Privacy

Who is responsible

Mohammad Saad Ibna Inan, student at HSRW, runs LectureX. For anything about your data, email hello@lecturex.app.

What is stored, why and for how long

• Account: matriculation number, name, password (only as a bcrypt hash), sign-in version

  To sign you in and keep your timetable yours.

  Kept: Until your account is deleted.

• Your university email (@hsrw.org) and when you confirmed it

  To make sure accounts belong to HSRW members, and so you can reset a forgotten password or sign in with a code.

  Kept: Until you replace it, the admin removes it at your request, or your account is deleted.

• Sign-in, sign-up and reset codes we email you (stored only as a keyed hash, never the code itself)

  To confirm the mailbox is yours.

  Kept: Until used or 15 minutes; expired ones are removed automatically.

• Department, semesters, selected courses and groups, and a snapshot of their times and rooms

  To build your timetable and tell you when the official plan changes.

  Kept: Until you change them or your account is deleted.

• Your notes

  Private notes per class or date; only you can read them. With note reminders on, the evening before a note's date its first words appear in a push notification on your own devices.

  Kept: Dated notes: 3 days after their date. Undated notes: end of the semester period (end of February or August).

• Class-change reports you send (class, date, the change, optional comment)

  So the admin can check and publish a correction for everyone. The admin's devices are notified of new reports with the class and the change only, never your name or comment.

  Kept: 30 days after being resolved or after the class date, or when the term changes.

• Push notifications, if you turn them on for a device: the address your browser's push service gave that device, its encryption keys, and which notifications it wants

  To remind that device shortly before each of your classes (if class reminders are on), and to tell it about class changes, tomorrow's classes, your notes dated tomorrow, deadlines and your confirmed reports while LectureX is closed.

  Kept: Until you turn them off or sign out on that device, change or reset your password, the push service reports the device gone, or your account is deleted.

• When you last opened the app (one date and time, updated at most once a day)

  To count how many students use LectureX; only totals are ever looked at.

  Kept: Replaced on your next day of use; deleted with your account.

• Calendar subscription link (a random secret), if you turn it on

  So your calendar app can fetch your classes and exams (plus NRW public holidays).

  Kept: Until you reset or turn it off, or your account is deleted.

• IP address, matriculation number and email address of sign-in, sign-up and code requests, of requests that turn notifications on or off, and how many report notifications your reports caused, as short-lived counters

  To stop password guessing, mass sign-ups, floods of emails and other misuse.

  Kept: 15 minutes to 24 hours; the expired counters are removed automatically, usually within a day.

Legal basis: providing the service you signed up for (Art. 6(1)(b) GDPR); for the request counters, the day you last opened the app, the anonymous statistics below and backups, the legitimate interest in running LectureX securely and reliably and knowing how many students use it (Art. 6(1)(f) GDPR). LectureX does not sell data, show ads or build profiles.

On your device

• A sign-in cookie that keeps you signed in, plus the security cookies of the sign-in system. They are needed for the app to work; there are no advertising or tracking cookies.
• The automatic check on the sign-up and code forms (ALTCHA) runs a short calculation in your browser. It is served by LectureX itself, sets no cookies and contacts no third party.
• In your browser's local storage: a copy of your profile (so screens open instantly and offline, never your notes or email address), an unsent note draft, published class changes, which updates you hid, until when the email, install and notification cards stay hidden, whether you marked an exam registration as done, and for push notifications which ones this device wants and the account they belong to. Signing out clears the profile copy and turns push off on that device.

Anonymous statistics

LectureX uses Vercel Web Analytics and Speed Insights to see which pages are used and how fast they load. They set no cookies. Page views are counted per visitor with a hash of the request that Vercel discards after 24 hours; recorded are the page, referrer, approximate location, browser, operating system, device type and load times. No account data, notes or names are sent.

Service providers

• Vercel Inc. (USA) hosts the app and provides the statistics above.
• Neon, Inc. (USA) hosts the database.
• Supabase stores nightly backups in the EU (Ireland). Backups are encrypted before they leave the app's systems; Supabase cannot read them. They are deleted after 30 days.
• Name.com, Inc. (USA) forwards email sent to hello@lecturex.app to the operator's Google (Gmail) inbox.
• The push service of your browser (Apple, Google, Mozilla or Microsoft) delivers push notifications to devices where you turned them on. It receives the device's address and an end-to-end encrypted message it cannot read, and sees when and how large it is.
• cron-job.org (Germany) calls LectureX every few minutes so class reminders go out on time. It receives no personal data, only counts of reminders sent.
• Brevo (Sendinblue SAS, France) sends the replies from hello@lecturex.app and the codes LectureX emails to your university address (it receives the address and the message). Brevo counts anonymously whether these emails are opened and their links clicked (not linked to your address), and routes the links through its own redirect.

They process data only to provide their service to LectureX. Where data reaches the USA, it relies on the providers' safeguards for international transfers described in their privacy policies.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and receive it in a machine-readable form (Art. 15–21 GDPR). Name, department, semesters, courses, notes, the calendar link and push notifications you can change or delete yourself in the app. To delete your account and everything linked to it, use Delete account on Profile (it takes effect at once), or email hello@lecturex.app from an address that identifies you and include your matriculation number. Deleted data disappears from backups when they expire, within 30 days.

You can also complain to a data protection authority, for example the one for North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit NRW, ldi.nrw.de).