In short
Meldo has no server of its own and no account. There are no ads, no tracking and no analytics services. Your data is stored on your device. Meldo exchanges data with Microsoft Teams or Google Drive only if you connect them yourself, and then directly between your device and that service. The developer never sees your entries.
Controller
Yavuz Selim Kolbasar
Email: contact@meldo.dev
Meldo is a free, non-commercial open-source project. The source code is on GitHub.
What is stored on your device
Subjects, timetable, hand-raises, grades, tasks, settings and scanned or imported documents. Widgets, the Raise hand button and notifications read the same data on this device. On iOS, documents are in the Meldo folder of the Files app; on Android, under Files › Documents › Meldo.
Scanning, photos and files
For scanning, Meldo uses Apple's document scanner on iOS and Google's document scanner (ML Kit) on Android, which runs through Google Play services. The images are processed on your device and saved as a PDF in Meldo. On Android, Google Play services may send technical usage and error data about the scanner to Google, but not your scans. For photos, Meldo only gets the pictures you pick in the system photo picker. You choose PDFs in the file picker.
Passwords and sign-ins
Your Microsoft sign-in and your Google sign-in are stored only on this device: in the Keychain on iOS, and on Android encrypted with a key in the Android Keystore that can't leave the device. They are not synced and are not part of any backup.
WebUntis
WebUntis is currently not part of the apps; the import is waiting for approval from Untis. Meldo currently does not connect to WebUntis. Once Untis approves, we will add here which data Meldo then exchanges with WebUntis. If you connected WebUntis in an earlier version, the data loaded back then (for example timetable, holidays, exams and absences) stays on your device and is no longer updated. Your WebUntis sign-in from back then stays stored on the device, encrypted, but is no longer used.
Microsoft Teams
When you connect Teams, you sign in on Microsoft's page. Meldo then reads your assignments, your classes and your name (or, if none is set, your school email address) through Microsoft Graph and stays signed in (EduAssignments.ReadBasic, EduRoster.ReadBasic, User.Read, offline_access). Meldo saves the assignments as homework on your device. Your name and your class names are only shown in the app. Meldo never sees your Microsoft password and checks for new assignments at most every three hours, also in the background. Microsoft may process data outside the EU. Microsoft's and your school's terms apply to that.
Sync with Google Drive
When you turn on sync, you sign in to Google and allow Meldo two things:
- The hidden app folder in your Google Drive (
drive.appdata): Meldo stores your data and documents there so you can restore them on a new device or keep your devices in sync. They are encrypted on your device with your sync password first (AES-256-GCM). Google cannot read the content, but can see how many files there are, their size and when they were saved. Meldo cannot access your other files. - Your Google account's email address (
openid,email): only to show in the app which account is connected. It stays on your device.
Meldo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Meldo does not transfer this data to anyone, does not use it for advertising and does not let any person read it. Google may store the encrypted files on servers outside the EU. You delete the sync data in the app under More › Google Drive › Delete sync data from Google Drive. You can also revoke access at any time in your Google account.
Notifications and Live Activity
Reminders, the question after each lesson and the Live Activity (the Live Update on Android) are created on your device. Meldo sends no data to a server for them. On iOS, notifications, the Live Activity and widgets on the Lock Screen or in StandBy show subjects and tasks even while your device is locked. On Android, this applies to the Live Update and notifications. You can change this in your device settings or by removing the widget.
Backups of your device
When your iPhone or iPad makes a backup to iCloud or a computer, your Meldo data is included. On Android, the system may bring your Meldo data along when you move to a new device, depending on your settings. Passwords and sign-ins are excluded in both cases.
Downloading the app
When you download Meldo from the App Store, Apple processes data as its own controller under Apple's privacy policy. The Android version is available on Google Play and GitHub. If you download it from GitHub, GitHub processes data such as your IP address under its privacy statement. If you install it from Google Play, Google processes data as its own controller under Google's privacy policy. Apple gives the developer at most aggregated, anonymous statistics. On iOS, if you allowed sharing analytics with app developers in your device settings, Apple passes crash reports to the developer without your name. If you installed Meldo from Google Play and allowed your device to send usage and diagnostics data to Google, Google Play passes crash reports to the developer without your name. They contain the device model, system version and the place in the code, but no Meldo entries, and are used only to fix bugs (Art. 6(1)(f) GDPR).
This website
This website is served by Cloudflare Pages (Cloudflare, Inc., USA). When you visit it, Cloudflare processes technically necessary data such as your IP address to deliver the page and protect it from abuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. The website sets no cookies and uses no tracking. It only stores your language and appearance choice in your browser (localStorage) when you tap DE, EN or the light and dark button at the top. That is strictly necessary for a feature you asked for (Section 25(2)(2) TDDDG). For details, see Cloudflare's privacy policy.
Contacting the developer
If you write to the developer, your message and contact details are used only to answer you (Art. 6(1)(f) GDPR) and deleted once that's done. GitHub issues are public. Please don't post personal data there.
Deleting data
You can delete individual entries in the app. Deleting Meldo from your device removes your Meldo data on that device. On Android, the copies of your documents under Files › Documents › Meldo stay until you delete them there. On iOS the Keychain may keep sign-ins afterwards. If you disconnect in the app first, they are deleted right away. If Meldo ever can't read its file, it keeps a copy for at most 30 days so nothing is lost.
Legal basis
What you enter in Meldo stays on your device. The developer does not receive your entries. Meldo processes your entries and the connections you turn on because that is needed for you to use Meldo as described in the terms of use (Art. 6(1)(b) GDPR). Meldo does not rely on consent. When you tap Allow at Google or Microsoft, Meldo gets access there. Those providers or your school are responsible for the processing on their side.
Children and teenagers
Meldo is made for students, including those under 16. The developer gets no data about you through Meldo, except crash reports without your name if you allowed them (see “Downloading the app”). Signing in to Microsoft and Google is governed by the rules of your school and those providers. If you are under 16, talk to your parents before connecting Microsoft or Google.
Your rights
Because Meldo does not store your entries on a server of its own, the developer can neither see them nor hand them over. For data held by Microsoft or Google, contact your school or that provider. Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Changes
If what Meldo does with data changes, this policy is updated before the new version is released. The date at the top shows when it last changed.
Right to object
Where the developer processes data under Art. 6(1)(f) GDPR (crash reports, emails, website), you can object at any time by emailing contact@meldo.dev.