Privacy notice

The controller within the meaning of the General Data Protection Regulation (EU) 2016/679 (GDPR) is:

No data protection officer has been appointed, as the legal requirements for one are not met. For any privacy question you can reach the controller at the address above.

• POKYH is free, ad-free and does not sell data.
• Your WebUntis password only goes to your school’s WebUntis server and is not stored on POKYH servers.
• Data from WebUntis (timetable, grades, absences, messages) is fetched only to show it and is not kept permanently on POKYH servers.
• Optional statistics are only used with your consent, which you can withdraw at any time. Photos from other sites can be hidden at any time.
• You can ask for access, deletion and more at any time; an e-mail is enough.

School credentials (WebUntis sign-in)

Your username and password are only used to sign you in at the WebUntis server of the school you chose; Untis GmbH runs these servers on behalf of each school. On POKYH servers the password is neither stored nor logged. So that a session WebUntis ended can be renewed automatically, the credentials and the chosen school are kept on your device, AES-GCM encrypted in an httpOnly cookie (pokyh_renew); it is only sent to the sign-in address, only valid together with your session, expires after 4 hours and is deleted when you sign out. The WebUntis session is AES-GCM encrypted in an httpOnly cookie as well. Your sign-in consists of these cookies only: delete them and you are signed out. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Session cookie (pokyh_session)

Encrypted httpOnly cookie holding the school-portal session token. Expires on logout or after 4 hours. Not accessible to JavaScript (XSS protection).

POKYH account (alternative sign-in)

Users without a school account can register with a POKYH-only account (username + password). The password is stored bcrypt-hashed. A plaintext password is never stored.

User cookie (pokyh_user)

Contains non-sensitive display information (username, class, school) for rendering in the app. No password, no token.

School search and chosen school

To help you find your school, the POKYH server sends your search term (name, town or postcode of a school) to the public WebUntis school search (Untis GmbH). Untis only receives the search term and the address of the POKYH server, not your IP address. Results are kept in the server’s memory for up to 10 minutes and are not linked to anyone. Your browser stores the chosen school (login name, name, address and server as listed by WebUntis) until the end of the school year (31 August, at least 30 days) as pokyh_school, so you do not have to search for it every time; you can change it whenever you sign in. After you sign in, the POKYH backend assigns your account to this school (the school’s login name, name and server), so that classes, reminders, comments and the menu stay separate per school; when someone from a school signs in for the first time, the school is created. Legal basis: Art. 6(1)(b) GDPR.

POKYH backend (to-dos & reminders)

To-dos and class reminders are stored on POKYH’s own backend: title, details, timestamp, username. You can delete them yourself at any time. No external cloud services are used for these features.

Canteen ratings & comments

When you rate or comment on a dish, the POKYH backend stores the star rating or comment text, your username, internal user ID, and a timestamp. Comments are visible with your username to other signed-in users; ratings appear as an average and count and, if you also commented on the dish, as your stars beside your comment. You can delete your own comments at any time.

Notifications (bell)

So that the bell looks the same on all your devices, the POKYH backend stores with your internal user ID which of its notifications you have seen or cleared, and when. Only identifiers are stored (e.g. “grade:4711” for a grade or “msg:12” for a message), no grades, subjects, texts or senders. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR). The entries are deleted automatically after 30 days, and earlier with your account.

Reports of content (Digital Services Act)

If you report a comment or other content (with “Report” or by e-mail), we process your report: your name and e-mail address if you give them, the reported content and your reasons. We need them to review the report, to answer you and to give reasons for our decision. We do not tell the person whose content was reported your name. Legal basis: legal obligation (Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065). Retention: until the case is closed, then at most 6 months for questions and complaints.

Push notifications (website, optional)

Only if you allow notifications in your browser: the POKYH backend stores your browser’s push address (endpoint) with your user ID. So that it can tell you about new WebUntis messages, it also stores your current WebUntis session (session identifier and access token, not your password) and uses it to ask your school’s WebUntis server about every 5 minutes how many messages are unread. Message contents are not stored. This stops as soon as WebUntis ends the session. Notifications are delivered through your browser vendor’s push service (e.g. Google, Mozilla or Apple). You can withdraw at any time in your browser settings; the push address is then deleted.

Photos from other sites (cafeteria)

The dish photos in the cafeteria menu are hosted on third-party recipe sites and shown from there; POKYH does not copy them. Your browser loads them directly from those sites, which, as with any page request, receive your IP address and technical details of your browser (e.g. the browser type), without a referrer, so without the address of the POKYH page. What those sites do with it, for example whether they set cookies, is up to them; many browsers block third-party cookies. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in showing the menu clearly. You can object at any time (Art. 21 GDPR): with “Hide photos” on the cafeteria page your browser no longer loads photos from other sites; it stores the choice as pokyh_external_media.

Google Analytics 4 (GA4)

This website may use Google Analytics 4 (Google LLC), but only after your explicit consent in the cookie banner; before that, no connection to Google is made. GA4 collects pseudonymised usage data (page views, device category, approximate country of origin) and sets the cookies _ga and _ga_* for this. According to Google, GA4 does not store IP addresses; Google signals and advertising features are switched off. Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 122 Italian Privacy Code). You can withdraw it at any time in the cookie settings; the cookies are then deleted. You can additionally opt out of data collection at tools.google.com/dlpage/gaoptout.

Cloudflare Tunnel (Cloudflare, Inc.)

Cloudflare Tunnel is used for the public reachability of the self-hosted server. Cloudflare processes network metadata (IP addresses, request headers) to forward traffic. No content is stored permanently. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) for secure server operation. Cloudflare also passes on to us the country derived from the IP address (where applicable region and city), which we use for the visitor statistics of the website and the apps; no location lookup with other providers takes place.

Server logging (request logs)

The POKYH backend server automatically records access logs: IP address, HTTP method, requested path, HTTP status code, response time, username and user agent. Purpose: security, error diagnosis and abuse detection. We also count from them, without names, how many accounts were active each day and in the last 7 or 30 days and whether they used the iOS app, the Android app or the website. For your account, a day-by-day overview records whether you used POKYH, on which kind of device (iOS app, Android app, website on a phone or computer) and how often you signed in, without IP address and without the pages you opened; you can see this overview yourself in your profile. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Logs are deleted after 30 days at the latest, your account's day-by-day overview at the end of the school year (see Retention).

Administration log

If administrators change something that concerns your account or your content (for example removing a comment or granting rights), the POKYH backend records who changed what and when, and which account or content was affected, without passwords or other secrets. Purpose: accountability and protection against misuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and accountability (Art. 5(2) GDPR). The entries are deleted after 365 days.

Usage statistics (apps & website)

While you are signed in and POKYH is open in the foreground, the iOS app, the Android app and the website tell the POKYH backend about every 30 to 60 seconds how long POKYH was used and how many screens were opened. Stored per visit: a random visit ID, the platform (iOS app, Android app or website, for the website also phone or computer and whether it is installed as a web app), the app version, day and time, the duration of use and the number of screens opened. Not stored with it: IP address, user agent, content or input; nothing is stored in the browser or on the device for this. Without consent (anonymous): instead of your account the visit holds only a day key, a hash of your account ID and a random value that is deleted at the end of the day. This lets us count how many different people used POKYH on a day without knowing who, and days cannot be linked together. Page views of the website also count as website visits, and opening an app as an app visit, for this the IP address is stored separately from the usage statistics (see “Website and app visitors”). Per class and day, only the total time and the number of people who used POKYH are also added up (no names; a class is shown only from 5 person-days up). Analysis is in totals only (e.g. users per platform, average duration of use, peak times), seen only by administrators. Legal basis: legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR); you can object at any time (Art. 21 GDPR): a short message to the contact address above is enough. Browsers with “Global Privacy Control” enabled send no usage statistics. With consent (personal, “Accept all” or profile): the visit is also linked to your account, and administrators can see for your account which platform and app version you use, when you were last active, how long, how often and on how many days you used POKYH, which pages you opened and from which IP addresses and places you used the website and the apps (e.g. for support or to point out outdated app versions). Legal basis: your consent (Art. 6(1)(a) GDPR); under 14 only with your parents’ permission (Art. 8 GDPR, Art. 2-quinquies Italian Privacy Code). You can withdraw it at any time in your profile or the cookie settings; your name is then removed from everything collected so far. This data is not passed on to third parties, not used for advertising and not linked to grades or other school data.

Website and app visitors (reach & security)

For every page view of the website (with or without an account) the POKYH backend stores: the IP address, the country Cloudflare derives from it (and, where provided, region and city), the device type (phone, tablet, computer), the page opened, date and time, and whether you were signed in. In the same way, in the iOS and Android apps (which send usage data only while you are signed in) it stores each opening of the app once per IP address and day: the IP address, the country (and, where provided, region and city), the device (iPhone or Android), the app version, date and time, and the random visit ID of the usage statistics, so that a visit is counted only once. The app sends nothing extra for this; the address used is the one the usage statistics come from anyway. If you are signed in, a pseudonymous account key is added (a hash formed with a server secret, without your name), so it can be counted how many different accounts use an IP address, for example in a school network. Different visitors per day are counted with a day key (made from your account if you are signed in, otherwise from the IP address and browser identifier) that can no longer be resolved once the day is over. Purpose: knowing how many people the website and the apps reach and where they come from, and detecting abuse, bots and attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); you can object at any time (Art. 21 GDPR): a short message to the contact address above is enough. If you have agreed to the personal usage statistics, the visit is also linked to your account, so administrators see your name at the IP address (Art. 6(1)(a) GDPR); without consent no name is stored, and after withdrawal it is removed. IP address, place, account key, visit ID and account are deleted after 30 days; after that only an anonymous count by country, device type, page or app version, day and hour remains. Browsers with “Global Privacy Control” enabled are counted without IP address and account. Only administrators see this data; it is not passed on to third parties and not used for advertising.

Notice & consents

For your account we store which version of this notice was shown to you and when (at sign-in or after a change, on the website or in the app), and whether and when you gave or withdrew consent to the personal usage statistics, as proof (Art. 5(2), Art. 7(1) GDPR). Being shown the notice is not consent. This data is deleted with your account. Your cookie-banner choice is also stored on your device (see Cookies).

Mobile app (iOS & Android)

The native POKYH apps store credentials only encrypted on the device (iOS Keychain, or with a key from the Android Keystore) so the sign-in can be renewed; they are not stored on POKYH servers. iCloud sync is disabled. Apart from the usage statistics and the app visitor statistics described above, the app collects no analytics data; no third-party analytics SDKs are included. After the first sign-in and after a change to this notice the app shows a note about it once; that it was shown is stored as on the website (see “Notice & consents”). For offline use the app keeps the most recently loaded data (e.g. timetable, grades, absences, canteen) in the app’s private storage on the device. Reminders are delivered as local device notifications (no remote push). Update checks use the public GitHub API; for technical reasons GitHub receives the IP address, but no account or school data.

Error reports (apps and administration)

If an error occurs in the iOS or Android app or in the administration area, they send a technical error report to the POKYH backend: the error message and its trace (cleaned of addresses, tokens and query parameters), the affected page, the app version, the rough browser or app family and your school, without IP address, without account and without a full device identifier. Legal basis: legitimate interest in a working, secure service (Art. 6(1)(f) GDPR). The reports are deleted after 30 days.

Local storage (localStorage)

Your browser’s storage is used for settings (appearance, language, chosen school and cafeteria, photos yes/no, the progress in the hidden classroom of the sign-in page) and as a cache of recently loaded school data (timetable, grades, absences, messages) for faster display. This data does not leave your device; each entry is listed in the cookie policy.

Support via Buy Me a Coffee (voluntary)

The “Support POKYH” link (settings, About) loads nothing from Buy Me a Coffee before you open it; it opens in a new tab without a referrer. If you support POKYH there, Buy Me a Coffee is independently responsible for the payment; its terms and privacy notice apply, and Buy Me a Coffee is based in the USA. We only receive from Buy Me a Coffee the details you give there (for example name, e-mail address, message and amount), no payment or card data, and use them only to match the support and, where appropriate, to thank you. Legal basis: Art. 6(1)(b) GDPR; kept as long as legal duties, for example tax duties, require.

Processing takes place to provide the service (Art. 6(1)(b) GDPR). Necessary security measures (e.g. network forwarding, access logs), the visitor statistics of the website and the apps with IP address and the anonymous usage statistics are based on our legitimate interest in secure operation and in improving the service (Art. 6(1)(f) GDPR). The personal usage statistics and Google Analytics happen only with your consent (Art. 6(1)(a) GDPR), which you give in the cookie banner (“Accept all” or “Settings”) or in your profile and can withdraw there at any time; withdrawal does not affect the lawfulness of processing before it. Neither option is preselected, and POKYH is fully usable without them.

The school search and assigning your account to your school serve to provide the service (Art. 6(1)(b) GDPR). Photos from other sites are loaded on the basis of legitimate interest (Art. 6(1)(f) GDPR); you can object at any time by hiding them (Art. 21 GDPR).

• Untis GmbH (your school’s WebUntis)Sign-in and fetching of timetable, grades, absences and messages. Your school is the controller of its WebUntis data; Untis runs the servers on its behalf in the EU.Privacy
• Untis GmbH (public school search)Finding your school when signing in; Untis only receives the search term from the POKYH serverPrivacy
• POKYH backendOwn server for accounts, schools, to-dos, reminders, cafeteria, comments, notifications and statistics
• Google Analytics 4 (Google LLC)Anonymised usage statistics to improve the service, only with consentPrivacy
• Cloudflare, Inc.Network routing via Cloudflare Tunnel for the self-hosted serverPrivacy
• Browser vendors’ push servicesDelivery of web push notifications: only if you allow themPrivacy
• GitHub API (GitHub, Inc.)Update checks for the mobile apps; GitHub technically receives the IP address, no account or school dataPrivacy
• Recipe sites (dish photos)Photos in the cafeteria menu loaded directly from the sites that publish them (can be switched off with “Hide photos”)
• Buy Me a CoffeeVoluntary support: only if you open the link and support there; independently responsible for the payment

According to its own statements, Untis GmbH processes WebUntis data exclusively in the EU. Cloudflare, Inc., GitHub, Inc. (only for the apps’ update checks), Google LLC (only with your consent to statistics) and the browser vendors’ push services (for example Google, Apple or Mozilla; only if you allow notifications) may process data in the USA; transfers rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which these providers are certified, and on standard contractual clauses (Art. 46 GDPR). Recipe sites that the cafeteria photos come from may be based outside the EU, including in countries without an adequacy decision. Your browser loads the photos directly from there unless you switch them off with “Hide photos”; these sites thereby receive your IP address. If you do not want that, hide the photos.

Sign-in cookies are deleted on logout and otherwise expire automatically (session 4 hours, API token 8 hours, refresh token 30 days). To-dos, reminders, canteen ratings, and comments remain on the POKYH backend until you delete them yourself. Server logs are deleted after 30 days, database backups after 7 days. Your account's day-by-day overview (active days, device type, sign-ins) is kept until the end of the current school year; the usage statistics name your account only with consent and for at most as long. At the change of school year (1 August), each account's figures for the year (active days, sign-ins and, with consent, time spent) are moved, together with the accounts, classes, to-dos and reminders of the past school year, into a school-year archive that only administrators can see; the year's entries are then deleted. Page views are deleted after 30 days. After that (and for anonymous visits once the server logs are deleted) no entry can be traced back to a person any more, and it remains only as an anonymous statistic. For website and app visits, IP address, place, account key, visit ID and (with consent) your account are removed after 30 days; an anonymous count by country, device type, page or app version, day and hour remains. Completed to-dos are automatically hidden after 24 hours. Google Analytics data is deleted, where you have consented, after 14 months. Reports of content are kept until the case is closed, then at most 6 months. The administration log is deleted after 365 days, the apps’ error reports after 30 days. Which of the bell’s notifications you have seen or cleared is deleted by the POKYH backend after 30 days. The progress in the hidden classroom stays only in your browser until you delete it there.

The chosen school stays in your browser until 31 August of the current school year, for at least 30 days. The WebUntis session stored for push notifications is only valid until WebUntis ends it and is deleted together with the push address. The assignment of your account to your school is deleted with your account. Cached school search results expire after 10 minutes.

POKYH is for people aged 14 and over. Younger people may only use POKYH with their parents’ consent. In Italy, consent (personal usage statistics, statistics cookies) can only be given by yourself from the age of 14 (Art. 8 GDPR, Art. 2-quinquies of the Italian Data Protection Code); below that only by the parents. If we learn that a child’s data is processed without this consent, we delete it.

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure / right to be forgotten (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent

[email protected]

Complaint to the competent supervisory authority: the Italian Garante per la protezione dei dati personali, www.garanteprivacy.it

You are not obliged to give POKYH any data. Without your WebUntis credentials, however, POKYH cannot show data from WebUntis. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

All connections use HTTPS/TLS (provided via Cloudflare Tunnel). WebUntis session tokens are encrypted server-side with AES-GCM and stored only in httpOnly cookies (no JavaScript access). Passwords are never stored on POKYH servers. Input is validated server-side. The server runs on private hardware and is reachable only through the encrypted Cloudflare Tunnel.

• pokyh_sessionNecessaryEncrypted school-portal session token (httpOnly, AES-GCM, 4 hours)
• pokyh_userNecessaryNon-sensitive display info (no token, no password, 4 hours, 8 hours with a POKYH account without a school account)
• pokyh_api_tokenNecessaryPOKYH backend JWT for API access (not httpOnly, 8 hours)
• pokyh_api_refreshNecessaryPOKYH backend refresh token to automatically renew the API token (httpOnly, 30 days)
• pokyh_renewNecessaryCredentials and chosen school for automatic session renewal, AES-GCM encrypted (httpOnly, only sent to the sign-in address, only valid together with the session, 4 hours, deleted when you sign out)
• pokyh_schoolSettingThe school chosen at sign-in (localStorage, until 31 August, at least 30 days)
• pokyh_external_mediaSettingRemembers that you hid photos from other sites (localStorage, until you show them again)
• pokyh_themeSettingSaved colour scheme (localStorage, not a cookie)
• pokyh_sidebar_collapsedSettingSidebar collapsed/expanded state (localStorage, not a cookie)
• passkey_declinedSettingRemembers that you declined saving the sign-in in the browser (cookie, 1 year)
• pokyh_cache_*NecessaryCache of recently loaded school data for faster display (localStorage, never leaves the device, deleted when you sign out)
• _ga, _ga_*StatisticsGoogle Analytics 4: anonymised usage statistics (only with consent), 1-2 year lifetime

Cookies and storage

This privacy notice is updated when POKYH or the law changes. The current version is always at pokyh.com/legal. POKYH informs you about important changes after you sign in.