No child leaves with the wrong adult because somebody was unsure at the kerb.
The office cannot know that today it is the aunt. Guardians add and withdraw the adults who may collect their child themselves, so the list a member of staff checks is current rather than whatever was written down at admission.
Staff are not asked to decide on the kerb. Where somebody is not on the list the answer is no — and if a member of staff overrides that anyway, it raises an incident naming the person and alerts the guardians at once. A system that only ever says no produces no record of what staff actually did.
Authorisations are withdrawn rather than deleted, incidents are never removed, and dismissed is kept distinct from resolved. When a school is asked about a particular afternoon weeks later, it has an answer rather than a recollection.
Every school already has a rule about who may collect a child. It is usually a sentence in the admission form and a memory in a member of staff’s head, and it is tested at the worst possible moment — at a bus stop, in the rain, with a queue behind, by an adult who says they are the uncle and is probably telling the truth.
Asked to decide on the spot, with no list and no way to check, staff will let the child go. That is not a failure of diligence. It is what happens when the school gives somebody a responsibility and no means of discharging it.
The adults who may collect a child are maintained by that child’s guardians, from the parent app. Not by the office, because the office cannot know that this week the grandmother is staying, or that today the neighbour is doing the run.
Each entry carries a name, a relationship in the family’s own words, and a phone number, so staff can ring to confirm before handing a child over. It can be open-ended, or valid between two dates, or — the common case — a one-time authorisation for one person on one afternoon, which is spent the moment it is used and cannot be used again.
A guardian may also set a handover code: a short secret shared with whoever they are sending, read out at the kerb. It is stored hashed and there is no way to read it back — a parent who forgets theirs sets a new one. A stolen copy of the school’s data does not yield a working set of codes for every child.
Staff meeting the child open the collection list on their own device and check the adult in front of them. The name and the code are checked separately and reported separately, which matters more than it sounds: an adult who is on the list but has the wrong code needs a phone call, while an adult who is on no list needs something else entirely.
Where nobody matches, the answer is no, and staff are shown who is authorised so they can ask for one of them.
Sometimes a member of staff will hand a child over regardless. A parent is on the phone insisting, the queue is building, and refusing feels absurd.
So the override exists — and it is deliberately loud. Using it records an unauthorised pickup as a high-severity incident naming the person who took the child, and alerts the guardians immediately. The school finds out within the minute rather than at bedtime, and there is a permanent record of what was actually done.
Incidents cannot be deleted. An incident that is dismissed stays visibly distinct from one that was resolved, so nobody can quietly reduce the count.
The same principle covers the gate. A visitor who is expected — a parent coming in for a meeting, a contractor, an external examiner — is registered before they arrive, against the member of staff they are coming to see. Arrival and departure are recorded, so at any hour the school can say who is on the premises, and afterwards it can say who was.
It is the same question the collection list answers, asked at a different door: which adults does this school have a reason to let near its children today.
A demo runs about forty minutes and uses your own class lists, frameworks and grading — so you are looking at your school rather than a sample database.
Or try it first — the Trial tier gives you a full term, free, with every module unlocked. See plans.
Either way we confirm your school by phone before activating it, so you are live usually within one working day.
