Privacy Policy

Last updated: 17 August 2026

This notice explains how personal data is processed when you use ente.study. It reflects the requirements of the Swiss Federal Act on Data Protection (FADP). Other laws may apply depending on where you use the platform.

Responsible person

The person responsible for the processing described in this notice is:

Maximilian Barth

Advanced Software Technologies Lab

Universitätstrasse 6

8092 Zurich

Switzerland

Data we process

Depending on how you use the platform, the following personal data is processed:

  • Account and login data, including name, email address, username or institutional identifier, profile image, login provider, preferred language, consent status, and authentication or session data.
  • Learning and service data, including code files, prompts, chat messages and AI responses, selected exercises, quiz answers, feedback, ratings, progress, usage, and completion data.
  • If you consent to participate in the research study: optional age and gender information, study-group assignment, interaction and timing data, survey responses, and other study measurements.
  • Technical and usage data, including IP address, user agent, session identifiers, timestamps, page and product events, rate-limit information, and error diagnostics. No session replay or screen recording is used.

Sources

Most data comes directly from you when you log in, write code, use the AI tutor, complete exercises or surveys, or send feedback. Technical data is generated automatically when the platform is used.

When you choose an external login, ETH GitLab, Aalto GitLab, or Google provides the account information needed to authenticate you.

Why we use it

  • To authenticate users, operate the platform, save work and progress, provide AI-assisted learning, and execute code.
  • To keep the platform secure, prevent abuse, enforce usage limits, diagnose errors, and maintain reliable operation.
  • To understand product events and improve the platform, teaching experience, and technical performance.
  • To conduct the educational research study only where the user has given consent. Consent can be withdrawn at any time.

Access and services

Personal data is accessible only where necessary for the purposes above. The following recipients and service providers may process it:

  • Members of the Advanced Software Technologies Lab who are assigned to this project.
  • Railway, for application hosting, database storage, and caching in the Netherlands.
  • ETH GitLab, Aalto GitLab, or Google, when the corresponding login method is selected.
  • OpenRouter and a model provider available through OpenRouter, for processing prompts, chat context, and relevant code needed to generate AI responses.
  • Daytona, for temporary code execution in its European region. Sandboxes are configured for immediate deletion when execution stops.
  • PostHog Cloud EU, hosted in Germany, for event capture and error logging. Session recordings are disabled.

Personal data is not sold and is not disclosed outside the project team except to these service providers or where disclosure is required by law.

Processing abroad

Data may be processed in Switzerland, the Netherlands, Germany or another European location used by the named providers. OpenRouter, its model providers, and Google may also process data in the United States or other countries in which they operate.

Where a destination does not provide an adequate level of data protection, personal data is transferred only where an applicable legal exception or suitable safeguard is available, such as recognized standard contractual clauses.

OpenRouter is configured for Zero Data Retention. OpenRouter does not retain prompts or responses unless prompt logging is explicitly enabled, and requests are routed only to model endpoints with a zero-retention policy.

Retention

Personal data is kept only for as long as needed to operate the relevant course or research study. Account, learning, usage, and study data is deleted after the end of the relevant course or study, unless a longer period is required by law.

If research consent is withdrawn, the associated research data is deleted. A user may also request deletion of the account and data linked to it.

Temporary code-execution environments are deleted when execution stops. OpenRouter requests are subject to Zero Data Retention.

Cookies

The platform uses cookies and similar browser storage where necessary for login, session security, language selection, and basic operation.

PostHog may use first-party browser storage to associate product events and error reports. It is not used for advertising, and session recordings are disabled.

You can block or delete cookies through your browser settings. Blocking essential storage may prevent login or other parts of the platform from working correctly.

Automated decisions

The AI tutor generates automated educational responses, and consenting research participants may be assigned automatically to a study group. These processes do not make decisions with legal or similarly significant effects.

Security

Appropriate technical and organizational measures are used to protect personal data against unauthorized access, loss, alteration, or disclosure. Access is limited to people and providers who need it for the purposes described above.

Your rights

Subject to the conditions of Swiss data protection law, you may request information about your personal data, access or receive a copy of it, have inaccurate data corrected, have data deleted, or object to particular processing. You may withdraw research consent at any time without affecting processing that occurred before withdrawal.

To exercise these rights or ask a privacy question, contact:

You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).