EN·DE·FR

Privacy Policy

NotiClass App

Last updated: November 2026

This privacy policy explains how NotiClass ("the app", "we", "us") collects, uses, and protects your personal data. This app is operated by an individual developer based in Luxembourg and is subject to the General Data Protection Regulation (GDPR) and Luxembourg's Law of 1 August 2018 on data protection.

We are not affiliated with or endorsed by Untis GmbH.

1. Who is responsible for your data?

The data controller is the individual developer of this app, reachable at:
Email: [email protected]
Country: Luxembourg

2. What data we collect and why

To provide timetable change notifications, we collect and store the following data on our server:

WebUntis username: to authenticate with your school's WebUntis server on your behalf
WebUntis password or access key: required to poll your timetable and homework periodically; see below for how this is protected
School server and school name: to connect to the correct WebUntis instance
Apple Push Notification token: to deliver notifications to your specific device
Timetable data: your lesson schedule is fetched and temporarily stored to detect changes
Homework data: subjects, due dates, and assignment text are fetched and temporarily stored to notify you when new homework is added

Your WebUntis password or access key is encrypted and stored in a separate, isolated internal system. It is not the same server that handles requests from the app over the internet. That public-facing server has no ability to decrypt your credentials at all: it can only ask the isolated credential system to log in to WebUntis on your behalf, and receives back your timetable or homework in return, never the credential itself. This means a security issue in the public-facing part of our system cannot expose your password or key, because that part genuinely does not have the capability to. Credentials are transmitted exclusively over HTTPS, every access to a stored credential is logged, and we never log or display your password or key in plaintext. We do not use, sell, or analyze your credentials beyond logging into WebUntis on your behalf. See security.noticlass.website for the actual code behind this, not just this description of it.

The legal basis for processing this data is Article 6(1)(b) GDPR: processing is necessary to perform the service you have explicitly requested.

3. How we use your data

Your data is used exclusively to:

Log into your school's WebUntis account periodically (as often as every 5 minutes during school hours) to check for timetable and homework changes
Send you a push notification when a change is detected (cancellation, room change, test, etc.) or when new homework is added
Display your timetable changes and homework within the app

We do not sell, share, rent, or disclose your data to any third party for any purpose. We do not use your data for advertising, analytics, or profiling.

4. Where your data is stored

Your data is stored on a private server operated by the developer, located in Luxembourg (European Union). Data does not leave the EU. Push notifications are delivered via Apple's Push Notification service (APNs), which is operated by Apple Inc. in accordance with Apple's own privacy policy.

5. How long we keep your data

Your data is stored for as long as you have an active account in the app. When you log out or delete your account, all your data is permanently deleted within minutes, including your credentials (from both the main server and the isolated credential system described above), timetable data, homework data, and push token.

6. Your rights under GDPR

As a data subject under GDPR, you have the following rights:

Right of access: you can request a copy of the data we hold about you
Right to rectification: you can correct inaccurate data by logging out and back in
Right to erasure: use the "Delete Account & Data" button in the app to permanently delete all your data immediately
Right to restriction: you can log out at any time to stop all processing
Right to data portability: contact us to receive your data in a machine-readable format
Right to object: you can object to processing at any time by contacting us

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Data breaches

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Luxembourg National Commission for Data Protection (CNPD) within 72 hours and inform affected users without undue delay, as required by Article 33 and 34 GDPR.

8. Third-party services

Apple Push Notification service (APNs): used to deliver notifications. Apple receives your device token and notification content. See Apple's Privacy Policy.
WebUntis / Untis GmbH: your credentials are used to authenticate with your school's WebUntis server. See Untis Privacy Policy.
Cloudflare: used to secure and route traffic to our server. See Cloudflare's Privacy Policy.

9. Children's privacy

This app is intended for students. We do not knowingly collect data from children under the age of 13 without verifiable parental consent. If you believe a child under 13 has registered without consent, contact us and we will delete their data immediately.

10. Changes to this policy

We may update this privacy policy from time to time. The date at the top of this page indicates when it was last updated. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Supervisory authority

You have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD):
CNPD: cnpd.public.lu
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
Tel: +352 26 10 60 1

12. Contact

For any privacy-related questions or requests:
Email: [email protected]