Who we pass data to
Last updated: 12 October 2026
This is the complete list of services that process personal data on our behalf. It is an annex to the privacy policy and the data processing agreement.
Running the application
| Who | What for | What is passed | Where | Policy |
|---|---|---|---|---|
| Google Ireland Ltd. (Firebase — Cloud Firestore) | Database | Profiles, class rosters, grades, tests and question texts, consent records | European Union (eur3 multi-region) | link |
| Google Ireland Ltd. (Firebase Authentication) | Sign-in, including optional two-step verification | Teacher's e-mail and name, password hash, two-step verification key if turned on; for a pupil only the ID, with no name; the IP address at sign-in (kept for a few weeks) | USA; Data Privacy Framework certification and standard contractual clauses | link |
| Google Ireland Ltd. (Firebase Hosting and App Check) | Web hosting; checking that a request comes from the genuine app | IP address and request details (hosting keeps them for a few months) | Google's global infrastructure | link |
| Cloudflare, Inc. | The server between the app and the AI; pupil sign-in, rate limits, admin panel, nightly jobs | Request content in transit and the IP address; an operational log with a shortened account identifier | EU / worldwide; Data Privacy Framework certification and standard contractual clauses | link |
Fonts have been bundled into the app and the website since 12 October 2026. Until then they were loaded from Google Fonts (Google LLC, USA), which thereby saw the device's IP address.
About signing in with Google. Anyone who chooses it is using Google's sign-in library. Its own declaration to Apple lists the collection of coarse location for Google's purposes — it never reaches us and is in none of our data, but it is honest to say so, because it is why the App Store listing carries a "Location" label. See the privacy policy, section 2.
That same declaration says the library processes a device identifier and usage data for Google's own analytics as well. That is why the App Store listing shows the purpose "Analytics" against those two items. It is not our analytics — we run none and receive none of it, see the row below.
Artificial intelligence
| Who | What for | What is passed | Where | Policy |
|---|---|---|---|---|
| Anthropic PBC | Generating test questions — nothing else | The teacher's topic and brief, and materials the teacher uploads. Nothing about a pupil: no name, no answer, no result, no photo of the answer sheet | USA, standard contractual clauses | link |
The artificial intelligence works for the teacher only. Until 5 September 2026 it could explain a pupil's mistakes to them; the question text and the pupil's answer were sent for that — without a name, but sent. That feature is gone and nothing about a pupil leaves any more.
Anthropic deletes inputs within 30 days and does not use them to train models. It keeps them longer only for a request its automated checks flag as violating its usage policy (inputs and outputs up to 2 years, the results of the check up to 7 years), or where the law requires it. We send files inside the request, not to its file store.
Payments and subscriptions
| Who | What for | What is passed | Where | Policy |
|---|---|---|---|---|
| Apple / Google | Selling the subscription; they are the seller, not us — independent controllers, in the EU Apple Distribution International Ltd. and Google Commerce Ltd (Ireland) | Payment details — we never see them | Under their own privacy policies | Apple · Google |
| RevenueCat, Inc. | Keeping track of whether a subscription is active | The teacher's account identifier, the purchase history from the App Store or Google Play, and the technical details of the request (system type, IP address) — no name or e-mail. It receives nothing about pupils | USA, standard contractual clauses | link |
Talking to us
| Who | What for | What is passed | Where | Policy |
|---|---|---|---|---|
| Google Ireland Limited (Google Workspace) | The mailbox that receives mail sent to `privacy@gradeai.ch` — access requests, erasure requests, questions from schools, and support | The content of the e-mail you write to us: the sender's address and whatever you put in the message | European Union | link |
It is one mailbox and one person reads it. We copy nothing out of it elsewhere and add no address to any list. Should a child write to us, we answer and then delete the address — see Children's Privacy, section 2a.
It is not a mailing service. Workspace delivers the mail that comes to us; we send no bulk e-mail from it and we still have no mailing service — see below.
What is deliberately absent
| Analytics and traffic measurement | We run none. No analytics tool runs in the application or on the website and we gather no statistics about what anyone does. On Google's own analytics inside its sign-in library, see the note above |
| Bot protection on the website | Google reCAPTCHA — separates a person from a script so nobody can hammer the server or run up the AI bill. It reads browser signals and stores its own cookie. Security, not advertising. Not used in the mobile app |
| Crash reporting | none |
| Ad networks and advertising identifiers | none |
| E-mail service | we do not have one yet — the only automatic e-mails are account-security ones sent by the Firebase sign-in service (password reset, address verification, e-mail change). When one is added, it will appear here and we will announce it 30 days in advance |
| Image storage | none. The photo of the answer sheet never leaves the device |
| Backups with a third party | none. We copy the database ourselves; the copy sits on the operator's encrypted disk in the Czech Republic and is deleted after 7 days — see the privacy policy, section 7 |
| Fonts from a third party | none; they are bundled into the app |
This list is complete. If someone is missing from it, that is a mistake — write to us at the address in the privacy policy.
Operator: Martin Sixta · privacy@gradeai.ch · full details in the terms, section 7b