Privacy Policy

NotiClass App

Last updated: May 2026

This privacy policy explains how NotiClass ("the app", "we", "us") collects, uses, and protects your personal data. This app is operated by an individual developer based in Luxembourg and is subject to the General Data Protection Regulation (GDPR) and Luxembourg's Law of 1 August 2018 on data protection.

We are not affiliated with or endorsed by Untis GmbH.

1. Who is responsible for your data?

The data controller is the individual developer of this app, reachable at:
Email: [email protected]
Country: Luxembourg

2. What data we collect and why

To provide timetable change notifications, we collect and store the following data on our server:

WebUntis username — to authenticate with your school's WebUntis server on your behalf
WebUntis password — stored encrypted using AES-128 encryption; required to poll your timetable every few minutes
School server and school name — to connect to the correct WebUntis instance
Apple Push Notification token — to deliver notifications to your specific device
Timetable data — your lesson schedule is fetched and temporarily stored to detect changes

        Your password is encrypted at rest using AES-128 (Fernet) and transmitted exclusively over HTTPS. It is only used by our automated systems to request your timetable from your school's server. We do not use, sell, or analyze your credentials, and we never log or display your password in plaintext.
    

The legal basis for processing this data is Article 6(1)(b) GDPR — processing is necessary to perform the service you have explicitly requested.

3. How we use your data

Your data is used exclusively to:

Log into your school's WebUntis account every 5 minutes to check for timetable changes
Send you a push notification when a change is detected (cancellation, room change, test, etc.)
Display change history within the app

We do not sell, share, rent, or disclose your data to any third party for any purpose. We do not use your data for advertising, analytics, or profiling.

4. Where your data is stored

Your data is stored on a private server operated by the developer, located in Luxembourg (European Union). Data does not leave the EU. Push notifications are delivered via Apple's Push Notification service (APNs), which is operated by Apple Inc. in accordance with Apple's own privacy policy.

5. How long we keep your data

Your data is stored for as long as you have an active account in the app. When you log out or delete your account, all your data is permanently deleted from our server within minutes, including your credentials, timetable data, and push token.

6. Your rights under GDPR

As a data subject under GDPR, you have the following rights:

Right of access — you can request a copy of the data we hold about you
Right to rectification — you can correct inaccurate data by logging out and back in
Right to erasure — use the "Delete Account & Data" button in the app to permanently delete all your data immediately
Right to restriction — you can log out at any time to stop all processing
Right to data portability — contact us to receive your data in a machine-readable format
Right to object — you can object to processing at any time by contacting us

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Data breaches

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Luxembourg National Commission for Data Protection (CNPD) within 72 hours and inform affected users without undue delay, as required by Article 33 and 34 GDPR.

8. Third-party services

Apple Push Notification service (APNs) — used to deliver notifications. Apple receives your device token and notification content. See Apple's Privacy Policy.
WebUntis / Untis GmbH — your credentials are used to authenticate with your school's WebUntis server. See Untis Privacy Policy.
Cloudflare — used to secure and route traffic to our server. See Cloudflare's Privacy Policy.

9. Children's privacy

This app is intended for students. We do not knowingly collect data from children under the age of 13 without verifiable parental consent. If you believe a child under 13 has registered without consent, contact us and we will delete their data immediately.

10. Changes to this policy

We may update this privacy policy from time to time. The date at the top of this page indicates when it was last updated. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Supervisory authority

You have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD):
CNPD — cnpd.public.lu
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
Tel: +352 26 10 60 1

12. Contact

For any privacy-related questions or requests:
Email: [email protected]