Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes, and to what extent, in connection with the provision of our application.

Our terms of use also apply to your use of Lectio.

The terms used are not gender-specific.

Last updated: October 23, 2026

Table of Contents

• Preamble
• Controller
• Overview of Processing Activities
• Relevant Legal Bases
• Security Measures
• Disclosure of Personal Data
• International Data Transfers
• General Information on Data Storage and Deletion
• Rights of Data Subjects
• Provision of the Online Offer and Hosting
• Registration, Login, and User Account
• Signing In with Apple or Google
• Semester Sync
• Contact and Inquiry Management
• Moodle Integration
• TUCaN Import
• Username and Friends
• Update Check
• Third-Party Providers Used (Supabase, Vercel, GitHub)
• Changes and Updates
• Glossary of Terms

Controller

Mateo Arenas Salas
Spreestraße 5, Flat 5130
64295 Darmstadt, Germany

Email: mateoas@icloud.com

Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

• Account data.
• Contact data.
• Content data.
• Usage data.
• Meta, communication, and procedural data.
• Log data.

Categories of data subjects

• Communication partners.
• Users.

Purposes of processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Organizational and administrative procedures.
• Feedback.
• Provision of our online offer and user friendliness.
• Information technology infrastructure.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we base our processing of personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or registered office. Should more specific legal bases apply in individual cases, we will inform you of these in this privacy policy.

• Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
• Legitimate interests (Art. 6(1)(f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests, fundamental rights, and fundamental freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains, in particular, special provisions on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transmission and automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Applicability of data protection provisions in the country of registered office: In the country in which the controller has its registered office, national data protection regulations apply in addition to the General Data Protection Regulation (GDPR).

Security Measures

In accordance with the legal requirements, taking into account the state of the art, the cost of implementation, and the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, availability, and its segregation. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data, and responses to any compromise of data. We also take the protection of personal data into account as early as the development or selection of hardware, software, and procedures, in accordance with the principle of data protection through technology design and through data protection-friendly default settings.

Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured with an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is being transmitted securely and encrypted.

Disclosure of Personal Data

In the course of our processing of personal data, it may occur that such data is transmitted to or disclosed to other bodies, companies, legally independent organizational units, or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks, or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

International Data Transfers

Data processing in third countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in connection with the use of third-party services or the disclosure or transmission of data to other persons, bodies, or companies (which becomes apparent from the postal address of the respective provider, or where the privacy policy explicitly refers to data transfers to third countries), this always takes place in accordance with the legal requirements.

For data transfers to the USA, we rely on the Data Privacy Framework (DPF) where the recipient is certified under it; the EU Commission recognized the DPF as a safe legal framework by an adequacy decision dated July 10, 2023. Where a recipient is not certified under the DPF, the transfer is based on the EU Commission's Standard Contractual Clauses, which establish contractual obligations to protect your data.

For each individual service provider, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/. Specific information on the providers we use can be found in the section "Third-Party Providers Used (Supabase, Vercel, GitHub)".

For data transfers to other third countries, corresponding safeguards apply, in particular Standard Contractual Clauses, explicit consent, or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found on the EU Commission's website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with the legal provisions as soon as the underlying consent is revoked or there is no further legal basis for the processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule apply where statutory obligations or particular interests require longer retention or archiving of the data.

In particular, data whose storage is necessary for the assertion, exercise, or defense of legal claims or to protect the rights of other natural or legal persons may be retained for longer accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing activities.

Where multiple retention periods or deletion deadlines are specified for a given piece of data, the longest period shall always apply. Data that is no longer retained for its original purpose, but is retained due to statutory requirements or other reasons, is processed exclusively for the reasons justifying its retention.

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, arising in particular from Articles 15 to 21 GDPR:

• Right to object: You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw any consent given to us at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about this data as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: In accordance with legal requirements, you have the right to request the completion of data concerning you or the correction of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with legal requirements, you have the right to request that data concerning you be deleted without delay, or, alternatively, in accordance with legal requirements, to request a restriction on the processing of the data.
• Right to data portability: You have the right to receive data concerning you that you have provided to us, in accordance with legal requirements, in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you violates the GDPR. The authority responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information), P.O. Box 3163, 65021 Wiesbaden, Germany, https://datenschutz.hessen.de.

Provision of the Online Offer and Hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to deliver the content and functions of our online services to the user's browser or device.

• Types of data processed: Usage data (e.g., page views and length of visit, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved). Log data (e.g., log files relating to logins or the retrieval of data or access times).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online offer and user friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Security measures.
• Retention and deletion: Deletion in accordance with the information provided in the "General Information on Data Storage and Deletion" section.
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities, procedures, and services:

• Provision of the online offer on rented storage space: For the provision of our online offer, we use rented storage space as well as the associated computing capacity and software from specialized hosting providers (see the section "Third-Party Providers Used (Supabase, Vercel, GitHub)"); Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
• Collection of access data and log files: Access to our online offer is logged in the form of so-called "server log files." Server log files may include the address and name of the web pages and files accessed, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, e.g., to prevent server overload (particularly in the event of malicious attacks, so-called DDoS attacks), and also to ensure the server's utilization and stability; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is exempt from deletion until the final clarification of the respective incident.

Registration, Login, and User Account

Users can create a user account. As part of registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account on the basis of the fulfillment of contractual obligations. The data processed includes, in particular, login information (email address and password, or the details from Apple or Google, see "Signing In with Apple or Google").

When using our registration and login functions and the user account, we store the IP address and the time of the respective user action. This storage is based on our legitimate interests as well as those of users in protection against misuse and other unauthorized use. This data is generally not disclosed to third parties unless it is necessary for the assertion of our claims or there is a legal obligation to do so.

A user account is optional and allowed only from the age of 16. Without a user account, Lectio stores your data only on your device (see "Semester Sync").

Users may be informed by email of matters relevant to their user account, such as technical changes.

• Types of data processed: Account data (e.g., name, user ID, username); contact data (email address); content data (your semester data, see "Semester Sync"); usage data (e.g., page views and length of visit, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Log data (e.g., log files relating to logins or the retrieval of data or access times).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures; organizational and administrative procedures. Provision of our online offer and user friendliness.
• Retention and deletion: Deletion in accordance with the information provided in the "General Information on Data Storage and Deletion" section. Deletion upon termination.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities, procedures, and services:

• Registration with pseudonyms: Users may use pseudonyms instead of their real names as usernames; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
• No public profile: A user account has no public profile. Other signed-in users see only your username, if you have chosen one (see "Username and Friends"), never your email address or your name.
• Deletion of data upon termination: When users have terminated their user account, their data relating to the user account is deleted, subject to any legal permission, obligation, or consent of the users. Users can delete their user account at any time directly in the app (Profile ▸ the account's row ▸ "Delete account…"); this deletes the user account and all data stored with it: semesters, credit plan, shared tags, username, friendships, requests and blocks. What remains afterwards (a reserved username, reports you filed) is described in the "Username and Friends" section. If the account was created with Sign in with Apple, Lectio also revokes the connection to Apple. Semester data stored locally on the user's device is not affected. Alternatively, deletion can be requested by email to the address given in the "Controller" section; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
• No retention obligation for data: It is the users' responsibility to back up their data prior to termination taking effect. We are entitled to irretrievably delete all data stored by the user during the term of the contract; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Signing In with Apple or Google

Instead of an email address and password, you can create your user account and sign in with Apple or Google. We never receive your Apple or Google password.

• Sign in with Apple: The provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. You confirm the sign-in in Apple's own dialog. Lectio asks Apple for your name and email address; Apple passes them on, the first time, together with a user ID that applies only to Lectio, to our authentication service (Supabase). If you choose "Hide My Email", we receive a forwarding address from Apple instead of your email address. When you delete your user account, Lectio asks Apple for one more confirmation and uses it to revoke the connection between your Apple Account and Lectio. Privacy policy: https://www.apple.com/legal/privacy/; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
• Signing in with Google: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You sign in on Google's own sign-in page, which the system opens in a browser window. Google then passes your name, your email address, a Google user ID and the link to your profile picture to our authentication service (Supabase). Lectio uses the name only to suggest a first username, and does not use the profile picture at all; other users see neither. Google may also process data in the USA; Google LLC is certified under the Data Privacy Framework. Privacy policy: https://policies.google.com/privacy; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

• Types of data processed: Account data (name, user ID at Apple or Google, for Google the link to the profile picture); contact data (email address or Apple's forwarding address).
• Data subjects: Users (e.g., users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures.
• Retention and deletion: This data is stored with your user account and deleted with it.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Semester Sync

Without a user account, Lectio stores all of your semester data only on your device. If you are signed in, we also store it on our servers (Supabase, see "Third-Party Providers Used") so that it is the same on all of your devices. The following is synced:

• Your semesters with all their contents: courses, readings, tasks and other items with their tags, due dates and reminder settings; the class schedule with classes, rooms and notes, and your attendance; your study time with the individual study sessions; vacations; your courses' credits, grades and partial grades; links to Moodle courses (see "Moodle Integration") and to TUCaN modules (see "TUCaN Import").
• Your credit plan (table credit_plans): your degree's total credits, categories, statuses, grading scale and how the grade point average is calculated.
• Your shared tags (table tag_libraries): the reading, task and attendance tags that all of your semesters can use.

This data can only be retrieved with your user account. Your friends see only the parts of your class schedule that you share (see "Username and Friends"). A change that has not yet reached our servers, for example because you are offline, waits on your device until it is uploaded.

What does not leave your device: Without a user account, your semesters, your credit plan and your tags are not transferred to us. Lectio then connects only when you start it yourself: to send feedback (see "Third-Party Providers Used") or to retrieve data directly from your university (Moodle, TUCaN). It also asks the App Store for updates (see "Update Check"). Even with a user account, the following stays on your device: your Moodle token, the app's settings on this device, which friends you show on your schedule, and the data that widgets and reminders are made from.

• Types of data processed: Content data (your semesters, your credit plan and your shared tags with the contents listed above); account data (your user ID, the time of the last change).
• Data subjects: Users (e.g., users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations.
• Retention and deletion: A semester is stored until you delete it; whatever you delete within a semester is also deleted from our servers with the next sync. The credit plan and the shared tags are stored until you delete your user account. Deleting the user account deletes all of this data from our servers. A waiting change is deleted from your device once it has been uploaded or you delete your user account.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Contact and Inquiry Management

When contacting us (e.g., by email, telephone, or through the feedback in the app), as well as in the context of existing user and business relationships, the information provided by the inquiring parties is processed to the extent necessary to respond to the inquiries and any requested measures.

• Types of data processed: Contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image messages and posts, as well as related information such as authorship or time of creation). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication; organizational and administrative procedures; feedback (e.g., through the feedback in the app). Provision of our online offer and user friendliness.
• Retention and deletion: Deletion in accordance with the information provided in the "General Information on Data Storage and Deletion" section.
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Further information on processing activities, procedures, and services:

• Contact by email: When you contact us by email or other means, we process the personal data transmitted to us in order to respond to and process the respective inquiry. This generally includes information such as name, contact information, and, where applicable, further information provided to us that is necessary for appropriate processing. We use this data exclusively for the stated purpose of contact and communication; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Moodle Integration

Connecting the app to your university's Moodle site is optional. You pick your university from a list built into the app, or enter the address of the Moodle site. Searching the list transfers nothing; the app checks an address you enter with a request to that site that contains nothing about you.

Usually you connect by signing in on your Moodle's own sign-in page, which the system opens in a browser window. Your password goes directly to your university; Lectio never sees it. Moodle then issues the app a personal access token, as it does for the official Moodle app. If your university does not allow this sign-in, you can paste a token instead that you create in your Moodle profile.

The token is stored only in the protected keychain of this device; it is never synced through iCloud Keychain or transferred to us or to another device. The connection itself, that is the site address and your name in Moodle, is also stored only on this device.

The app retrieves your name, your courses and their contents directly from your Moodle site: when you import or sync courses, and for linked courses also by itself when the app opens, to find new material. These requests do not go through us. What you import becomes part of your semester, and so that syncing with Moodle works on all of your devices, so do the site address, the ids and names of the linked Moodle courses, and the ids and links of the material imported and skipped. If you are signed in, this is synced with the semester (see "Semester Sync").

"Open in Moodle" opens a Moodle page in the Moodle app if it is installed, otherwise in the browser; the Moodle app receives the page's address.

You can disconnect Moodle at any time in the app under Profile, which deletes the token from this device. The Moodle site is operated by your university, whose own privacy policy applies to it.

• Types of data processed: Account data (your name and user ID in Moodle, the site address, the access token); content data (names, ids and contents of your courses, links to Moodle material).
• Data subjects: Users (e.g., users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations.
• Retention and deletion: The token and the connection are stored only on this device until you disconnect Moodle or delete the app. Imported material and links to Moodle courses are deleted with the semester they belong to.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

TUCaN Import

Importing grades and credits from TUCaN, TU Darmstadt's campus management system, is optional. Lectio offers it mainly when you are connected to TU Darmstadt's Moodle, and imports only when you start the import yourself.

To import, you sign in on TU Darmstadt's own sign-in pages, which Lectio shows in a browser view of its own. Your password and your second factor go directly to TU Darmstadt; Lectio does not read or store them. The browser view keeps no data: cookies and other website data are discarded as soon as it closes.

After you sign in, Lectio receives only TUCaN's session cookie. With it, the app retrieves your transcript of records and your module results, and then signs you out of TUCaN. The cookie and the retrieved pages are held only in memory, are not transferred to us, and are discarded as soon as you close the import. The pages also contain details such as your name; Lectio takes only the data listed below and shows you what it would take before anything is saved.

What you take over becomes part of your semesters and your credit plan: module names and numbers, grades, credits, whether a module was passed, and the areas of your degree programme. If you are signed in, it is synced like all semester content (see "Semester Sync"). TU Darmstadt's privacy policy applies to the sign-in and to TUCaN's pages.

• Types of data processed: Account data (TUCaN's session cookie, only during the import); content data (the names and numbers of your modules, the semester in which they were completed, grades, credits, whether they were passed, the areas of your degree programme).
• Data subjects: Users (e.g., users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations.
• Retention and deletion: The session cookie and the retrieved pages are discarded as soon as you close the import. Imported data is deleted with the semester it belongs to, and in the credit plan when you remove it there or delete your user account.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Username and Friends

If you have a user account, you can choose a username; this is optional. Without a username, nobody can find you, and you cannot add friends. With one, other signed-in users can find you by it: as soon as someone types at least three characters, the app shows up to five usernames that begin with them. Only the username is shown, never your email address or your name. A username that you give up, by changing it or by deleting your user account, stays reserved for seven days and can then be chosen by someone else. The app refuses offensive usernames; we may also remove a username later if it breaks our terms of use.

You can send other users a friend request, which they can accept or decline. You can withdraw a request and remove a friend at any time. Requests and friendships are stored on our servers together with the user IDs of both accounts and are visible only to the two accounts concerned.

By accepting a friend request, you and your friend agree to see each other's class schedule. Under "What Friends See" (in the app's Friends sheet) you choose what is shared: lectures, exercise groups, exams and other classes; the names of your semesters, courses and classes; rooms; and the notes you write on individual classes. The start date and number of weeks of your semesters are used to place the classes in the calendar. Your attendance, readings, tasks, grades, credits and study time are never shared. Your friend's app retrieves the shared schedule from our servers when it is displayed and does not store it permanently. Sharing ends as soon as either of you removes the friendship. Which friends you have chosen to show on your schedule is stored only on your device.

You can block another user. A block ends any friendship and deletes all requests between you; neither of you then finds the other in the search, and the blocked user cannot send you requests. The blocked user is not told. You can also report a user, for example for an offensive username or unwanted requests. A report contains your user ID, the reported user's ID and username, the reason you chose and any details you add. Only we can read reports, and we review them within 24 hours; the reported user is not told who reported them. We use reports to protect users of the app and to take action against misuse, for example by removing a username or deleting an account.

• Types of data processed: Account data (username, if chosen, user ID, the time the username was last changed); content data (friend requests and friendships, your sharing settings, the shared parts of your class schedule, blocked users, reports and the details they contain).
• Data subjects: Users (e.g., users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures (protection against misuse and harassment).
• Retention and deletion: The username is stored until you change it, we remove it, or you delete your user account; a username you give up then stays reserved for seven days, without any link to your account. Friend requests are deleted once they are accepted, declined or withdrawn, friendships once either of you removes them, and both when either account is deleted. A block is stored until you lift it or either account is deleted. A report is deleted once we have handled it, at the latest after 12 months, and when the reported account is deleted; if you delete your own account, your reports are kept without your user ID.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR) in protecting users from misuse, for reports.

Update Check

If Lectio was installed from the App Store, the app asks Apple's public App Store lookup service at most once a day whether a newer version is available, and tells you if there is one. Apple receives the app's identifier (com.masprime77.lectio) and the region set in your device settings, and, as with any connection, your IP address; nothing about your user account or your semesters is transferred. Apple's privacy policy: https://www.apple.com/legal/privacy/.

• Types of data processed: Meta, communication, and procedural data (the app's identifier, region, IP address).
• Data subjects: Users (e.g., users of online services).
• Purposes of processing and legitimate interests: Provision of our online offer and user friendliness; security measures (up-to-date versions).
• Retention and deletion: We store nothing; the app only remembers on your device when it last asked.
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Third-Party Providers Used (Supabase, Vercel, GitHub)

For the operation and provision of our application, we use the following third-party providers as processors:

• Supabase: Supabase provides us with database hosting as well as an authentication solution (registration and login via email and password, via Sign in with Apple, or via a Google account). According to the data processing agreement, our contracting party is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, a company of the Supabase group, which includes Supabase, Inc. in the USA. The data is stored on servers in the EU (Frankfurt region). Supabase and its sub-processors may access it from outside the EU, in particular from the USA and Singapore, for example for operations and support. Supabase is not certified under the Data Privacy Framework; such transfers are based on the EU Commission's Standard Contractual Clauses (Module 2), which are part of the data processing agreement (see the "International Data Transfers" section). Further information on data protection at Supabase can be found at: https://supabase.com/privacy; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
• Vercel: With Vercel Inc., based in the USA, we operate a serverless function that receives in-app feedback and forwards it to GitHub Issues for internal follow-up. Vercel receives the content of the report (type, title, text, app version and platform) and your IP address; the app sends no account data, email address or device identifier. The function uses the IP address to limit too many reports in a short time and holds it only in memory for that purpose. Vercel is certified under the Data Privacy Framework (see the "International Data Transfers" section). Further information on data protection at Vercel can be found at: https://vercel.com/legal/privacy-policy; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
• GitHub: GitHub, Inc., based in the USA, stores in-app feedback as an issue in a private repository that only we can access. It receives the type, title and text of the report, together with the app version and platform; the app sends no account data, email address or device identifier with it. GitHub is certified under the Data Privacy Framework (see the "International Data Transfers" section). Further information on data protection at GitHub can be found at: https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Changes and Updates

We ask that you regularly inform yourself of the content of our privacy policy. We will adjust the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require your participation (e.g., consent) or other individual notification.

Where we provide addresses and contact information for companies and organizations in this privacy policy, please note that such addresses may change over time, and we ask that you verify the information before making contact.

Glossary of Terms

This section provides an overview of the terms used in this privacy policy. Where terms are defined by law, their statutory definitions apply. The following explanations are intended primarily to aid understanding.

• Account data: Account data includes essential information necessary for identifying and managing contractual partners, user accounts, profiles, and similar associations. This data may include personal and demographic information such as names, contact information (addresses, phone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Account data forms the basis for any formal interaction between individuals and services, institutions, or systems by enabling unique identification and communication.
• Content data: Content data includes information generated in the course of creating, editing, and publishing content of all kinds. This category of data may include text, images, videos, audio files, and other multimedia content published across various platforms and media. Content data is not limited to the actual content itself, but also includes metadata that provides information about the content, such as tags, descriptions, author information, and publication dates.
• Contact data: Contact data is essential information that enables communication with individuals or organizations. It includes, among other things, telephone numbers, postal addresses, and email addresses, as well as means of communication such as social media handles and instant messaging identifiers.
• Meta, communication, and procedural data: Meta, communication, and procedural data are categories that contain information about how data is processed, transmitted, and managed. Metadata, also known as data about data, includes information that describes the context, origin, and structure of other data. It may include information on file size, creation date, document author, and revision history. Communication data captures the exchange of information between users via various channels, such as email traffic, call logs, social network messages, and chat histories, including the persons involved, timestamps, and transmission paths. Procedural data describes the processes and workflows within systems or organizations, including workflow documentation, transaction and activity logs, and audit logs used to track and verify processes.
• Usage data: Usage data refers to information that records how users interact with digital products, services, or platforms. This data includes a wide range of information showing how users use applications, which features they prefer, how long they spend on certain pages, and which paths they take through an application. Usage data may also include frequency of use, activity timestamps, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. In addition, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings.
• Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Log data: Log data is information about events or activities logged within a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details about the use or operation of a system. Log data is often used to analyze system issues, monitor security, or generate performance reports.
• Controller: The "controller" refers to the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: "Processing" is any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, whether collecting, evaluating, storing, transmitting, or deleting it.

Created with the free privacy policy generator from Dr. Thomas Schwenke, Datenschutz-Generator.de