Privacy Policy
Last updated: 11.11.2026
1. Who we are and who Schuly is for
Schuly is a free, independent app for students who attend a school in Switzerland. We offer our service at schuly.dev only to these students, and it supports only school systems used in Switzerland. Schuly isn't part of your school, Centerboard AG (Schulnetz), OdA Org, or Microsoft.
Niclas Erismann, Switzerland, is responsible: privacy@schuly.dev. If you enter your own server in the app, its operator is responsible instead. If you're unsure what this means for you, ask a parent.
2. Two ways to use Schuly
- Schuly account: the server fetches your school data in the background and keeps a copy, so the app opens quickly and can notify you.
- Private mode: there is no account. Your login and school data stay on your device. They pass through our server with each request, but aren't stored there.
3. What data we process
The data comes from you and from the school systems you connect.
- Account: username, email, password as a hash, second factor, profile picture, signed-in devices with IP address and browser, time of last use, and your confirmation of the privacy notice.
- School data: name, school, classes, teachers, grades, exams, timetable, semester reports, and documents.
- Student ID card (Lernendenausweis): name, date of birth, and photo. Schuly fetches the card from Schulnetz when you open it. With a Schuly account, the server keeps only the photo, encrypted, as the picture of your school account. The app keeps an encrypted copy on your device so you can show the card offline.
- Absences: period, status, and reason. The reason can include health information, which is sensitive personal data.
- Microsoft 365 (only if you link an account): mail, calendar, files, Microsoft Teams chats, and notes. This content can include data about other people, such as teachers and classmates.
- Notifications: device token and your settings.
- Technical data: server logs and a security log of sign-ins and deletions.
When you register, we check whether your IP address belongs to a Swiss network. The result isn't stored.
4. Logins we store
- Schulnetz: session tokens and cookies, no password.
- OdA Org: username and password, because the portal offers no other way to sign in again.
- Microsoft: refresh token and cookies. We don't store your Microsoft password.
These give access to those accounts. They're stored encrypted on the server and removed when you disconnect the account.
5. Why
We process data to show and update your school data, notify you, provide the features you use, and protect the service. We don't sell data or show ads. The website uses no trackers or analytics.
6. AI features
Helply is an AI, not a person, and can be wrong. When you use it, your messages, attachments, and the data you allow go to an AI model we run ourselves in Switzerland. The AI service doesn't keep them after answering or use them for training. Schuly stores your conversations encrypted. Helply asks you before it changes anything.
AI apps you connect yourself (for example through MCP) receive the data you allow. Their provider's terms apply, and the data can go abroad.
7. Recipients and countries
| Recipient | Purpose | Country | Basis |
|---|---|---|---|
| IONOS SE | Server hosting | Germany | Adequate protection |
| Cloudflare, Inc. | Delivering schuly.dev and docs.schuly.dev | USA | Swiss-U.S. Data Privacy Framework |
| Resend, Inc. | Confirmation and password emails | USA | Standard contractual clauses |
| Google (Firebase) | Delivering notifications on Android and iOS; generic text by default, details only if you turn them on | USA | Swiss-U.S. Data Privacy Framework |
| Apple | Delivering notifications on iOS (through Firebase) | USA | Per Apple |
| Google (Google Play), Apple (App Store) | Downloading and updating the app, if you get it there | USA | Provider's own responsibility |
| Microsoft | Microsoft 365 if you link it; sign-in at some schools | USA / EU | Per Microsoft |
| Google, Microsoft | Signing in to Schuly, if you choose them | USA | Per provider |
| Centerboard AG, OdA Org | Fetching your school data | Switzerland | On your behalf |
| GitHub, Inc. | Checking for app updates in the app from GitHub (sends your IP address, can be turned off; not in the app from Google Play or the App Store) and downloads | USA | Per GitHub |
| Giphy | GIFs in chats: your browser loads the images directly from Giphy (sends your IP address) | USA | Per Giphy |
App stores: if you download the app from Google Play or the App Store, Google and Apple process data for this under their own responsibility and their own privacy policies. From them, we only get summary statistics and, if you allow it on your device, crash reports without your name.
8. How long
- School data: until 6 months after you leave the school.
- Inactive accounts: deleted after 12 months without use, after an email warning if you have a confirmed address.
- Helply: 30 days after your last activity in the conversation.
- AI app activity: 30 days.
- Security log: 1 year. Server logs: limited in size and continually overwritten. Request contents aren't logged.
- Backups: 30 days at most.
- Microsoft content on the web: the web app keeps mail and chats briefly in the server's memory (lists up to about 70 minutes, one mail up to 2 hours, folder names up to 25 hours) and unencrypted in your browser. The browser storage is deleted when you sign out, so always sign out on shared computers.
9. Security
Connections to and from our server are encrypted. Logins, documents, absence reasons, and Helply content are stored encrypted on the server. Grades and other school data aren't encrypted individually. Authenticator secrets stay on your device, unless you save one for school sign-in.
10. Your rights
You can ask for access to your data, and for correction, deletion, or a copy of it. In the app under Settings → Privacy, and in the web app under Settings → Danger zone, you can export your data and delete your account. For anything else, write to privacy@schuly.dev; we answer within 30 days. Your school corrects wrong school data, and Schuly picks up the change on the next sync. If another country's data protection law applies to your use, you also have the rights it grants.
Schuly makes no automated individual decisions. You confirm AI actions in Helply yourself.
11. Deleting your account
You can delete your account yourself at any time: in the app under Settings → Privacy → Delete account, or in the web app at app.schuly.dev under Settings → Danger zone. If you can no longer get into your account, write to privacy@schuly.dev from your account's email address, and we delete it for you.
Deleting removes your sign-in, your profile, the stored logins of your school accounts, your school data and documents, pictures, device tokens, Helply conversations, and the access of AI apps right away. If a step fails, it is retried daily until it succeeds. Backups keep the data for 30 days at most. The security log keeps an entry that the account was deleted for up to 1 year, without your email or any content. Your school and Microsoft accounts stay as they are. Uninstalling the app doesn't delete your account. Private mode has no account: use Sign out to remove your data from your device.
12. Complaints and changes
Contact us first. You may also complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (edoeb.admin.ch). The version published here with the date above applies.