Privacy Policy

Last updated: 2026-10-06 · Language: English · Deutsche Version

Tuba is operated from Austria (EU) and available worldwide. Regardless of where you live, we apply the EU General Data Protection Regulation (GDPR, 2016/679) as our baseline. This document is our full Article 13/14 notice.

1. Data controller

Christian Fischer
Austria (full address: see Imprint)
Email: info@tuba.school

We are the controller for your own data (account, purchases, help requests). For work by students and other third parties that you upload, we process the data on your behalf (section 9).

2. What data we process

• Account: email, timestamps and the version of the Terms and Privacy Policy in force when you registered. Registration only requires an email address — no name or other personal details. Legal basis: Art. 6(1)(b) GDPR — contract performance.
• Transactional emails: Account confirmation and password reset emails are delivered via Resend (EU region, Ireland). Only your email address and the message content are transmitted. Legal basis: Art. 6(1)(b) GDPR.
• Image content (e.g. student work): sent to Anthropic for transcription and analysis (section 4). Tuba does not store original images on its servers; to show them next to the result they stay only in your browser tab's memory (section 3a). For your own data the legal basis is Art. 6(1)(b) GDPR. Content of students and other third parties is processed by us as a processor on your behalf (Art. 28 GDPR, section 9); the legal basis lies with you or your school.
• Correction results: the text transcribed from your images, the corrected version, the error list with explanations and the estimated position of each spot in the photo (page number and coordinates, not the image itself), grading and feedback, plus the task details (grade, subject, topic, notes, criteria). Stored in Supabase (EU) until you delete them (individually in your account or by deleting your account). The transcribed text may contain personal data if the original was not anonymised before upload — the app reminds you of this at upload time. Legal basis: Art. 6(1)(b) GDPR; for third-party content, processing on your behalf (section 9).
• Red-pen balance & purchases (internally: credits): balance and transaction history. Purchases run through Stripe Checkout. We pass your email, account ID, chosen pack and the time of your confirmation regarding the right of withdrawal to Stripe. Stripe collects payment and billing data (e.g. country or address) directly and is an independent controller for fraud prevention and legal obligations. Legal basis: Art. 6(1)(b) and (c) GDPR.
• Help and error reports: message, optionally your email, page URL and user agent, linked to your account if signed in. Without sign-in we keep an HMAC hash of your IP address for at most one hour to limit abuse. Purpose: replying and fixing errors. Legal basis: Art. 6(1)(b) or (f) GDPR.
• Technical error logs: if an analysis or payment fails, we log the time, the type of error and a technical error message, linked to your account but without text or image content. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in fixing errors and correct billing.
• Welcome-bonus protection: a SHA-256 hash of the normalized email address is stored so the free bonus cannot be claimed repeatedly by deleting and re-registering. The plain email address is not stored for this purpose. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in preventing abuse.
• Server logs (Vercel): IP address, user agent, requested URL, timestamp, status code — kept for at most 30 days to detect abuse. Legal basis: Art. 6(1)(f) — legitimate interest in security.

3. Data residency & encryption

• Database (Supabase): EU region (Frankfurt). Encryption in transit and at rest using industry-standard practices.
• API servers (Vercel): EU region (Frankfurt).
• Mobile app: auth tokens are kept in the device's secure storage (Keychain/Keystore).

3a. Cookies and browser storage

Tuba sets no analytics, advertising or tracking cookies and embeds no third-party content (fonts and the product film are served from our own server). We store only what the features you use require:

• tuba-lang-pref (cookie, 180 days): your chosen language, set when you switch language or open a link with ?lang=de or ?lang=en. Without a choice, the homepage uses your browser's language setting (Accept-Language) when you arrive from elsewhere to pick German or English; nothing is stored for this.
• sb-…-auth-token (localStorage, until sign-out): your login session (token, email, account ID).
• tuba.history.… (localStorage, 24 hours, cleared on sign-out): your last up to 20 results on this device (transcription, correction, error list with photo position, feedback, grading), no photos.
• tuba.draft.… (localStorage, until sign-out): form draft (grade, subject, topic, notes, criteria).
• tuba.analysisAttempt.… (localStorage, until the analysis completes, cleared on sign-out): prevents double charging.
• tuba.intent.pack (localStorage, max. 24 hours): the pack you chose on the homepage.
• tuba.resultView (localStorage): your chosen result view.
• IndexedDB tuba: if you buy red pens while photos are selected, those photos stay in your browser so you can continue after payment. They are not sent to us, are no longer used after one hour and are deleted when you continue, sign out or next open the app.
• Tab memory: your photos stay there only while the result is open, so Tuba can show each spot in the photo. They are discarded when you start another correction, open a history entry, sign out or close the tab.

On shared devices, sign out to clear history, draft and cached photos.

4. International transfers (AI provider Anthropic, USA)

For AI correction we send image content, the images' pixel size and the task context (grade, subject, topic, notes, criteria) to:

• Anthropic Ireland, Limited (contract partner) and Anthropic, PBC (USA, processing) — Claude Sonnet

This is based on Anthropic's data processing addendum (DPA) with the EU Commission's Standard Contractual Clauses (Decision 2021/914). Under the Commercial Terms (section B) Anthropic does not train models on this data. Anthropic usually deletes inputs and outputs within 30 days; content flagged as a possible usage-policy violation may be kept for up to 2 years, longer where legally required.

5. Retention

• Original images: not stored on our servers; after analysis only in your browser tab's memory while the result is open; during a red-pen purchase also in your browser, usable for at most one hour (section 3a); for Anthropic see section 4
• Corrections & profile: until account deletion. If you delete a single correction, we keep only date, grade level, page count, modules and red pens used until account deletion.
• Red-pen balance and transactions in Tuba: until account deletion
• Payment and invoice data: 7 years at Stripe and in our accounting records (§ 132 BAO)
• Help and error reports: 12 months; reports you sent are deleted immediately when you delete your account
• Technical error logs: 12 months; deleting your account removes the link to your account
• Welcome-bonus hash: indefinitely while the free bonus is offered, so the same bonus cannot be claimed repeatedly
• Server logs: max. 30 days
• Security backups: encrypted database backups may contain deleted data for up to 30 days. They are used only to recover from serious operational or security incidents and are overwritten automatically afterwards.

6. Your rights (GDPR Art. 15–22)

• Access (Art. 15): in-app via Settings → Download data export; further information by email
• Rectification (Art. 16): by email
• Erasure (Art. 17): in-app via Settings → Delete account irreversibly — takes effect immediately in the production database; see retention above for backup copies
• Deleting single corrections: any time under Saved corrections in your account
• Restriction (Art. 18) / Objection (Art. 21): by email to info@tuba.school
• Data portability (Art. 20): JSON export inside the app

7. Right to lodge a complaint (Art. 77)

You can file a complaint with the Austrian Data Protection Authority: dsb.gv.at. Outside Austria: with the supervisory authority of your residence.

8. Automated decisions

AI corrections are recommendations, not binding assessments — the final decision is made by the teacher. No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place.

9. Student data: processing on your behalf

For student or other third-party work, you or your school are the controller. Tuba processes this content only on your behalf under the data processing agreement (Terms, section 12); the providers listed under Processors act as sub-processors.

Remove names and personal details before uploading. Do not upload texts revealing special categories of data (Art. 9 GDPR, e.g. health, religion, ethnic origin), or redact those passages. Tuba is for adults only; students do not use Tuba themselves.

10. Contact

Questions about privacy: info@tuba.school. Reply within 14 days.