Privacy Policy
Version 1.0 · November 2026 · covers the website studapp2.de, the two
Stud.IP demo systems demo6.studapp2.de and
demo62.studapp2.de, the tests via TestFlight and Google Play,
and the Stud.App apps for iOS and Android.
This is a translation for convenience. The German version, Datenschutzerklärung, is the binding one.
1. Controller
Bodo Steffen (sole proprietor)
In der Steinbreite 38
30455 Hannover, Germany
Email: admin [at] studapp2.de
2. Overview: what we do not do
Stud.App was built to collect as little data as possible. In concrete terms:
- No user account with us. There is no sign-up, no password and no email address at Stud.App. Your identity is managed solely by your institution, or by the demo system you use, through Stud.IP.
- No external tracking SDKs. No Google Analytics, no Firebase, no Crashlytics, no Facebook SDK, no advertising or analytics library.
- No advertising. The app is free and shows no ads. Notices come only from your own institution.
- No chat content with us. Messages from your institution's chat (Blubber) travel only between your device and your institution's Stud.IP server, or the demo system. They are not transmitted to us or to anyone else (see § 6).
- No servers of ours. The app talks only to your institution's Stud.IP, or to the demo system. We run no service that receives your data for the app, and we pass nothing on to third parties.
3. This website (studapp2.de)
The website is a static information site. When you open it, only the technically unavoidable data is processed on the server (server logs):
| Category | Purpose | Retention |
|---|---|---|
| IP address, truncated (IPv4: first two blocks only, IPv6: first two groups only) | Serving the page, defence against attacks, visit statistics | 7 days max. |
| Date and time of the request | Server operation, error analysis | 7 days max. |
| HTTP status, amount of data transferred | Server operation, error analysis | 7 days max. |
| Page requested (without parameters) and referring page | Server operation, visit statistics | 7 days max. |
| User agent (browser and operating system) | Compatibility analysis | 7 days max. |
Cookies: the website sets no cookies and uses no tracking pixel. There is no cookie banner and no consent management, because there is nothing to consent to.
Visit statistics: from those truncated server logs we count on our own server how often the pages are opened. Only aggregated daily figures are kept (number of visits and page views), with no link to individual people. There is no script in your browser, no cookie and no transfer to third parties.
Hosting: the website runs on a server in the European Union. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing and operating the website).
4. Stud.IP demo systems (demo6.studapp2.de and demo62.studapp2.de)
Both demo systems are our own Stud.IP instances, with a few adjustments to the Stud.IP core that keep the app's functionality working. They hold demo data, no real institutional data and no third-party data.
When you sign in to one of the demo systems, the technical data usual for Stud.IP is processed (sign-in, session, your demo account ID). That data stays inside the respective demo system and is not passed on to third parties.
Demo content: whatever you upload, write or comment there is visible to other testers of the same demo system. Please do not upload sensitive or personal data. The systems are not meant for real content.
Reset interval: the test databases are reset regularly (at least once a quarter). Content is lost in the process. That is intended.
5. Using the app on iOS and Android
You get the app from Apple (currently a public TestFlight link, later the App Store) or from Google Play. We collect no personal data from you for it: you send us no email and give us neither your name, your Apple ID, your Google account nor your institution. Apple and Google handle the distribution and the installation directly with you (see below).
Processing by Apple
Once you follow the TestFlight invitation and install the app, Apple Inc. processes further data as a controller in its own right, including your Apple ID, device model, iOS version, crash and performance diagnostics and, where applicable, your country. That data goes to Apple, and in aggregated form to us as the developer.
Apple's own privacy policy is at apple.com/legal/privacy; Apple's specific TestFlight notice is at apple.com/legal/privacy/data/en/test-flight/. We have no influence on the processing on Apple's side.
Beta feedback at Apple
If you use "Send Feedback" inside the TestFlight app, then depending on your selection a screenshot, your comment and technical device data are sent to Apple and to us. The feature is voluntary. You decide anew for each piece of feedback.
Processing by Google
If you install the app from Google Play, Google Ireland Limited (for users in the EEA; Gordon House, Barrow Street, Dublin 4, Ireland) processes data as a controller in its own right, including your Google account, device model and Android version, installs and updates, crash and performance data, and your country. That data goes to Google, and to us as the developer only in aggregated, non-personal form (Play Console, Android Vitals). Google uses the Play services on your device to deliver the app and to verify the installation.
Google's privacy policy is at policies.google.com/privacy, the Google Play terms of service at play.google.com/about/play-terms. We have no influence on the processing by Google. Google also processes data in the United States, on the basis of the standard contractual clauses and the EU-US Data Privacy Framework.
Feedback and reviews on Google Play
A review you write in the Play Store is public and shows the name of your Google account; we can reply to it. If you use the feedback function of a closed test, we receive your message and technical details about the device. Both are voluntary.
6. Data the app stores locally
Stud.App keeps all application data exclusively on your device, on iPhone as well as on Android. There is no cloud synchronisation of Stud.IP content through any infrastructure of ours.
| Category | Location on iOS | Location on Android | In the device backup? |
|---|---|---|---|
| OAuth2 tokens (access + refresh) | Keychain | Encrypted preferences, key in the Android Keystore | No |
| Course list, events, announcements, file list | Core Data (app data) | Room database (app data) | No |
| Chat messages (Blubber): text, author name, time, channel name | Core Data (app data) | Room database (app data) | No |
| Details about your institution (name, address, logo, colours), supplied by your institution's Stud.IP | Core Data (app data) | Room database (app data) | No |
| Downloaded course files, for as long as you have opened them | App storage | App storage | No |
| App settings (for example appearance, notifications) | App settings on the device | App settings on the device | No |
On iOS, tokens and institution data are excluded from the iCloud backup via
NSURLIsExcludedFromBackupKey. On Android the app's backup is switched off
entirely; the rules for backup and device transfer exclude the database, the files and
the tokens, so a new phone does not carry this data over either.
About the chat in detail: the chat is optional: it appears only once you add the "Chat" tile to the overview yourself. From then on the app loads the messages of the channels you open and keeps them locally so you can read them without a network. When you close a channel, the app keeps only the 50 most recent messages of that channel. Profile pictures and images inside messages are held in memory only and discarded when the app quits; they are loaded exclusively from your own institution's server. Images from other servers are not displayed, only a notice with a link. Your read state (which messages you have seen) also stays on the device. Chat messages are part of the data export under Art. 15 GDPR (§ 10); the export file goes wherever you save or share it.
Deletion: you can delete all locally stored data at any time under Settings → "Delete all local data", or by uninstalling the app.
7. No servers of the publisher
Stud.App is free and open source. The app needs no service from us: it talks only to
your institution's Stud.IP server, or to the demo system you pick. Everything specific
to your institution (name, address, logo, colours, optionally the canteen and links) is
supplied by your institution's Stud.IP through the app-connect plugin
installed there.
There is therefore no account with us, no purchase, no unlocking and no directory or licence service operated by us. We do not learn which institution you use, when you open the app or what you do in it.
8. Usage statistics
The apps collect no usage statistics. No analytics service is integrated, not even one of ours.
It is envisaged for later that an institution may switch on usage statistics on its own instance for its own members. That would happen only after explicit consent in the app, and the data would not leave the institution. As long as the feature is not active, nothing is collected; this policy will be updated beforehand.
9. System permissions of the app
The app asks for system permissions only when you use the feature in question. At present these are notifications, when you switch notifications on, and on iOS the camera, when you scan a document. On Android the app opens your camera app for that and needs no camera permission of its own. Text recognition (iOS only) runs on the device; a scan leaves it only if you upload it yourself into a course folder at your institution. All AI features run on device.
10. Your rights under the GDPR
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR): you may ask which data we process about you.
- Rectification (Art. 16 GDPR): you may have incorrect data corrected.
- Erasure (Art. 17 GDPR): you can delete all locally stored data in the app yourself. We hold no data about you (§ 7). Step by step: deleting your data.
- Restriction (Art. 18 GDPR) and data portability (Art. 20 GDPR).
- Objection (Art. 21 GDPR) to processing based on a legitimate interest.
- Complaint: you may lodge a complaint with a data protection supervisory authority (in Germany the competent authority of the respective state, overview at bfdi.bund.de).
Please send requests to support [at] studapp2.de.
11. Data of minors
Stud.App is aimed at students and teaching staff at higher education institutions. We do not knowingly collect data from minors.
12. Changes to this privacy policy
We reserve the right to update this policy, for example once an institution can switch on usage statistics, or when the legal situation changes. The date of the last update is given in the lead above. For substantial changes, testers are additionally informed in the app.