DP Dashboard

Privacy Policy

Last updated 2 November 2026

DP Dashboard (dpdash.andreisisu.com) is a free, non-commercial study planner for IB Diploma students. It's built and run by one person, Andrei Sisu, a student, as a personal project. This page explains what the app stores about you, where it goes, and what you can do about it.

The short version: the app stores what you type into it so it can sync across your devices. If you say yes, it also records when you use it. There are no ads and no third-party tracking. It's a hobby project, not a bank, so don't put anything in it you'd be upset to see leaked (see Security).

Who is responsible

The data controller is Andrei Sisu, the developer of DP Dashboard. For anything privacy-related, contact sisu@andreisisu.com.

What the app stores

What	Why	Where
Username and PIN (the PIN only as a one-way hash)	To find your account and unlock it	Your browser and the sync server
Dashboard content: your name, exam session, subjects, timetable, assignments, grades and assessments, study blocks, calendar events, IA/EE/TOK milestones, revision checklists, word counts, weekly study goal, settings	That's the app. Syncing lets you use it on several devices.	Your browser and the sync server
Friends: who you've added, plus pending requests	The Friends feature	Sync server
Terms acceptance: date and version you agreed to	Record that you accepted the Terms when you signed up	Sync server
Usage stats (only if you allow them): first and last visit, number of visits and sessions, roughly how long you're active, which days you used the app, and whether sessions start in the morning, afternoon, evening or night and on which weekday which pages you open and which features you use, and how often (for example PDF export, Pomodoro, saving an assignment) your setup: mobile or desktop, operating system, browser, screen size range, language, light or dark mode, installed as an app or not, notification permission, weekly or A/B timetable, app version how many subjects, assignments (and how many are done), grades, study blocks, milestones, calendar events and revision items you have, and when you added your first assignment. Only the numbers, never names, titles, marks or anything you wrote error messages from the app (with any quoted text removed), sync failures, and sessions started offline during sign-up, how far you got through the setup steps. This is stored under a random ID, not your username Not collected: anything you type, your IP address or location, and no fingerprinting or screen recording.	To see how the app is used, which features matter, where people get stuck, and what breaks, so I can fix and improve it	Sync server. The copy I read is encrypted so only I can open it.
Device preferences: dark mode, consent choice, offline cache, timer and reminder settings	To remember your settings on this device	Your browser only

The app doesn't ask for your email, phone number, location, or anything else not listed above.

Cookies and local storage

DP Dashboard does not set cookies. It uses your browser's local storage, which works like a cookie but is never sent automatically to any server. Most of it is strictly necessary: without it the app can't keep you signed in or work offline. The only optional part is usage stats, which stay off until you choose Allow usage stats. You can change your choice any time in Settings → Privacy & legal. If you turn usage stats off, the stats already recorded are deleted. When the list of usage stats changes, you're asked again, and nothing new is recorded until you answer.

Who else handles your data

A few services sit between your browser and the app. They only process data to deliver the service:

Cloudflare (Workers and D1 database) hosts the sync server where your account data is stored.
GitLab (GitLab Pages) hosts the website files.
Google Fonts serves the typefaces. Your browser asks Google for them, so Google sees your IP address.

Like most web hosts, these providers may keep short-lived technical logs, such as IP addresses and request times, under their own privacy policies. Some of them may process data outside the EU under their standard safeguards. Your data is never sold, rented, or used for advertising.

Friends can see your timetable

When you accept a friend request, that person can see your name, subjects, and timetable so the app can show which classes you share. They can't see your grades or assignments in the app.

Security: please read this

This is a student hobby project, and its security matches that. To be clear about the limits:

Your PIN is a lock on the app screen, not strong protection. Since version 1.1.5 it's stored on the server as a salted one-way hash, not as plain text. Older PINs are converted the next time you sign in. A 4–6 digit PIN is still short, so a determined attacker who obtained the hash could guess it.
Someone with technical skill who knows or guesses your username could read your data from the sync server.
As the developer, I can technically see all stored data. I only look at it to fix problems, and I never share it.

So please don't reuse a PIN you use anywhere else, and don't store anything sensitive in the app, such as passwords, health information, or private notes about other people. I'm working on improving this, and this section will change when I do.

For transparency, independent QA audits of the app, with what was found and what was fixed, are published at dpdash.andreisisu.com/qa.

Legal basis (GDPR)

Providing the service: storing and syncing your account and dashboard content, which you asked for by creating an account.
Consent: usage stats. You can withdraw consent any time.
Legitimate interests: keeping the service running and fixing bugs.

How long data is kept

Your account data is kept while you use the app. Delete it any time in Settings, or ask and it's deleted within 30 days. A deleted username stays reserved so nobody else can take it over. Usage stats are deleted as soon as you turn them off. If the app shuts down, all server data will be deleted. Data in your own browser stays until you clear it or use Settings → Reset everything.

Your rights

Under the GDPR you can ask to see, correct, export, or delete your data, and you can object to or restrict how it's used.

Export: Settings → Data management → Export JSON gives you a copy of your dashboard.
Delete: Settings → Data management → Delete my account erases your account and synced data from the server straight away. (Reset everything only clears this device.) You can also email the contact above.
Complain: you can contact Romania's data protection authority, ANSPDCP (dataprotection.ro), or the authority in your own country.

Under 16s

In Romania you need to be at least 16 to agree to online services like this one yourself. If you're younger, please get a parent's or guardian's permission before creating an account. If a parent asks, I'll delete the account.

Changes

If this policy changes in a way that matters, the date at the top will change and the app may ask you to review it again.