This English version is a translation for convenience. If the two differ, the Polish version applies.
Okienko UEK is an unofficial, free student app with the timetable of the Cracow University of Economics. It is not affiliated with UEK. Below we explain in plain words what data we process, why and for how long.
Who is responsible for the data
The controller is Szymon Słota, a private individual who runs the app. Contact for anything about your data: kontakt@okienkouek.pl.
Your UEK password
- Your login and password pass through our server only to log in to UEK systems on your behalf (logowanie.uek.krakow.pl, e-uczelnia.uek.krakow.pl) and fetch your timetable. The server neither stores nor logs the password.
- If you tick “Remember me”, the password stays only on your device, encrypted with a key that cannot be exported from it. The app then uses it to refresh the timetable in the background.
- After logging in, the server gives the app your UEK timetable session, encrypted so the app cannot read it, for 10 minutes and only in its memory. That way choosing your group does not need a second login to UEK. It contains no password.
- “Log out” removes the password and the key from the device.
What data we process
- Account (sync between devices): UEK login, the list of logged-in devices (only a hash of each device’s key), chosen and recently viewed groups, hidden subjects, theme, absences, your own notes and hidden entries, added friends, and your friend profile settings with a copy of its photo. The profile’s secret key is stored encrypted. That way everything is in place when you log in on another device.
- Friend profile (only if you turn it on): the name you choose, groups, an optional photo, the entries you share, entry confirmations and friend groups. Anyone who knows your code sees them. Entries added for a class group are visible to all app users in that group. With such an entry we keep a hash of your UEK login, so that the author of a reported entry can be blocked. We also keep the codes of the friends you added, to know who can join a friend group at once: someone joins without an invite only if they and everyone in the group have one another as friends. Others get an invite, and until they accept only the person inviting sees them.
- Notifications (only if you turn them on): your browser’s push subscription address, groups, hidden subjects and reminder settings.
- Calendar subscription (only if you turn it on): a random identifier, groups, hidden subjects and the dates of your entries.
- USOS connection (only if you use it): we read your programme and class groups once. We discard the access token right after reading.
- Reports (only if you report something): which entry or profile, the reason, the time and who reported it, that is your profile code or, without a profile, a hash of a random key from your device. The author of reported content does not learn who reported it. Others only see the number of reports on an entry.
- Technical data: IP address and request times, used to limit attempts (protection against abuse). Attempt counters are kept in the database under a keyed hash of the IP address or UEK login, from which the address or login cannot be read back. The hosting provider also briefly keeps standard request logs.
- Error reports: when something in the app breaks, we send a description of the error: the place in the code, browser and system, screens visited. Before sending we remove the login, passwords, entry text, identifiers and email addresses. The report goes through our server, so the provider does not learn your IP address.
- Visit statistics: the address of the page visited without parameters, the referring page, country, device type, system and browser. No cookies and no identifier that would recognise you the next day. We use them to see which parts of the app are used.
- Group timetables are fetched from planzajec.uek.krakow.pl and we keep one shared copy, so we do not fetch the same timetable for every person separately. This is UEK data about groups, not your personal data.
Legal basis
- Providing the service you ask for (Art. 6(1)(b) GDPR): login, timetable, sync, friends, notifications, calendar.
- Legitimate interest, that is security, protection against abuse, handling reports, visit statistics and fixing errors (Art. 6(1)(f) GDPR).
How long
- Password: never on the server; on the device until you log out.
- Account: until you delete it, or 12 months after you last used the app on any device.
- Friend profile with photo and entries: until you stop sharing, or after 12 months without use. The photo stops being available at once, and its file is gone from the server by the next night at the latest.
- Dated entries: up to 6 months after that date. Entries without a date: 12 months after the last change.
- Calendar subscription: until you turn it off, or after 12 months without downloads by a calendar app.
- Notifications: until you turn them off or the subscription expires in the browser.
- A reminder waiting to be sent (who to, and its text): until it is delivered, at the latest until the class or the entry’s time.
- Reports: 90 days, or until the reported content is deleted.
- Count of group notifications about entries (a limit against abuse): 2 days.
- Attempt counters: up to a day.
- An invite to a friend group: until it is accepted or declined, at most 30 days.
- Error reports: 30 days.
- Visit statistics: in aggregate form that cannot be linked to you.
- Encrypted database backups: 14 days. So the data of a deleted account is gone from them at most 14 days after deletion.
Old data is deleted automatically once a day.
Who we share data with
We do not sell data or show ads. Data only goes to the providers the app cannot work without:
- Vercel Inc.: hosting of the app and server (servers in Frankfurt, EU) and visit statistics.
- Supabase Inc.: database (region: Ireland (eu-west-1)).
- Functional Software Inc. (Sentry): error reports (servers in Frankfurt, EU).
- GitHub Inc.: storage of encrypted database backups (only the controller has the key).
- Your browser’s notification provider (e.g. Google, Apple, Mozilla): delivers encrypted notifications to your device.
- Cracow University of Economics: its systems, which we log in to on your behalf.
Vercel, Supabase, Sentry and GitHub are US companies. Where data leaves the European Economic Area, this happens under the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.
Cookies and device storage
We use no advertising or analytics cookies. Visit statistics work without cookies and without storing anything on your device. The app stores data on your device (IndexedDB, localStorage, cache) so it works without internet. The only cookie is the technical usos_req, set for 15 minutes while connecting to USOS. All of this is necessary for the service you ask for.
Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. You can delete all data on the server yourself in Settings → Delete account and data. For anything else, write to kontakt@okienkouek.pl. You can also lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).
Changes
We will announce important changes to this policy in the app. The date of the last change is at the top of the page.