Privacy Policy
Last updated: 04.11.2026
1. Who we are and who Schuly is for
Schuly is a free, independent app for students who attend a school in Switzerland. We offer our service at schuly.dev only to these students, and it supports only school systems used in Switzerland. Schuly isn't part of your school, Centerboard AG (Schulnetz), OdA Org, or Microsoft.
Niclas Erismann, Switzerland, is responsible: privacy@schuly.dev. If you enter your own server in the app, its operator is responsible instead. If you're unsure what this means for you, ask a parent.
2. Two ways to use Schuly
- Schuly account: the server fetches your school data in the background and keeps a copy, so the app opens quickly and can notify you.
- Private mode: there is no account. Your login and school data stay on your device. They pass through our server with each request, but aren't stored there.
3. What data we process
The data comes from you and from the school systems you connect.
- Account: username, email, password as a hash, second factor, profile picture, signed-in devices with IP address and browser, time of last use, and your confirmation of the privacy notice.
- School data: name, school, classes, teachers, grades, exams, timetable, semester reports, and documents.
- Absences: period, status, and reason. The reason can include health information, which is sensitive personal data.
- Microsoft 365 (only if you link an account): mail, calendar, files, Microsoft Teams chats, and notes. This content can include data about other people, such as teachers and classmates.
- Notifications: device token and your settings.
- Technical data: server logs and a security log of sign-ins and deletions.
When you register, we check whether your IP address belongs to a Swiss network. The result isn't stored.
4. Logins we store
- Schulnetz: session tokens and cookies, no password.
- OdA Org: username and password, because the portal offers no other way to sign in again.
- Microsoft: refresh token and cookies. We don't store your Microsoft password.
These give access to those accounts. They're stored encrypted on the server and removed when you disconnect the account.
5. Why
We process data to show and update your school data, notify you, provide the features you use, and protect the service. We don't sell data or show ads. The website uses no trackers or analytics.
6. AI features
Helply is an AI, not a person, and can be wrong. When you use it, your messages, attachments, and the data you allow go to an AI model we run ourselves in Switzerland. The AI service doesn't keep them after answering or use them for training. Schuly stores your conversations encrypted. Helply asks you before it changes anything.
AI apps you connect yourself (for example through MCP) receive the data you allow. Their provider's terms apply, and the data can go abroad.
7. Recipients and countries
| Recipient | Purpose | Country | Basis |
|---|---|---|---|
| IONOS SE | Server hosting | Germany | Adequate protection |
| Cloudflare, Inc. | Delivering schuly.dev and docs.schuly.dev | USA | Swiss-U.S. Data Privacy Framework |
| Resend, Inc. | Confirmation and password emails | USA | Standard contractual clauses |
| Google (Firebase) | Delivering notifications; generic text by default, details only if you turn them on | USA | Swiss-U.S. Data Privacy Framework |
| Apple | Delivering notifications on iOS | USA | Per Apple |
| Microsoft | Microsoft 365 if you link it; sign-in at some schools | USA / EU | Per Microsoft |
| Google, Microsoft | Signing in to Schuly, if you choose them | USA | Per provider |
| Centerboard AG, OdA Org | Fetching your school data | Switzerland | On your behalf |
| GitHub, Inc. | Checking for app updates (sends your IP address, can be turned off) and downloads | USA | Per GitHub |
| Giphy | GIFs in chats: your browser loads the images directly from Giphy (sends your IP address) | USA | Per Giphy |
8. How long
- School data: until 6 months after you leave the school.
- Inactive accounts: deleted after 12 months without use, after an email warning if you have a confirmed address.
- Helply: 30 days after your last activity in the conversation.
- AI app activity: 30 days.
- Security log: 1 year. Server logs: limited in size and continually overwritten. Request contents aren't logged.
- Backups: 30 days at most.
- Microsoft content on the web: the web app keeps mail and chats briefly in the server's memory (lists up to about 70 minutes, one mail up to 2 hours, folder names up to 25 hours) and unencrypted in your browser. The browser storage is deleted when you sign out, so always sign out on shared computers.
9. Security
Connections to and from our server are encrypted. Logins, documents, absence reasons, and Helply content are stored encrypted on the server. Grades and other school data aren't encrypted individually. Authenticator secrets stay on your device, unless you save one for school sign-in.
10. Your rights
You can ask for access to your data, and for correction, deletion, or a copy of it. In the app or web app, under Settings → Privacy, you can export your data and delete your account. For anything else, write to privacy@schuly.dev; we answer within 30 days. Your school corrects wrong school data, and Schuly picks up the change on the next sync. If another country's data protection law applies to your use, you also have the rights it grants.
Schuly makes no automated individual decisions. You confirm AI actions in Helply yourself.
11. Complaints and changes
Contact us first. You may also complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (edoeb.admin.ch). The version published here with the date above applies.