Privacy Policy

Last updated: 25 July 2026

1. Introduction

Welcome to Diclasso! We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes what data we collect, how we use it, and how we protect it.

Diclasso is operated by Nutistu OÜ (registry code 14322776, Estonia). We are the data controller for this data within the meaning of GDPR Article 4(7).

Scope: this policy applies to all of our domains — digiklass.ee, its English-language version diclasso.com, and the supporting domains liitu.ee and classo.it (join links for games and polls) and lingi.ee (short links). All of them share the same data controller, the same servers, and the same databases.

2. Scope of Service and Our Role

Diclasso is a free web-based toolkit intended for the personal use of the registered user. The primary user group is teachers in their own teaching, but the tools are equally suitable for other private or small-scale events — for example, team activities at work, the programme of a party, a club's activities, or other similar situations. The user registers an account as a private individual using their email or Google/Microsoft account.

Session participants (e.g., players, respondents) do not create accounts in Diclasso and are not required to. A participant joins only via a link or session code shared by the user, predominantly anonymously or under a nickname of their own choice.

The user is responsible for ensuring that the data they enter (e.g., the names of persons in a list) is permitted to be entered under the applicable rules and law.

3. Information We Collect

3.1 Authentication Data

When you sign in with Google or Microsoft, we collect:

• Account ID (Google or Microsoft)
• Email address
• Name
• Profile picture URL
• Account creation and last login timestamps

When you register with email and password, we collect:

• Email address
• Name
• Password (stored as a cryptographic hash, never in plain text)
• Email verification status and token
• Account creation and last login timestamps

3.2 Security-Related Data

To ensure account security, we collect:

• Login attempt history (IP address, timestamp, success status)
• Password reset tokens (temporary, expire automatically)
• Account lockout status (activated after 5 failed login attempts)

3.3 Content You Create and Session Content

To provide our services, we store content entered by the user or generated in their sessions:

• Names of lists (e.g., class, team, group)
• Names of list members (entered by the user — we recommend using first names, initials, or nicknames where entering the full real name is not necessary)
• Responses and results from polls, votes, games, and quizzes
• Event registrations

We do not ask for or store from session participants email addresses, phone numbers, dates of birth, profile pictures, national identifiers, or other direct identifiers. For participants we only store what the participant themselves enters when starting the game/poll (e.g., a nickname), plus a technical session ID. In most tools, asking for the participant's name is optional and the user can turn it off.

3.4 File Collection (Koguja)

When using the file collection feature with Google Drive or Microsoft OneDrive integration, we store:

• Encrypted cloud service credentials (Google Drive or OneDrive)
• Collection session data (title, description, folder ID)
• File metadata (name, size, type)
• Submitter name (if requested)

3.5 Technical Data

We automatically collect:

• Session cookies (for authentication, 30-day validity) — the full cookie list is in §12
• Browser and device information
• IP address — used for security purposes (see §3.2) and to determine the country at the time of the request; the IP address is not stored in page-view statistics
• Country and network operator (e.g. "Elisa Eesti AS") — derived from the IP address using a database file located on our own server. No IP address is sent to any external service for this. We do not determine or store city-level location. The network operator name lets us separate real visitors from data-centre bots in our statistics
• Application usage statistics and page views (server-side, no cookies or third parties). A visitor who is not signed in is identified only by a daily-salted hash (IP + browser information) — it cannot be traced back to a person and is different the next day. For signed-in users, page views are linked to the account, see §4

3.6 Browser Storage

We store in your device:

• Theme preference (light/dark)
• Application card order preferences
• Newsletter subscription status
• Local settings and unfinished work (e.g. drafts) in some applications, so that your work is not lost on page refresh

3.7 Feedback and Correspondence

If you send us a message using the feedback form on the site, we store:

• The message content, chosen category, and rating
• Your name and email address — taken from your account when signed in, so that we can reply
• The page address and browser information from which the feedback was sent (to reproduce issues)
• Our replies and the course of the conversation

4. How We Use Your Data

• Service provision: delivering educational tools and features
• Authentication: user identification and account management
• Personalization: remembering your preferences
• Communications: sending important updates and newsletters
• Analytics: collecting application usage statistics to improve our service (server-side, without cookies or third parties)
• Security: detecting and preventing misuse

How "anonymous" the statistics really are. Statistics about visitors who are not signed in are pseudonymous: we store only a daily-salted hash from which a person cannot be identified. For signed-in users, page views and application launches are linked to the account. We use this for two things:

• Your own usage overview on your dashboard — when and which tools you have used. Only you see it (along with the system administrator, who has access to the database).
• Aggregate statistics — how often an application is used, at what times of day, from which country. Individual users are not distinguished in aggregate figures.

We do not make automated legal or similarly significant decisions on this basis, we do not pass profiles to any third party, and we do not use them for advertising. If you do not want your usage linked to your account, let us know — we will remove the link manually (see also the right to object in §9).

5. Data Security and Hosting

We implement the following security measures:

• Secure database storage
• Secure password hashing
• Encryption of cloud service credentials (AES-256-CBC)
• Secure cookies (HttpOnly, Secure flags)
• HTTPS connection for data transmission
• Login attempt rate limiting (brute-force protection)
• Automatic account lockout after repeated failed attempts
• Email address verification on registration
• API request rate limiting
• Backups encrypted with AES-256 before they leave the server (see §10)
• Regular security updates

Hosting: Diclasso servers are located in the Opalstack hosting provider's Frankfurt (Germany) data centre. Data remains within the European Union.

Security updates and vulnerability management: We monitor security advisories for the libraries and server software in use and apply updates within a reasonable timeframe. Vulnerability tracking relies on public CVE databases. We do not perform regular external penetration testing — Diclasso is a free service intended for personal use.

Internal access: Access to the Diclasso system and databases is limited to Nutistu OÜ representatives for the purpose of system administration. In addition, the hosting provider (Opalstack) has technical access to the server infrastructure.

While we follow best practices, no system can guarantee 100% security.

6. Personal Data Breaches

If we become aware of a personal data breach (e.g., data leak, unauthorised access, loss or alteration of data), we will act as follows:

• We identify and document the nature, scope, and likely consequences of the breach.
• We assess the likely impact of the breach on users' rights and freedoms.
• If the breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of the breach (GDPR Article 33).
• If the breach is likely to result in a high risk, we will also notify the affected users without undue delay at their registered email address (GDPR Article 34).
• We maintain a register of breaches in which all identified personal data breaches are recorded together with the circumstances, consequences, and measures taken.

If you suspect that a personal data breach has occurred affecting the Diclasso system, please notify us immediately at mikk@nutistu.ee.

7. Third-Party Services

7.1 Google Services

• Google OAuth: for authentication, only if you choose to sign in with Google (Google Privacy Policy)
• Google Drive: for file storage, only if you choose this option

7.2 Microsoft Services

• Microsoft Azure AD / Entra ID: for authentication, only if you choose to sign in with Microsoft (Microsoft Privacy Statement)
• Microsoft OneDrive: for file storage, only if you choose this option

7.3 Backup Storage (Google Drive)

Our own automated backups (see §10) are uploaded encrypted to a Google Drive account managed by Nutistu OÜ. Encryption happens on the server before upload and the key is held only on our server and in a password manager — Google cannot read the backup contents.

7.4 Content Delivery Networks (CDN)

When loading pages, fonts and web frameworks are fetched from the following networks. They do not set cookies or collect personal data, but the service providers can see your IP address.

• jsDelivr, cdnjs (Bulma, Font Awesome and other libraries)
• Google Fonts (Inter typeface)

7.5 YouTube

Some applications (Kuldvillak, Viktoriin, Kiirviktoriin) allow users to add YouTube videos. We use the youtube-nocookie.com domain, which does not set tracking cookies until the user actually plays a video.

7.6 Hosting Provider and Email Delivery

Opalstack (a US-based company, with servers in Frankfurt, Germany) provides server hosting and email delivery (SMTP). Opalstack has technical access to Diclasso database files as part of the hosting service, but is not entitled to use the data for any other purpose.

7.7 Geolocation Database (DB-IP)

We determine a visitor's country and network operator from a database file stored on our own server (DB-IP Lite, licensed under CC BY 4.0), which we download once a month. No visitor IP address is ever sent to DB-IP or any other service — this is not a query-based service but a static file on our server. Data source: IP Geolocation by DB-IP.

7.8 Ko-fi (Donations)

Our support page contains a link to the external service Ko-fi. The link itself transmits no data — Ko-fi sees you only once you click and leave Diclasso. If you choose to donate, the entire payment takes place within Ko-fi (and their payment provider) under their terms; we neither see nor store payment details. Donating is not required in order to use the service.

8. Data Sharing

We do not sell or rent your data. We only share data:

• With your consent
• With service providers: who help operate the application (e.g., Google)
• For legal reasons: when required by court or authorities
• To protect rights: our or users' rights, safety, and security

9. Your Rights

Under the EU General Data Protection Regulation (GDPR), you have the right to:

• Access: obtain a copy of your personal data
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data
• Restrict processing: limit certain data processing
• Data portability: receive data in machine-readable format
• Object: prohibit data processing for certain purposes
• Withdraw consent: at any time

To exercise your rights, please contact us (see §15). You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee/en).

10. Data Retention

• User account: retained while the account is active. We delete it within 30 days of a deletion request.
• List data and member names: retained until the user deletes them or closes the account.
• Poll, game, and session data: deleted according to application-specific logic — mostly per-session (e.g., Foor, Klassitahvel widgets, Lumememm), some until the user deletes them.
• Images, audio recordings, shared text: 30 days, then automatically deleted. If you share an audio recording while logged in, we store a link between the shared clip and your account so you can manage the share from your dashboard (stop it or extend it by 30 days); extending starts a new 30-day period. The link is deleted together with the clip.
• Session data: 30 days after last activity.
• Password reset and email verification tokens: expire automatically within 1 hour.
• Login attempt logs: up to 90 days.
• Collection sessions: until user deletes or they expire.
• Application usage statistics: individual records for up to 24 months, then daily aggregate figures only, with no link to a person.
• Feedback messages and correspondence: up to 24 months after the matter is resolved.
• Short links (lingi.ee): until the user deletes them; an expired link remains renewable for 30 days (redirection is disabled during that time) and is archived afterwards.
• Not-found (404) request log: up to 180 days — we store only the requested address and the day, without the IP address.
• Security policy (CSP) reports: in aggregate form only (which rule was violated on which page), without IP address or account link.

Backups: there are two layers of backups. (1) The hosting provider's (Opalstack) own backups, made as part of the hosting service (see Opalstack documentation). (2) Our own encrypted backups: databases daily (the last 7 are kept) and the entire site weekly (the last 4 are kept). These are encrypted with AES-256 on the server and then uploaded to Nutistu OÜ's Google Drive account (see §7.3) — the key never reaches Google. When an account is deleted, we remove the data from the production system immediately; it disappears from our backups through rotation (databases within about a week, full archives within about a month) and from the host's backups according to their own schedule.

You may request deletion of your account and data at any time.

11. Children's Privacy

An account can only be created by users who are at least 13 years old, and by accepting the terms of service the user confirms their age.

Minors do not create accounts in Diclasso. When you use Diclasso together with minors (e.g., in class with students, in training, at a children's event, or in club activities) such that they take part in games or polls:

• participation is anonymous or under a nickname chosen by the participant;
• the data collected is minimal (session-based responses, optional nickname);
• data is typically deleted after the session ends, depending on the tool.

The user is responsible for ensuring that the use of the tools with minors complies with the applicable rules (e.g., the school's internal rules, instructions from the event organiser, notice to parents). If a user enters minors' real names into a list, we recommend first consulting with the responsible party and considering the use of nicknames or initials.

If your child's data has been entered into Diclasso and you wish to have it deleted, please contact us — we will delete the data without undue delay.

12. Cookies

Diclasso only uses cookies strictly necessary for the service to function — we do not use tracking or advertising cookies:

• Session cookie (PHPSESSID): to remember your login (30-day validity)
• CSRF cookie: to securely process form submissions
• Login redirect cookie (login_redirect): temporary cookie that expires after sign-in
• Session device cookie (live_device): used in shared activities and games where participants do not create accounts. It lets the server recognise that the same browser is the same participant — so the same person's answers are not counted twice and unfinished work is not lost on refresh. It contains only a random code, no personal data; it lasts 32 days from last use and is protected from JavaScript (HttpOnly)

Local storage (localStorage) is used on your device to remember theme preferences (light/dark), application card order, and some applications' local settings and drafts — this data never leaves your device.

Because we only use strictly necessary cookies, we do not need prior consent for cookie use (EU ePrivacy Directive art. 5(3) exemption). You can manage cookies through your browser settings, but this may affect application functionality.

13. International Data Transfers

The primary Diclasso data (user account data, class lists, game and poll results) is hosted in Opalstack's Frankfurt (Germany) data centre — data remains within the European Union. Country detection also happens entirely on our server (see §7.7) — no IP address leaves the EU for that purpose.

Data travels outside the EU in two cases:

• Encrypted backups to Google Drive (see §7.3 and §10). The content is encrypted before transfer and the key stays with us, so Google cannot read the data.
• Third-party services the user optionally chooses to use — Google OAuth, Google Drive, Microsoft Entra ID, OneDrive, jsDelivr/cdnjs/Google Fonts, YouTube, Ko-fi.

Such transfers take place under the respective providers' standard contractual clauses and data protection frameworks. The user can decide whether to use these third parties — authentication is also available with email and password.

14. Changes

We may update this policy from time to time. We will notify you of changes by:

• Updating this page and the date
• Sending email for significant changes

15. Contact and Data Controller

For questions or requests, please contact us at the email address above.

16. Governing Law and Supervisory Authority

This Privacy Policy is governed by Estonian law and the EU General Data Protection Regulation (GDPR). The supervisory authority is the Estonian Data Protection Inspectorate (www.aki.ee/en), with which you have the right to lodge a complaint.