Dominic Drees (Devsforge.de), further details in the imprint
Email: dominic.drees@live.de

The provider is the controller within the meaning of Art. 4(7) GDPR only for data it receives itself, i.e. exclusively for feedback emails that you send voluntarily.

You or your school are responsible for student data and other content you enter in ClassBuddy. For this, ClassBuddy is purely a tool on your device. The provider has no access to this data and does not process it.

• Classes (short name, subjects, school year, color)
• Students (first and last name, gender, birthday, notes, contact details such as phone and email, optionally a photo)
• Timetable, appointments, imported school and public holidays
• Assessments (observations, assessments, grades), absences, checklists, board photos, rooms and seating plans
• Dashboard cards including the documents, images, website addresses, shortcut names, scripts and quick notes you add
• Your profile (name, gender, birthday, main subjects) and the school settings (including the name and address of the school)

The data is stored in the protected app container of the device and is encrypted by iOS or iPadOS as soon as a device passcode is set. ClassBuddy uses the highest protection class (“complete protection”): while the device is locked, the data cannot be read, not even by the app itself. There is no synchronization and no ClassBuddy cloud.

For the “Now & Next” widget, the app stores the lessons of the next 14 days (time, class, subject, room, class color) in an area that only ClassBuddy and its widget can read. So that the widget can be shown while the device is locked, this file is readable after the first unlock. It contains no student data; on the lock screen, iOS hides its content until the device is unlocked.

Note: If you use device backups (iCloud Backup or a backup via Mac or PC), these may also contain ClassBuddy data. Please check your backup settings if your school does not permit this.

• Biometric app lock (Face ID or Touch ID) or the device passcode; unlocking is bound to a keychain item that only the Secure Enclave releases
• Privacy mode hides names, grades and notes on all pages; turning it off requires biometric confirmation or the device passcode
• Content is hidden in the app switcher
• “Complete protection” data protection class (iOS Data Protection): while the device is locked, all data is encrypted and cannot be read, not even by the app itself
• Regular updates, including security and privacy improvements
• Regular automated security scans of the source code (Semgrep)
• Automated tests covering more than 80 % of the app logic (data models, import and export, calculations, app lock)

ClassBuddy only connects to the internet in the following cases. For technical reasons, your IP address is transmitted to the respective server. Student data is never transmitted.

Only when you tap “import” in the school settings. The selected federal state and the time period are transmitted.

Only when the “Weather” card is visible on the dashboard, at most every 30 minutes. The school address from the school settings (street, postal code, town) is converted into coordinates via Apple Maps (iOS/iPadOS 26 and later; on earlier versions only the town via open-meteo.com, see below); Apple Weather then provides the current weather for these coordinates. The location of the device is not used. According to Apple, these requests are not linked to your Apple Account. Apple’s privacy policy applies.

If Apple Weather or Apple Maps cannot be reached, and on iOS/iPadOS before version 26 to convert the town into coordinates. The school’s town (without street) or its coordinates are transmitted.

Only when you edit the postal code and town in the school settings, to suggest the federal state for the holiday import. The school’s postal code and town are transmitted.

For the website icon (favicon), the stored website is fetched directly; the icon is cached locally. Tapping opens the website in Safari.

Only when a script that you write yourself in a programmable card fetches an https address via fetch when tapped (at most one request per tap, without cookies). Only what the script itself sends is transmitted; student data is not available to scripts.

The trial and the full version are in-app purchases in the App Store. Apple handles the purchase and payment. ClassBuddy receives no payment details and no personal data, only the confirmation whether the trial or the full version is unlocked. Apple’s privacy policy applies.

“Send feedback” opens your mail app with a prepared draft. Only if you send it does the provider receive your email address, your message, and the app version, device model and system version. This data is used exclusively to handle your request and is deleted afterwards (legal basis: Art. 6(1)(f) GDPR, legitimate interest in answering inquiries).

The source code, the donation page and links on cards open pages of external providers. The privacy policies of the respective providers apply there.

Recognition is handled entirely by iOS or iPadOS. Biometric data never leaves the Secure Enclave; ClassBuddy only receives “successful” or “cancelled”.

Through the photo picker or the Files app, ClassBuddy only receives the single file you select and has no access to your entire library. The file is copied into the app locally.

Only for the timer card: the first time you start a timer, the app asks whether it may notify you when it ends. The notification is scheduled locally on the device and marked as “time sensitive” so that it also appears during a Focus (e.g. “Teaching”); nothing is transmitted.

Only for scanning the board. The photo is stored locally in the app and is not transmitted.

Only for the “Noise level” card while it is switched on. Only the level is calculated; nothing is recorded, stored or transmitted.

The “Daily boost” card creates its quote with the on-device language model. No data is transmitted and no student data is used.

Location, contacts, the device calendar and Bluetooth are not used.

For data you manage in the app, you can exercise the rights of data subjects (Art. 15 to 21 GDPR) directly in the app:

• Access and portability: Settings › App Settings › Export
• Rectification: edit entries at any time
• Erasure: delete individual entries, delete a class including its students, use “Delete all local data” or delete the app

With regard to feedback emails, you have the right of access, rectification, erasure, restriction of processing, data portability and objection vis-à-vis the provider, as well as the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

• Depending on the federal state and school, processing student data on private devices may require approval or be subject to conditions. Please clarify this in advance with your school management or the data protection officer.
• Only record what you actually need (data minimization, Art. 5(1)(c) GDPR).
• Set a device passcode and keep the app lock turned on.
• Excel exports are not encrypted: store them securely, do not send them by unencrypted email and delete them after use.
• Delete classes you no longer teach (e.g. at the end of the school year).

These notes do not constitute legal advice.