Privacy information

1. Controller and contact

For all data-protection questions and requests you can use the contact above.

2. In short

• PolyBits processes the data needed to run your account, your learning progress and the safety of the service.
• There is no advertising, no sale of data and no marketing or behavioural tracking. The application loads no third-party scripts, fonts or analytics services – everything is served from the PolyBits server.
• Learning analytics are used only to improve the educational content; exports use a pseudonymous learner key instead of names or e-mail addresses.
• You can download your data and request deletion of your account at any time on your profile page.

3. Hosting and server logs

When you open PolyBits, the web server processes technical connection data: IP address, date and time, requested address, status code, transferred data volume and browser identification (user agent). This is necessary to deliver the pages and to detect and fend off attacks. The reverse proxy's access log is rotated and deleted after at most 7 days.

Public entrance and invitation password: the start page and the invitation form process the same technical connection data. The invitation password you enter is compared with a stored one-way hash; it is neither stored nor logged. To slow down guessing, attempts are counted per IP address in the server's working memory for 15 minutes – not in the database. After a correct entry your browser receives the cookie polybits_gate (HttpOnly) for the learning application's address. It contains only an expiry time and a technical signature, no personal data, and expires after 24 hours.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service).

4. Registration, approval and your account

To register you provide a username, an e-mail address and a password. Optionally you can add your first and last name and choose the interface language in your profile. The password is never stored – only a salted one-way hash (Argon2id).

Each new account waits for approval by a super-administrator. We store the account status (pending, active, rejected, suspended), the role, and a history of approval decisions with the deciding administrator, the time and an optional note.

Purpose: providing the learning service you signed up for, and deciding who takes part in the limited pilot. Legal basis: Art. 6(1)(b) GDPR. Without username, e-mail address and password no account can be created; there is no other obligation to provide data.

Operator review: Confirm Art. 6(1)(b) as the basis for the account relationship of a free pilot (alternative: consent, Art. 6(1)(a)).

5. Signing in, sessions and browser storage

Signing in sets one cookie that is strictly necessary for the service (plastx_session, HttpOnly). On the server we store a hash of it together with the time of creation and last use, the IP address and the browser identification. A session ends when you log out or after 14 days without use; expired sessions are deleted automatically.

The browser's local storage keeps interface preferences (such as the language and filter settings) on your device only; they are not sent to anyone.

If you install PolyBits on your device (“Install PolyBits”), the browser or operating system keeps the app's name and icon. PolyBits uses no service worker and keeps no offline copy of pages or of your data; the installed app loads everything from the server like the website.

Legal basis: § 25(2) no. 2 TDDDG (storage strictly necessary for a service you requested) and Art. 6(1)(b) GDPR. No consent banner is shown because PolyBits uses no cookies or storage beyond this and the invitation cookie described in section 3.

6. Learning progress, answers and competencies

While you learn, PolyBits records your lesson runs and Training Camp sessions, every answer you give (the response itself, whether it was correct, first or second try, time and language), the experience points, stars, streak days and achievements derived from them, and your competency mastery.

Purpose: showing your progress, unlocking paths and lessons, and selecting practice questions. Legal basis: Art. 6(1)(b) GDPR.

Challenger Board (optional): you appear on the ranking only if you choose to – in the dialog before your registration is sent, or later in your profile. Without that choice you are not shown. Participants are shown to other approved learners with username, XP, streak and number of completed lessons. You can leave the board at any time in your profile; your progress is not affected. Legal basis for the board: Art. 6(1)(a) GDPR (your consent, revocable at any time).

Operator review: Confirm consent (Art. 6(1)(a) GDPR) as the basis for the optional Challenger Board.

7. Question reports

If you report a question, we store the question, the category, your optional comment, the time and your account. Super-administrators see who reported a question so that they can ask follow-up questions; reviewers (admins) see the report content without your identity.

Purpose: correcting educational content. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correct content).

8. Learning analytics

Super-administrators can see aggregated statistics on how questions perform (for example the share of correct first answers) to find unclear or faulty questions. These statistics are computed from the learning records described above – there is no separate tracking.

Exports for deeper analysis replace your identity with a random learner key. This is pseudonymisation, not anonymisation: the operator could link the key back to your account using the database, so the exports remain personal data and are handled with corresponding care.

The analytics serve educational quality improvement only – not advertising, not commercial profiling and not decisions about you. There is no automated decision-making within the meaning of Art. 22 GDPR.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the educational content). You may object at any time (see “Your rights”).

Operator review: Confirm the legitimate-interest basis for content analytics and document the balancing test.

9. Security records

PolyBits keeps an audit log of security-relevant events: sign-ins and failed sign-in attempts (with the identifier that was entered and the IP address), password changes and resets, and administrative decisions (approvals, role changes, content decisions). Failed sign-in records and stored IP addresses are deleted automatically after 90 days. Records of administrative decisions are kept for accountability while the pilot runs.

Legal basis: Art. 6(1)(f) GDPR (security of the service, traceability of administrative decisions).

Operator review: Confirm the retention of administrative decision records (proposal: for the duration of the pilot, then review).

10. Password recovery

If you forget your password, you can file a request. It is stored only if it matches an account, together with the time, the number of requests, your language and the IP address. A super-administrator checks the request and issues a one-time link that is valid for 24 hours; only a hash of the link is stored. Closed requests are deleted after the retention period of the security records.

Legal basis: Art. 6(1)(b) GDPR.

Recipients

Your data is not sold or passed on for advertising. Within PolyBits, learners see only the Challenger Board (with the participants who chose to appear on it), reviewers see question content and anonymous report contents, and super-administrators see account and moderation data as described above.

Service providers process data on the operator's behalf under a data-processing agreement (Art. 28 GDPR): the hosting provider. They may use the data only to provide their service. Data is not intended to be transferred to countries outside the EU/EEA.

Operator review: Conclude the data-processing agreement with the hosting provider (and the mail provider, if used) and confirm that no third-country transfer takes place.

Storage periods

Account and profile

As long as the account exists. On a deletion request the account is anonymised.

Learning records (runs, answers, achievements)

As long as the account exists; after anonymisation they remain without any link to you, for aggregate statistics.

Sessions

Until logout or 14 days without use.

Invitation cookie (on your device)

24 hours.

Failed sign-ins, IP addresses in security records

90 days.

Records of administrative decisions

For the duration of the pilot.

Password-recovery requests

Open requests until handled; closed ones 90 days.

Reverse-proxy access log

7 days.

Rejected registrations

Until anonymised by a super-administrator; a fixed period is still to be decided.

Database backups

Encrypted; they roll over after the configured backup retention (proposal: 30 days), after which deleted data is gone from backups as well.

Operator review: Decide the retention for rejected registrations and the backup retention period; adjust this table accordingly.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21).

In PolyBits you can download all data stored about your account as a file, correct your profile data and request deletion of your account on your profile page. For anything else, use the contact in section 1.

You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence or place of work.