Privacy Policy

Last updated: 28 September 2026

1. Introduction

Welcome to Diclasso! We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes what data we collect, how we use it, and how we protect it.

Diclasso is operated by Nutistu OÜ (registry code 14322776, Estonia). We are the data controller for this data within the meaning of GDPR Article 4(7).

Scope: this policy applies to all of our domains — digiklass.ee, its English-language version diclasso.com, and the supporting domains liitu.ee and classo.it (join links for games and polls) and lingi.ee (short links). All of them share the same data controller, the same servers, and the same databases.

2. Scope of Service and Our Role

Diclasso is a web-based toolkit that is free to use and intended for the personal use of the registered user. The primary user group is teachers in their own teaching, but the tools are equally suitable for other private or small-scale events — for example, team activities at work, the programme of a party, a club's activities, or other similar situations. The user registers an account as a private individual using their email or Google/Microsoft account.

Session participants (e.g., players, respondents) do not create accounts in Diclasso and are not required to. A participant joins only via a link or session code shared by the user, predominantly anonymously or under a nickname of their own choice.

The user is responsible for ensuring that the data they enter (e.g., the names of persons in a list) is permitted to be entered under the applicable rules and law.

3. Information We Collect

3.1 Authentication Data

When you sign in with Google or Microsoft, we collect:

• Account ID (Google or Microsoft)
• Email address
• Name
• Profile picture URL
• Account creation and last login timestamps

When you register with email and password, we collect:

• Email address
• Name
• Password (stored as a cryptographic hash, never in plain text)
• Email verification status and token
• Account creation and last login timestamps

3.2 Security-Related Data

To ensure account security, we collect:

• Login attempt history (IP address, timestamp, success status)
• Password reset tokens (temporary, expire automatically)
• Account lockout status (activated after 5 failed login attempts)
• Security audit trail — a record of the system refusing access to someone else's content, or of an account security action (email change, content sharing, admin export): timestamp, IP address, account and type of action, without the content itself
• Web server request log (IP address, timestamp, requested address without sharing tokens, response code) — we keep a copy so that in the event of a security incident we can determine whose data was affected and to what extent. Without it, we would have to assume the worst in case of a breach.

3.3 Content You Create and Session Content

To provide our services, we store content entered by the user or generated in their sessions:

• Names of lists (e.g., class, team, group)
• Names of list members (entered by the user — we recommend using first names, initials, or nicknames where entering the full real name is not necessary)
• Responses and results from polls, votes, games, and quizzes
• Event registrations

We do not ask for or store from session participants email addresses, phone numbers, dates of birth, profile pictures, national identifiers, or other direct identifiers. For participants we only store what the participant themselves enters when starting the game/poll (e.g., a nickname), plus a technical session ID. In most tools, asking for the participant's name is optional and the user can turn it off.

3.4 File Collection (Koguja)

When using the file collection feature with Google Drive or Microsoft OneDrive integration, we store:

• Encrypted cloud service credentials (Google Drive or OneDrive)
• Collection session data (title, description, folder ID)
• File metadata (name, size, type)
• Submitter name (if requested)

3.5 Technical Data

We automatically collect:

• Session cookies (for authentication, 30-day validity) — the full cookie list is in §12
• Browser and device information
• IP address — used for security purposes (see §3.2) and to determine the country at the time of the request; the IP address is not stored in page-view statistics
• Country and network operator (e.g. "Elisa Eesti AS") — derived from the IP address using a database file located on our own server. No IP address is sent to any external service for this. We do not determine or store city-level location. The network operator name lets us separate real visitors from data-centre bots in our statistics
• Application usage statistics and page views (server-side, no cookies or third parties). A visitor who is not signed in is identified only by a daily-salted hash (IP + browser information) — it cannot be traced back to a person and is different the next day. For signed-in users, page views are linked to the account, see §4
• Campaign link source — if you open the site through a QR code in our printed material or a partner's link (utm_source in the address), we store the source and material identifier with the page view (e.g. "tife / exit ticket"). The source is kept in your session for 30 days, and if you create an account in the same browser during that time, it is linked to the account. We use this only to learn which materials bring in users; no new cookie is set for this

3.6 Browser Storage

We store in your device:

• Theme preference (light/dark)
• Application card order preferences
• Newsletter subscription status
• Local settings and unfinished work (e.g. drafts) in some applications, so that your work is not lost on page refresh

3.7 Feedback and Correspondence

If you send us a message using the feedback form on the site, we store:

• The message content, chosen category, and rating
• Your name and email address — taken from your account when signed in, so that we can reply
• The page address and browser information from which the feedback was sent (to reproduce issues)
• Our replies and the course of the conversation

3.8 Licenses and Quote Requests

If you request a license quote or conclude a license contract (see Terms of Service section 11), we store:

• The institution's name, registry code, and email domain(s); the approximate number of staff and the request message
• The contact person's name and email address — for signed-in users also the link to the account
• The license period, storage limit, price, invoice number, and payment date
• Email addresses on a list provided by the institution (e.g. colleagues using a personal email address), so that the license applies to them
• If you confirm your email address for a license: the address and the time of confirmation

We do not collect payment details (card or bank data) — licenses are paid by bank transfer against an invoice. Invoices and accounting source documents are kept in Nutistu OÜ's accounting records for the period required by law.

3.9 Public Collection

If you publish your content in the public collection (see Terms of Service section 5.4), we store:

• the title, description, subject, grade and classroom situation of the published content, the publication time and the link to your account. These are public and may be indexed by search engines;
• a public name, if you enter one yourself. Without it, the author is shown as “Diclasso user” — your account name and email address are not shown in the collection;
• likes from signed-in users, the number of copies, and which item a copy was made from;
• reports: the reporting account, the reason and the explanation. The author does not see who reported; if an admin hides an item, the reason is emailed to the author.

When you unpublish, the item disappears from the collection. When you delete the content or your account, the item, its likes and its reports are deleted.

4. How We Use Your Data

• Service provision: delivering educational tools and features
• Authentication: user identification and account management
• Personalization: remembering your preferences
• Communications: sending important updates and newsletters
• Analytics: collecting application usage statistics to improve our service (server-side, without cookies or third parties)
• Licenses: responding to quote requests, activating licenses, and notifying about their end
• Security: detecting and preventing misuse

How "anonymous" the statistics really are. Statistics about visitors who are not signed in are pseudonymous: we store only a daily-salted hash from which a person cannot be identified. For signed-in users, page views and application launches are linked to the account. We use this for three things:

• Your own usage overview on your dashboard — when and which tools you have used. Only you see it (along with the system administrator, who has access to the database).
• Aggregate statistics — how often an application is used, at what times of day, from which country. Individual users are not distinguished in aggregate figures.
• Organisation summary — if an account's email address is on an organisation's domain (e.g. @school.edu), we may share usage figures aggregated by that domain with the organisation: how many users used Diclasso, which tools, and how often per month. The summary contains no names, email addresses or any individual's activity; figures below three people are hidden, and no summary is shared if fewer than five users from the organisation have created content. Accounts with a personal email address (e.g. Gmail) are not included.

We do not make automated legal or similarly significant decisions on this basis, we do not pass profiles to any third party, and we do not use them for advertising. If you do not want your usage linked to your account, let us know — we will remove the link manually (see also the right to object in §9).

5. Data Security and Hosting

We implement the following security measures:

• Secure database storage
• Secure password hashing
• Encryption of cloud service credentials (AES-256-CBC)
• Secure cookies (HttpOnly, Secure flags)
• HTTPS connection for data transmission
• Login attempt rate limiting (brute-force protection)
• Automatic account lockout after repeated failed attempts
• Email address verification on registration
• API request rate limiting
• Backups encrypted with AES-256 before they leave the server (see §10)
• Regular security updates

Hosting: Diclasso servers are located in the Opalstack hosting provider's Frankfurt (Germany) data centre. Data remains within the European Union.

Security updates and vulnerability management: We monitor security advisories for the libraries and server software in use and apply updates within a reasonable timeframe. Vulnerability tracking relies on public CVE databases. We do not perform regular external penetration testing — Diclasso is a free service intended for personal use.

Internal access: Access to the Diclasso system and databases is limited to Nutistu OÜ representatives for the purpose of system administration. In addition, the hosting provider (Opalstack) has technical access to the server infrastructure.

While we follow best practices, no system can guarantee 100% security.

6. Personal Data Breaches

If we become aware of a personal data breach (e.g., data leak, unauthorised access, loss or alteration of data), we will act as follows:

• We identify and document the nature, scope, and likely consequences of the breach.
• We assess the likely impact of the breach on users' rights and freedoms.
• If the breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of the breach (GDPR Article 33).
• If the breach is likely to result in a high risk, we will also notify the affected users without undue delay at their registered email address (GDPR Article 34).
• We maintain a register of breaches in which all identified personal data breaches are recorded together with the circumstances, consequences, and measures taken.

If you suspect that a personal data breach has occurred affecting the Diclasso system, please notify us immediately at mikk@nutistu.ee.

7. Third-Party Services

7.1 Google Services

• Google OAuth: for authentication, only if you choose to sign in with Google (Google Privacy Policy)
• Google Drive: for file storage, only if you choose this option

7.2 Microsoft Services

• Microsoft Azure AD / Entra ID: for authentication, only if you choose to sign in with Microsoft (Microsoft Privacy Statement)
• Microsoft OneDrive: for file storage, only if you choose this option

7.3 Backup Storage (Google Drive)

Our own automated backups (see §10) are uploaded encrypted to a Google Drive account managed by Nutistu OÜ. Encryption happens on the server before upload and the key is held only on our server and in a password manager — Google cannot read the backup contents.

7.4 Fonts and Web Libraries

All typefaces (including Inter and OpenDyslexic) and web libraries (Bulma, Font Awesome and others) are served from our own server. They previously came from external content delivery networks (jsDelivr, cdnjs, Google Fonts), which meant every visitor's IP address reached those networks on page load. Since August 2026 no such request is made — loading the site's appearance no longer transmits anything to a third party.

7.5 YouTube

Some applications (Kuldvillak, Viktoriin, Kiirviktoriin) allow users to add YouTube videos. We use the youtube-nocookie.com domain, which does not set tracking cookies until the user actually plays a video.

7.6 Hosting Provider and Email Delivery

Opalstack (a US-based company, with servers in Frankfurt, Germany) provides server hosting and email delivery (SMTP). Opalstack has technical access to Diclasso database files as part of the hosting service, but is not entitled to use the data for any other purpose.

7.7 Geolocation Database (DB-IP)

We determine a visitor's country and network operator from a database file stored on our own server (DB-IP Lite, licensed under CC BY 4.0), which we download once a month. No visitor IP address is ever sent to DB-IP or any other service — this is not a query-based service but a static file on our server. Data source: IP Geolocation by DB-IP.

7.8 Ko-fi (Donations)

Our support page contains a link to the external service Ko-fi. The link itself transmits no data — Ko-fi sees you only once you click and leave Diclasso. If you choose to donate, the entire payment takes place within Ko-fi (and their payment provider) under their terms; we neither see nor store payment details. Donating is not required in order to use the service.

7.9 Maps (OpenStreetMap)

Some applications display a map: Adventure Trail (GPS checkpoints along a route) and Event (the event's exact location, if the organiser has set one). Map imagery (so-called tiles) is loaded from OpenStreetMap Foundation servers. At that moment OpenStreetMap can see your IP address and which map area is being viewed; their privacy policy permits short-term retention of such data to protect the service.

• On the event page the map loads only after you click ("Show map"). Until you do, no request goes to OpenStreetMap. The location can also be opened in an external map app — that is an ordinary link, which likewise transmits nothing until clicked.
• In the Adventure Trail player view the map is part of the game and loads with the page.
• Address search (when setting an event location or building a trail) goes through our server to OpenStreetMap's Nominatim service — the searcher's IP address never reaches OpenStreetMap; only the address being searched is passed on.

7.10 Weather (MET Norway)

The Class Board weather widget shows the weather for the chosen place based on open data from the Norwegian Meteorological Institute (MET Norway) (licence CC BY 4.0). Requests go through our server: MET Norway receives only the rounded coordinates of the place, never the IP address of the person viewing the board. Place search in the widget settings likewise goes through our server to OpenStreetMap's Nominatim service (see §7.9). We cache the responses on our server without linking them to any user — weather for up to a few hours, place-name searches for up to 30 days.

8. Data Sharing

We do not sell or rent your data. We only share data:

• With your consent
• With service providers: who help operate the application (e.g., Google)
• For legal reasons: when required by court or authorities
• To protect rights: our or users' rights, safety, and security
• With an organisation, in aggregate: only the organisation summary described in §4, which does not distinguish any individual

9. Your Rights

Under the EU General Data Protection Regulation (GDPR), you have the right to:

• Access: obtain a copy of your personal data
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data
• Restrict processing: limit certain data processing
• Data portability: receive data in machine-readable format
• Object: prohibit data processing for certain purposes
• Withdraw consent: at any time

To exercise your rights, please contact us (see §15). You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee/en).

10. Data Retention

• User account: retained while the account is active. If an account has not been signed in to for 12 months, we send a notice to the account's email address and delete the account together with all its content 30 days later, unless someone signs in during that time (Terms of Service section 3.4). We delete an account within 30 days of a deletion request.
• Unconfirmed account (created with an email address and password, email not confirmed, never signed in to): the name, email address, and password hash are deleted 30 days after registration. About a week after registration, we send a reminder with a new confirmation link (Terms of Service section 3.4).
• Trash (deleted content): when you delete content you created, it does not disappear immediately — it moves to the trash for 30 days, where you can restore it yourself (Dashboard → Trash). Participant responses and results linked to that content are kept with it during this period; without them the content would only be restored as an empty shell. The same applies to lists: a deleted list, or a member removed from a list, is kept in the trash together with the names, and learners’ progress linked to that list is not deleted during this period. After 30 days everything is deleted automatically and permanently. You can also delete an item from the trash permanently before that. When an account is deleted, the trash is deleted immediately along with the rest of the data.
• List data and member names: retained until the user deletes them or closes the account.
• Poll, game, and session data: deleted according to application-specific logic — mostly per-session (e.g., Foor, Klassitahvel widgets, Lumememm), some until the user deletes them. Presentation responses (anonymous, no names) are kept for 12 months after the session ends, or until the owner deletes them sooner; the results view shows the exact deletion date for each session. Top Answers survey responses (anonymous, no names) are kept for 12 months after the last response, or until the owner deletes them sooner; after that the free-text responses are deleted and only the game board rows remain (answer label and points).
• Images, audio recordings, shared text: 30 days, then automatically deleted. If you share an audio recording while logged in, we store a link between the shared clip and your account so you can manage the share from your dashboard (stop it or extend it by 30 days); extending starts a new 30-day period. The link is deleted together with the clip.
• Session data: 30 days after last activity.
• Password reset and email verification tokens: expire automatically within 1 hour.
• Login attempt logs: up to 90 days.
• Security audit trail and web server request log copy: up to 180 days. This is longer than for login logs because a data breach is often discovered only weeks or months later, and these logs are then the only way to identify the people affected.
• Collection sessions: until user deletes or they expire.
• Application usage statistics: individual records for up to 24 months, then daily aggregate figures only, with no link to a person.
• Feedback messages and correspondence: up to 24 months after the matter is resolved.
• License quote requests: up to 24 months.
• License data (institution, period, storage limit, price, invoice number, contact person): while the license is valid and for up to 7 years after it ends, so that we can evidence the contract and billing. When an account is deleted, we immediately remove the account link and contact details from a personal license.
• Email addresses on a school license list: up to 12 months after the license ends.
• License email confirmation: until the account is deleted; an unconfirmed confirmation link is deleted after 7 days.
• Short links (lingi.ee): until the user deletes them; an expired link remains renewable for 30 days (redirection is disabled during that time) and is archived afterwards.
• Not-found (404) request log: up to 180 days — we store only the requested address and the day, without the IP address.
• Security policy (CSP) reports: in aggregate form only (which rule was violated on which page), without IP address or account link.

Backups: there are two layers of backups. (1) The hosting provider's (Opalstack) own backups, made as part of the hosting service (see Opalstack documentation). (2) Our own encrypted backups: databases daily (the last 7 are kept) and the entire site weekly (the last 4 are kept). These are encrypted with AES-256 on the server and then uploaded to Nutistu OÜ's Google Drive account (see §7.3) — the key never reaches Google. When an account is deleted, we remove the data from the production system immediately; it disappears from our backups through rotation (databases within about a week, full archives within about a month) and from the host's backups according to their own schedule.

You may request deletion of your account and data at any time.

11. Privacy of Minors

An account can only be created by users who are at least 18 years old (of legal age), and by accepting the terms of service the user confirms their age. If we learn that an account was created by a minor, we may delete the account together with its content.

Minors do not create accounts in Diclasso — they take part in games and polls without an account, via a shared link or code. When you use Diclasso together with minors (e.g., in class with students, in training, at a children's event, or in club activities) such that they take part in games or polls:

• participation is anonymous or under a nickname chosen by the participant;
• the data collected is minimal (session-based responses, optional nickname);
• data is typically deleted after the session ends, depending on the tool.

The user is responsible for ensuring that the use of the tools with minors complies with the applicable rules (e.g., the school's internal rules, instructions from the event organiser, notice to parents). If a user enters minors' real names into a list, we recommend first consulting with the responsible party and considering the use of nicknames or initials.

If your child's data has been entered into Diclasso and you wish to have it deleted, please contact us — we will delete the data without undue delay.

12. Cookies

Diclasso only uses cookies strictly necessary for the service to function — we do not use tracking or advertising cookies:

• Session cookie (PHPSESSID): to remember your login (30-day validity). The CSRF token for forms is kept inside the same session — we do not set a separate CSRF cookie
• Login redirect cookie (login_redirect): a temporary cookie remembering which page to return you to after sign-in; it expires after sign-in or within an hour at the latest
• Session device cookie (live_device): used in shared activities and games where participants do not create accounts. It lets the server recognise that the same browser is the same participant — so the same person's answers are not counted twice and unfinished work is not lost on refresh. It contains only a random code, no personal data; it lasts 32 days from last use and is protected from JavaScript (HttpOnly)
• Time zone cookie (dk_tz): stores your device's time zone name (e.g. "Europe/Tallinn") so that deadlines and expiry times are shown in your local time. It contains only the time zone name, not your location or any personal data; it lasts one year
• Quiz device cookie (viktoriin_device): links a quiz participant to the same browser so that answering in progress is not lost on refresh and the same participant is not counted twice. Only a random code; lasts one year, HttpOnly
• Listening test device cookie (kt_device): links a listening test participant to the same browser so that listening and answering in progress are not lost on refresh and rate limiting is per device rather than per shared school IP. Only a random code; lasts one year, HttpOnly
• Preference groups device cookie (el_device): links a preference groups participant to the same browser so that they can change their choices and later see their result, and rate limiting is per device rather than per shared school IP. Only a random code; lasts one year, HttpOnly
• Hangman device cookie (lumememm_device): distinguishes participants in the same game without accounts. Only a random code; lasts one year, HttpOnly
• Sign-up session cookie (valik_session): holds a temporary reservation in a sign-up list so that the slot you picked is not lost while you register. Only a random code; lasts 30 minutes, HttpOnly
• Scheduling poll cookie (uhisaeg_voter_…): lets you change your availability answer later without creating an account. A separate cookie per poll containing only a random code; lasts 90 days, HttpOnly
• Wall author cookie (sein_authors): holds random codes for the wall posts you added yourself, so that you can edit or delete them later. It contains no post content or personal data; lasts 90 days, HttpOnly
• Wall device identifier (sein_fp): distinguishes participants on the same wall and limits post flooding. Only a random code; lasts 90 days
• Q&A wall device cookie (pollDeviceId): lets you manage the questions you submitted and counts your vote once. Only a random code; lasts one year

Local storage (localStorage) is used on your device to remember theme preferences (light/dark), application card order, and some applications' local settings and drafts — this data never leaves your device.

Because we only use strictly necessary cookies, we do not need prior consent for cookie use (EU ePrivacy Directive art. 5(3) exemption). You can manage cookies through your browser settings, but this may affect application functionality.

13. International Data Transfers

The primary Diclasso data (user account data, class lists, game and poll results) is hosted in Opalstack's Frankfurt (Germany) data centre — data remains within the European Union. Country detection also happens entirely on our server (see §7.7) — no IP address leaves the EU for that purpose.

Data travels outside the EU in two cases:

• Encrypted backups to Google Drive (see §7.3 and §10). The content is encrypted before transfer and the key stays with us, so Google cannot read the data.
• Third-party services the user optionally chooses to use — Google OAuth, Google Drive, Microsoft Entra ID, OneDrive, YouTube, Ko-fi. Map tiles (see §7.9) come from OpenStreetMap Foundation servers located in Europe and the United Kingdom (which has an EU adequacy decision), fronted by a global content delivery network.

Such transfers take place under the respective providers' standard contractual clauses and data protection frameworks. The user can decide whether to use these third parties — authentication is also available with email and password.

14. Changes

We may update this policy from time to time. We will notify you of changes by:

• Updating this page and the date
• Sending email for significant changes

15. Contact and Data Controller

For questions or requests, please contact us at the email address above.

16. Governing Law and Supervisory Authority

This Privacy Policy is governed by Estonian law and the EU General Data Protection Regulation (GDPR). The supervisory authority is the Estonian Data Protection Inspectorate (www.aki.ee/en), with which you have the right to lodge a complaint.