Privacy Policy

Responsible Body, Data Protection Officer, and Supervisory Authority

text.ur is operated by the University of Regensburg.

Universität Regensburg Universitätsstraße 31 93053 Regensburg

For further information on the responsible body (Art. 4(7) GDPR), the data protection officer, the competent supervisory authority, and your rights, please refer to the university’s data protection page:

Data protection — University of Regensburg

Purpose and Legal Basis

text.ur is a collaborative PDF annotation platform operated by the University of Regensburg for academic purposes. Personal data is processed on the legal basis of Art. 6(1)(e) GDPR in conjunction with Art. 2(1) BayHIG in conjunction with Art. 4 BayDSG to carry out a public task, to enable collaborative document annotation in teaching and research. Providing account data is required to use the platform. Without this data, no user account can be created.

Data Collected

Account data: When you register, we store your username, email address, first name, last name, and a hashed password. Guest accounts only store a username.

Usage data: Comments, annotations, reactions, task responses, and group memberships you create while using the platform.

Uploaded files: PDF documents.

Storage Location

All data is processed exclusively on university infrastructure and all assets are served from there. Uploaded files and other personal data are stored exclusively on the server’s file system and in a local database.

Cookies

This application uses only technically necessary cookies. No tracking or analytics cookies are used. Since all cookies are essential for the application to function, no consent banner is required.

Name	Purpose	Expiry
access_token	Authentication (session token)	12 hours
refresh_token	Session renewal	7—90 days (depending on account type)
theme	Dark/light mode preference	30 days
locale	Language preference	30 days

Server Logs

For security and error analysis, the server logs HTTP requests with anonymized IP addresses (last octet set to 0 for IPv4, /48 mask for IPv6). Log files are automatically deleted after 90 days. Full (unanonymized) IP addresses are only held transiently in memory for rate limiting purposes and are not persisted.

Retention Period

Personal data is retained as long as the user account exists. Upon account deletion, all account data and personal usage data are deleted immediately. Groups you own are transferred to another group administrator — transferred groups persist with all uploaded documents. Groups without another administrator are deleted along with their data.

Recipients

Only authorized administrators of the application and responsible IT staff of the University of Regensburg have access to the collected data.

Third Parties

This application does not transmit any personal data to third-party services and does not load any external resources. No transfer of personal data to countries outside the EU takes place.

Your Rights

For information on your rights under the GDPR, please refer to the university’s data protection page linked above.

Data Export

You can download all personal data associated with your account at any time. The export includes your profile information, group memberships, comments, reactions, and task responses.

Please log in to export your data.

Account Deletion

You can permanently delete your account and all associated data from your account settings page. Groups you own will be transferred to another administrator or deleted if none exists.

Automated Decision-Making

No automated decision-making, including profiling, takes place.

Contact

For questions about data protection, please contact the data protection officer at dsb@ur.de or the application administrators at Text.ur@sprachlit.uni-regensburg.de.