | The Python runtime in the browser (Pyodide 0.26) | Everyone |
www.googletagmanager.com, *.google-analytics.com, *.analytics.google.com | Google Analytics, optional: loads only after consent. Blocking it does not affect the lessons. | Optional |
assets.mailerlite.com, groot.mailerlite.com | The waitlist form on the front page only | Optional |
Nothing is loaded from any other host. There are no adverts and no advertising networks.
No internet? The offline bundle
For a room with no connection, or a filter you cannot change, download the offline bundle (about 8 MB). Unzip it on any machine with Python 3, run START.bat (Windows) or start.sh (Mac, Linux), and the lessons, competitions, simulator and docs open at http://localhost:8000/ with every library included. Progress is saved in the browser. Classes, live rooms and feedback need the internet and are off in the bundle. It can also be served from a school web server or a shared drive with any static server.
Data map
| Data | Where it lives | Who can read it |
|---|---|---|
| Student progress when not in a class | The student's browser only (local storage) | The student |
| Student class record: nickname, anonymous id, current lesson, task results, last program run, last error, timestamps | Cloud Firestore, London (europe-west2) | The student (own record) and the teacher who made the class. Database rules enforce this; there is no admin console access for schools. |
| Teacher account: email, name, provider id | Firebase Authentication (Google) and Cloud Firestore, London | The teacher, BugBotLab support |
| Class settings: name, code, message, assignment, locked modules, hints | Cloud Firestore, London | The teacher; students in the class read the settings that apply to them |
| Feedback and problem reports | Cloud Firestore, London, then emailed to BugBotLab (Google Workspace) | BugBotLab support only |
| Analytics events (with consent) | Google Analytics 4 | BugBotLab, aggregated |
Accounts and sign-in
- Students never create accounts. Joining a class creates an anonymous Firebase identity in that browser, tied to nothing but the nickname they typed. Leaving the class or clearing site data ends it.
- Teachers sign in with a school Google Workspace or Microsoft 365 account (recommended, so your normal offboarding applies), or with an email address and password.
- Microsoft sign-in uses a multi-tenant Entra application; admin consent is only required if your tenant blocks user consent for the basic
openid email profilescopes. No other permissions are requested.
Deleting data
A teacher can delete a class, which deletes every student record in it, from BugBot Teach. To delete a teacher account or for a school-wide deletion at the end of a contract, email info@bugbotlab.com; we complete it within 30 days and confirm in writing.
Documents
- Privacy notice, including the list of processors.
- DPIA template, pre-filled for BugBot, for your data protection officer to complete.
- A signed data processing agreement is included with the School plan. Ask at info@bugbotlab.com.