Website version · Русская версия
Effective from 18 May 2026, version 2.0. Cheboksary. Applicable mobile application version: 2.7.18 and above.
1.1. The data controller is the Federal State Budgetary Educational Institution of Higher Education «I.N. Ulianov Chuvash State University» (hereinafter – the University, the Controller).
1.2. Registered and operating address: 15 Moskovsky Avenue, Cheboksary, Chuvash Republic, 428015, Russian Federation. Founder: Ministry of Science and Higher Education of the Russian Federation. The University was established on 1 September 1967. Educational activities are carried out under licence No. 2276 of 19 July 2016.
1.3. University contacts:
1.4. Legal grounds for the processing of personal data:
1.5. This version of the Policy applies to the «My ChuvSU» mobile application
distributed via Google Play, RuStore and App Store under the package identifier
online.chuvsu.ru, starting from version 2.7.18.
1.6. By using the application, the user confirms that they have read this Policy. Consent to the processing of specific categories of data (analytics, error reports) is given through the application settings and may be withdrawn at any time.
The application supports iOS 15.0 and above, Android 5.0 (API 21) and above. The categories below are processed only when the corresponding features are used.
When signing in through the corporate authentication system (akey.chuvsu.ru,
OpenID Connect / OAuth 2.0 with PKCE), the application receives the following information:
The composition is determined by the University's SSO system (Keycloak) and is not extended by the application.
device_info_plus library).These identifiers do not allow identification of the user on their own and are used solely for the technical delivery of notifications and the grouping of events.
Material limitation on composition: the surname and patronymic are deliberately not transmitted to the Yandex AppMetrica analytics system. The transmission is limited to the identifier and first name, in line with the data minimisation approach.
When an unexpected error occurs in the application, the following information may be transferred
to the error registration system (bugtracker.chuvsu.online, deployed within the
University's infrastructure):
Prior to sending, headers that may contain secrets are automatically removed:
Authorization, Cookie, Set-Cookie, X-API-Key,
X-Auth-Token. In the production build the application does not write tokens, API
responses or other sensitive information to the device's system logs.
The application provides a «Report a problem» feature, allowing the user to mark outdated,
incorrect or missing information in application blocks (timetable, grades, news, etc.). The
following items are transferred to the University server (/api/v4/data-issues)
along with the report:
The user identifier is not directly included in the request payload; the account is determined on the server side from the authorisation token.
The application provides the «Settings → Analytics collection» section with two independent toggles:
bugtracker.chuvsu.online.The toggles are independent. Disabling either does not affect access to the application's main features. The effect of a toggle is immediate and persists until the next explicit change.
Requested separately by the operating system. May be withdrawn at any time through the device settings; the application remains functional except for notifications themselves.
Requested separately for each feature at the time of its first use (see clause 5.2). Refusal results in the unavailability of the corresponding feature only.
| Recipient | Purpose | Location | Data transferred | Legal ground |
|---|---|---|---|---|
| Yandex LLC (AppMetrica service) | Application usage segmentation and measurement, push notification delivery | Russian Federation | Installation identifier, screen navigation and push notification events, profile attributes per clause 3.2.3 | User consent (clause 4.1) |
| Google LLC (Firebase Cloud Messaging, Firebase Installations, Firebase Analytics) | Push notification delivery, analytics | USA, Europe | FCM token, installation identifier, navigation events | User consent + cross-border transfer notification (see clause 5.3) |
| RuStore LLC (RuStore Push service) | Push notification delivery for devices without Google services | Russian Federation | RuStore push token | User consent (expressed by the fact of using the application capable of running without Google services) |
| Apple Inc., Google LLC | Application distribution, delivery of updates, receipt of reviews and ratings | USA | User account information in the application store, generated by the stores themselves | Terms of use of the respective store |
University IT infrastructure: online.chuvsu.ru,
akey.chuvsu.ru, bugtracker.chuvsu.online |
Application backend, single sign-on, error registration and analysis | Russian Federation | Information listed in section 3.2 | Implementation of educational relations under Federal Law No. 273-FZ + user consent for the features subject to consent |
| Permission | Platform | Purpose |
|---|---|---|
Receipt and display of notifications (POST_NOTIFICATIONS / Push
Notifications) |
Android, iOS | Notifications about the timetable, grades, messages and University announcements |
Exact alarm (SCHEDULE_EXACT_ALARM), wake lock (WAKE_LOCK),
start at boot (RECEIVE_BOOT_COMPLETED) |
Android | Triggering of class start alarms set by the user |
Full-screen notification (FOREGROUND_SERVICE,
ACCESS_NOTIFICATION_POLICY) |
Android | Correct playback of alarms and priority notifications |
Read and write calendar events (READ_CALENDAR / WRITE_CALENDAR,
NSCalendarsUsageDescription) |
Android, iOS | Adding classes to the system calendar upon explicit user action |
Photo library access (NSPhotoLibraryUsageDescription,
READ_EXTERNAL_STORAGE – only for Android 12 and below) |
Android, iOS | Selecting an image for the profile avatar; on Android 13 and above the system Photo Picker is used, which does not require access to the whole library |
Camera (NSCameraUsageDescription) |
Android, iOS | Capturing the profile avatar; scanning the library card number by barcode |
Contacts access (NSContactsUsageDescription) |
iOS | Autocomplete of the «location» field when creating a timetable event. The address book contents are not copied to the application or to the University servers |
The application does not request permissions for geolocation, microphone, call log, SMS, medical sensors or biometric sensors.
Google services (Firebase Cloud Messaging, Firebase Analytics, Firebase Installations) process the technical identifiers and events transmitted to them on servers located outside the Russian Federation. The transfer is performed on the basis of the user's consent to push notifications and analytics and is subject to notification of the authorised body for the protection of the rights of personal data subjects in accordance with Article 12 of Federal Law No. 152-FZ. The data transferred abroad is limited to the installation identifier, the push notification token and screen navigation events; the personal data listed in clause 3.2.1 is not transferred to those services.
At the time of preparation of this Policy, the following features are under development; the data described below is not processed until the corresponding feature is launched. The section will be supplemented or updated by the time each feature is launched:
ucs.chuvsu.ru). Third-party advertisers are not
engaged; user data is not transferred to third parties in connection with this feature.
Non-essential announcements may be disabled in the settings.The application uses the secure storage mechanisms built into the operating system (Android Keystore, iOS Keychain via platform mechanisms) for the following items:
When the user signs out, the tokens and the profile cache are deleted. Push notification tokens are revoked from Firebase and RuStore during the standard sign-out procedure.
The information received through the «ChuvSU Key» system and University APIs is stored in the University's accounting systems for the period established by University internal regulations on the retention of administrative and educational documentation, in line with GOST R 7.0.97-2016 and the regulations of the Ministry of Science and Higher Education of the Russian Federation.
Yandex AppMetrica analytics events are retained in accordance with the periods determined by
the AppMetrica service (by default – 13 months of active analytics and 24 months of historical
data). Error reports in bugtracker.chuvsu.online are retained for no more than 90
days from the time of receipt (unless a different period is set by a University internal
regulation).
In accordance with Articles 14, 18.1, 20 and 21 of Federal Law No. 152-FZ the user has the right:
7.1. To obtain information about the processing of their personal data, including:
7.2. To request clarification, blocking or destruction of personal data where such data is incomplete, outdated, inaccurate, obtained unlawfully or no longer necessary for the declared purpose of processing.
7.3. To withdraw consent to processing. Withdrawal of consent in relation to personal data whose processing is necessary for the performance of the education contract or for purposes expressly provided for by law may result in the impossibility of performance of the corresponding obligations by the Controller.
7.4. To withdraw consent to the sending of analytical events and error reports at any time through the «Settings → Analytics collection» section of the application; this action does not affect access to the main features.
7.5. To request the deletion of the account and related personal data in accordance with the University's internal regulations. The request is sent to online@chuvsu.ru; the response time is no more than 30 calendar days.
7.6. To appeal against the actions or inaction of the Controller to the authorised body for the protection of the rights of personal data subjects (Roskomnadzor) or through the courts.
8.1. Data transfer between the application and University servers is
performed over HTTPS. For the domain online.chuvsu.ru an exception is configured
in the iOS ATS policy to allow operation with the University's internal domain; this
configuration has been agreed with the University's information security service.
8.2. Authorisation tokens are stored in the secure local storage of the operating system. Authentication in the «ChuvSU Key» system is performed via OAuth 2.0 with PKCE; alternatively, Device Authorization Grant (RFC 8628) is supported for devices where the use of an embedded browser is difficult.
8.3. In the production build the application does not write tokens or server response bodies to the operating system's logs. Extended logging may be enabled only in «Developer Mode», activated by tapping the version number seven times in the «About» section, and used solely for technical diagnostics.
8.4. Before sending technical HTTP request metadata to the error registration
system (bugtracker.chuvsu.online), the headers Authorization,
Cookie, Set-Cookie, X-API-Key, X-Auth-Token
are automatically removed.
8.5. The application uses AppMetrica Screenshot Reporting in the disabled state – screen captures containing user data are not transferred to the analytics system.
The application is intended for students, employees and other persons whose relationship with the University is confirmed in the account system. Consent to the processing of personal data of persons under the age of 14 is given by their legal representatives.
10.1. The University reserves the right to amend this Policy. A new version becomes effective upon its publication at online.chuvsu.ru/doc/mobile_app_privacy_policy and (where necessary) notification to users through the application.
10.2. The version history is maintained in the University's documentation repository. Material changes affecting the categories of processed data or the list of third parties are accompanied by a repeated consent request in the application interface.