Skip to content
Home

Privacy Policy

Last updated:

This English version is a translation provided for your convenience. Only the German version is legally binding.

This privacy policy applies to

“Personal data” means any information relating to an identified or identifiable person, for example your email address, your IP address or the session data of your TU login.

Tutiva is an unofficial project and has no connection with Technische Universität Wien. TU Wien is responsible for TU Wien’s own services (TISS, TUWEL, TU login, TUMAPS, library). TU Wien’s privacy policy applies there.

At a glance

  • Your study data stays on your device. Tutiva stores your timetable, courses (LVAs), to-dos, your own events, colours, settings and reminders only locally on your device.
  • Your TU password does not travel from your device to Tutiva. Your username, password and authenticator keys are kept only in your device’s secure storage (iOS Keychain or Android Keystore). They are never transmitted to our servers. MFA codes are never stored.
  • You log in directly with TU Wien. You enter your TU credentials in the app’s login window. The app sends them directly to TU Wien, never to us. The app also retrieves your data directly from TU Wien.
  • Our server only knows your TU session. So that you don’t have to keep logging in again, we store encrypted TU session cookies and the necessary technical administrative data. No name, no email address, no student ID number (Matrikelnummer), no events.
  • No tracking, no advertising, no analytics tools. Neither in the app nor on the website. The website does not set any cookies.
  • You’re in control. Using “Verbindung trennen” (Disconnect) immediately deletes your session from our server. Send questions and requests to [email protected].

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Flarely e.U.
Owner: Severin Hilbert
Herbert Rauch-Gasse 16
2361 Laxenburg
Austria

Commercial register (Firmenbuch) number: FN 670427 y, Landesgericht Wiener Neustadt (Regional Court of Wiener Neustadt)
Email (general): [email protected]
Email (privacy): [email protected]

We have not appointed a data protection officer because there is no legal obligation to do so.

2. The app

Tutiva has no user accounts of its own. You do not register with us and you give us neither your name nor your email address. Most features run entirely on your device. Below, we describe each category of data separately.

2.1 Signing in to TU Wien

When you connect Tutiva to your TU account, you enter your TU username, your password and the multi-factor authentication (MFA) code in the app’s login window. The app itself uses them to sign you in to the TU login and to TISS, just as a browser would. In doing so, TU Wien sets its own session cookies.

  • What happens: Your input is sent encrypted (HTTPS) directly from your device to TU Wien (idp.zid.tuwien.ac.at and tiss.tuwien.ac.at), never to our server. The app then stores the TU session cookies on your device so that it can retrieve your data.
  • Purpose: Connecting to your TU account, a core function of the app.
  • Legal basis: Art. 6(1)(b) GDPR (provision of the app you want to use).

Demo access: For review by Apple and Google, there is demo access with sample data. Usernames beginning with “tutivademo” are not sent to TU Wien. Instead, the app sends the username and a hash (SHA-256) of the username and password to our server, which only checks whether the details are correct. We do not store anything in the process.

2.2 Saved TU credentials and Authenticator

So that Tutiva can sign you in again automatically when your TU session expires, the app stores your TU username and your password after a successful TU login. In the Authenticator section, you can also store keys for one-time codes (TOTP/HOTP), for example for the TU login.

  • Where: exclusively in your device’s secure storage (iOS Keychain with the setting “only on this device, when unlocked”; Android Keystore, excluded from Android backups).
  • What does not happen: This data is never transmitted to our server, to the background service for session extension or to third parties. Tutiva sends your username and password only directly to TU Wien in order to sign you in there. MFA codes are never stored permanently.
  • Sharing QR codes: If you transfer authenticator accounts to another device via QR code, the code contains only the authenticator accounts you have selected, never your TU password.
  • Deletion: “Anmeldedaten vergessen” (Forget credentials) in the settings deletes your username and password. You delete authenticator accounts in the Authenticator. “Verbindung trennen” deliberately leaves both in place so that the next connection is quicker. Note for iOS: The Keychain may retain entries even if you delete the app. Therefore, delete your credentials and authenticator accounts in the app before you uninstall it.
  • Legal basis: Art. 6(1)(b) GDPR. Storage on your device is strictly necessary for the function you have requested (§ 165(3) TKG 2021, Austrian Telecommunications Act).

2.3 Timetable, courses and your own content

The app retrieves your timetable, your courses and other study information directly from TU Wien using your TU session. Tutiva stores this data, your to-dos, your own events, course colours, hidden courses, reminder settings and app settings only locally on your device so that the app also works offline. Your personal TU calendar export link (see 2.5) is kept in your device’s secure storage.

  • We do not receive this data.
  • Backups: Depending on your operating system settings, the app’s local storage may be included in device backups (e.g. iCloud or Google). We have no control over this.
  • Deletion: “Verbindung trennen” deletes the cached TU data on the device. To-dos and some display settings are kept. You remove everything else by deleting the app.
  • Legal basis: Art. 6(1)(b) GDPR.

2.4 Session extension via our server

TU sessions expire after a short period of inactivity. So that you don’t have to keep logging in again, Tutiva keeps your TU session active in the background.

For this purpose, we store the following on our server (backend provider Convex, see section 5):

  • your TU session cookies (only cookies of the tuwien.ac.at domain), encrypted with AES-256-GCM,
  • a hash of a random device identifier. The device identifier itself is kept only in your device’s secure storage. The server uses it to recognise your device without there being a user account,
  • technical administrative data: the status of the session (active or new sign-in required), the times of the last change and the last extension, the next scheduled extension time and short-lived internal lock identifiers.

We store no name, no email address, no student ID number, no password, no MFA codes and no events or courses.

A background service runs approximately every nine minutes as a Cloudflare Worker (see section 5). It briefly decrypts the cookies, uses them to request two TISS web addresses without downloading their contents, and stores renewed cookies in encrypted form again. If TU Wien requires a redirect to the TU login, it follows only known TU Wien web addresses. It knows neither your password nor your authenticator keys and cannot respond to a new MFA prompt. If TU Wien requires a new sign-in, it marks the session accordingly. You then sign in again in the app.

  • Purpose: Providing the “stay signed in” function.
  • Legal basis: Art. 6(1)(b) GDPR.
  • Storage period: until you select “Verbindung trennen” in the app. We then immediately delete the entire entry, including any calendar subscription. If you reconnect, we replace the stored cookies. Important: There is currently no automatic deletion of inactive entries. If you delete the app without disconnecting first, the entry remains. However, the cookies it contains become invalid at TU Wien once they expire. Therefore, disconnect before you delete the app.

2.5 Calendar subscription (iCal link)

In the calendar, you can optionally create a subscription link that lets you subscribe to your TU timetable in another calendar app (e.g. Apple Calendar or Google Calendar).

  • How it works: For this, the app generates a random 256-bit token. On our server, we store only a hash of this token, your personal TU calendar export link (encrypted) and salted hashes for hidden courses and events. These hashes contain no titles, rooms or times. When your calendar app requests the link, our server fetches the calendar fresh from TU Wien at that moment, filters out hidden entries and passes it on. No calendar content is stored in the process.
  • Anyone who knows the link can see your timetable. Only share it with calendar apps or people you trust.
  • Calendar app: The subscribing calendar app and its provider (e.g. Apple or Google) receive and store the calendar content. Their privacy policy applies to this.
  • Access logs: The subscription link runs via tutiva.app. Each time it is requested, Cloudflare (forwarding) and our backend provider Convex technically process the IP address and request data of the calendar service making the request. Cloudflare only passes the calendar content through and does not store it.
  • Storage period: until you deactivate the subscription or disconnect. When you deactivate it, we immediately delete the token hash, the calendar export link and the hashes for hidden entries, and the link stops working.
  • Legal basis: Art. 6(1)(b) GDPR.

2.6 Reminders

Reminders for events and to-dos are local notifications that your device schedules and displays itself. Tutiva does not use a push server for this and does not transmit a push identifier. You can revoke permission for notifications at any time in your system settings.

2.7 Camera, photos and Face ID

  • Camera: only when you scan a QR code in the Authenticator. The image is analysed on your device and is neither stored nor transmitted.
  • Photos: only when you select an image containing a QR code. Tutiva reads only that one image, on the device.
  • Face ID / device unlock: optional, to protect your security codes (“Face ID verlangen” – Require Face ID), and always when exporting authenticator accounts. Your operating system performs the biometric check. Tutiva only receives the information whether the check was successful, never biometric data.
  • Screenshots: In the Authenticator, Tutiva blocks screenshots and screen recordings to the extent that the operating system supports this.

The app only requests these permissions once you use the respective feature. You can withdraw them at any time in your system settings.

2.8 Location and campus map (TUMAPS)

The campus map in Tutiva displays TU Wien’s TUMAPS website (maps.tuwien.ac.at) in an in-app browser. If you have your location shown there and allow location access, your device shares your location with that website. Tutiva itself does not store or transmit your location. What TUMAPS does with the location, which map services the site loads and whether it uses its own analytics tools is decided by TU Wien as its operator. TU Wien’s privacy policy applies to this.

2.9 TUWEL, TISS and the library in the app

You can open TUWEL, TISS and TU Wien’s library search in an in-app browser in Tutiva. In doing so, you communicate directly with TU Wien’s websites. These websites may set their own cookies and embed their own services. Tutiva only reads whether you are signed in there. The app does not store or transmit page content.

2.10 Technical data and error logs

  • Our server: With every request, Convex and its infrastructure service providers process technically necessary connection data such as the IP address. Our own error logs contain only general error types, no cookies, passwords, codes or content. The purpose is secure and stable operation. The legal basis is Art. 6(1)(f) GDPR.
  • No analytics SDK and no crash-reporting SDK: Tutiva contains no advertising, no tracking libraries and no analytics libraries.
  • App Store and Google Play: If you have agreed in your device settings to share analytics data with app developers, Apple or Google (as applicable) provide us with aggregated usage statistics and crash reports. Apple or Google collect this data under their own responsibility. We cannot attribute it to any individual.

2.11 Download via App Store and Google Play

You get Tutiva via the Apple App Store (including TestFlight) and Google Play. When you download and update the app, Apple or Google (as applicable) process data such as your account and device data under their own responsibility. Their privacy policies apply to this:

3. The tutiva.app website

3.1 Hosting and delivery

The website is a static site and is delivered via Cloudflare Pages (Cloudflare, Inc., USA), including a content delivery network (CDN). When you access the website, Cloudflare processes technically necessary data sent by your browser: IP address, date and time, requested address, referrer, browser and operating system (user agent) and the status of the request. Cloudflare also uses this data to fend off attacks.

  • Purpose: Delivery of the website, stability and security.
  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a fast, secure and available website.
  • Storage period: We do not analyse any access logs ourselves. Cloudflare stores logs in accordance with its own retention periods.

3.2 No cookies, no tracking

The website sets no cookies, uses no analytics or tracking services and loads no external fonts. All fonts are hosted on our own server. There is no contact form.

3.3 Links to App Store and Google Play

The website links to Tutiva’s pages on the App Store and Google Play. You are only taken to Apple or Google once you click one of these links. From that point on, their privacy policies apply.

4. Contact by email

If you write to us at an @tutiva.app address (such as [email protected] or [email protected]), we process your email address, your name (if provided) and the content of your message in order to deal with your request.

  • Forwarding: Emails to @tutiva.app are received by Cloudflare Email Routing (Cloudflare, Inc., USA) and forwarded to our mailbox at Google (Gmail). Google stores the messages there.
  • Legal basis: Art. 6(1)(b) GDPR, insofar as your enquiry concerns the use of Tutiva, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We handle requests concerning your data protection rights on the basis of Art. 6(1)(c) GDPR.
  • Storage period: for as long as is necessary to deal with your enquiry. We then delete the message, unless statutory retention obligations or the defence of legal claims require longer storage.

5. Recipients and processors

We do not pass on your data and we do not sell it. We only use the following service providers, who act on our behalf and on our instructions (Art. 28 GDPR):

  • Convex, Inc. (USA): backend and database for the encrypted TU sessions and the calendar subscription (see 2.4 and 2.5). The server is located in the USA (AWS region us-east-1). Privacy: convex.dev/legal/privacy
  • Cloudflare, Inc. (USA): hosting and CDN for the website, forwarding of calendar subscription links (see 2.5), forwarding of emails to @tutiva.app and operation of the background service for session extension (Cloudflare Workers, see 2.4). In the process, the decrypted TU session cookies are held briefly in the memory of the execution environment and are not stored. Privacy: cloudflare.com/privacypolicy
  • Google (Google Ireland Limited or Google LLC, USA): email mailbox (Gmail) in which forwarded emails are received. Privacy: policies.google.com/privacy

Independent controllers (not processors):

  • Technische Universität Wien: for TISS, TUWEL, the TU login, TUMAPS and the library, with which you communicate directly via Tutiva.
  • Apple and Google: for the App Store, TestFlight and Google Play, and for calendar apps with which you use a calendar subscription.

We only provide data to authorities if we are legally obliged to do so.

6. Transfers to third countries

Some of the service providers named above are based in the USA or process data there. This applies in particular to the storage of your encrypted TU session at Convex in the USA.

  • For service providers certified under the EU-US Data Privacy Framework (Cloudflare, Google), we base the transfer on the European Commission’s adequacy decision (Art. 45 GDPR).
  • For Convex, we base the transfer on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) in the provider’s data processing agreement.
  • In addition, we protect the session cookies with encryption whose key is not stored in the database.

You can obtain further information on the safeguards on request to [email protected].

7. Storage period

We store personal data only for as long as is necessary for the respective purpose. An overview:

  • Data on your device (timetable, courses, to-dos, settings, credentials, Authenticator): until you delete it in the app, disconnect or delete the app (for iOS, see 2.2).
  • Encrypted TU session on our server: until you select “Verbindung trennen” (see 2.4).
  • Calendar subscription: until you deactivate the subscription or disconnect (see 2.5).
  • Emails: until your enquiry has been dealt with, unless legal obligations require longer (see 4).
  • Technical logs at Convex and Cloudflare: in accordance with these providers’ retention periods.

Deleted data may still exist for a short time in our service providers’ backup copies until these are overwritten in the regular cycle.

8. Your rights

Under the GDPR, you have the right to:

  • access your data stored by us (Art. 15),
  • rectification of inaccurate data (Art. 16),
  • erasure (Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on legitimate interests (Art. 21),
  • withdraw consent with effect for the future (Art. 7(3)).

To exercise these rights, write to us at [email protected]. We respond within one month.

Good to know: Because Tutiva has no user accounts and we do not store a name or an email address with your TU session, we cannot readily attribute an entry on our server to a person (Art. 11 GDPR). The quickest way to delete your data is therefore to do it yourself: “Verbindung trennen” immediately removes your session and any calendar subscription from our server. Everything else is stored only on your device anyway.

Obligation to provide data: You are under no statutory or contractual obligation to provide us with data. Without a connection to your TU account, however, Tutiva cannot display your timetable and your courses.

No automated decision-making: We do not make automated decisions in individual cases and do not create profiles (Art. 22 GDPR).

Age limit: Tutiva is aimed at TU Wien students and is intended for people aged 16 and over.

9. Complaint to the data protection authority

If you believe that we are not processing your data lawfully, you can lodge a complaint with the Datenschutzbehörde (Austrian Data Protection Authority) at any time. However, we would appreciate it if you gave us the chance to resolve the problem first.

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Wien
Phone: +43 1 52 152-0
Email: [email protected]
Website: dsb.gv.at

10. Changes to this privacy policy

We update this privacy policy when Tutiva, our service providers or the legal situation change. You can always find the current version at tutiva.app/en/privacy. The date of the current version is shown at the top of this page.