Privacy Policy

This Privacy Policy describes how isma processes your personal data in accordance with the DSGVO (General Data Protection Regulation) and German TTDSG.

1. What we collect

When you register: email address, chosen nickname, password (stored as Argon2id hash — we never see your plain password). Optionally: profile bio, avatar URL, university choice, major, study year, locale preference. When you contribute: your uploaded documents, comments, threads, votes, study lists, course subscriptions, course proposals.

2. Legal basis

Account creation and core functionality (sharing materials) — Art. 6(1)(b) DSGVO (contract performance). Optional profile fields — Art. 6(1)(a) DSGVO (consent). Moderation logs and abuse prevention — Art. 6(1)(f) DSGVO (legitimate interest).

3. Who receives your data

isma is self-hosted. We do NOT sell or share your personal data with third parties. Service providers we use: SMTP for email verification (in production, this is your configured provider — see env config), file storage (MinIO/S3-compatible). No analytics tracking, no advertising, no embedded social media.

4. Retention

Account data: kept while account is active. Notifications and reports: 90 days after creation (automatic deletion). Soft-deleted accounts (Settings → Delete account): hard-deleted after 30 days; uploaded documents become orphaned (still associated for moderation history but with anonymized author). Idempotency keys: 24 hours.

5. Your rights (DSGVO Art. 15-22)

You have the right to: access your data (use GET /me/export to download a complete JSON copy — link in Settings), correct it (Settings → Profile), delete your account, restrict processing, port your data (the export JSON satisfies Art. 20), object to processing. To exercise these rights, contact the operator (see Impressum).

6. Cookies

isma uses only essential cookies for authentication (JWT session token, http-only). No analytics or advertising cookies are set without explicit consent — see the cookie banner on first visit.

Last updated: 31 May 2026