LehrPuls · Privacy & Security Fact Sheet

LehrPuls — Privacy & Security Fact Sheet

Version: November 8, 2026 · LehrPuls 1.21.1 · for teaching and learning centers, IT departments, and data protection officers · Contact: Dr. Florian Hollomey, office@lehrpuls.com

LehrPuls is a classroom response and feedback tool for higher education. It runs as a desktop application on the instructor's computer (macOS or Windows); participants answer in the browser of their smartphone, tablet, or laptop and install nothing. This fact sheet follows the order of questions used in sector DPIAs of the Dutch higher-education cooperative SURF (controller and processor, data categories, purposes, storage location, retention, sub-processors, third-country transfers, security, data subject rights), followed by the architecture, the data flows, what the relay sees, a comparison with cloud tools, a pre-filled DPIA template, and an IT approval checklist. Every statement about the system is backed by a source listed in section 16.

1. At a glance

Question	Answer
Where is the data?	Only on the instructor's computer (the user's application data directory), or, if IT configures it, in a data folder inside the institution's OneDrive tenant. There is no LehrPuls cloud and no account with the vendor.
Does the vendor receive content?	No. Questions, courses, names, answers, and results never leave the computer toward the vendor.
Do participants need an account?	No. They join via QR code or a six-digit code in the browser.
What happens online?	Messages pass through the relay `relay.lehrpuls.com` (Hetzner, EU). They are end-to-end encrypted (AES-256-GCM); the key sits in the URL fragment, which the browser never sends to any server. The relay sees connection data and ciphertext, not content.
Which firewall rules does IT need?	Outbound HTTPS/WebSocket (TCP 443) to `relay.lehrpuls.com` and optionally to `lehrpuls.com` (update notice). No inbound rules.
Who is the controller?	For the data in the application: the instructor or their institution. The vendor is the controller for the relay service and the website (connection data).
Are there deletion functions?	Yes: a deletion date per course with a reminder, anonymization of sessions while keeping the statistics, a trash with a time limit, deletion of participant files, anonymized exports and read-only API.

2. Controller and processor

Teaching content (questions, courses, names, answers, results): the controller is the instructor or their institution. The vendor does not receive this data and is not a processor for it; there is no data path to the vendor.
Relay service: the vendor (Dr. Florian Hollomey, Rohr 17, 8413 Ragnitz, Austria) operates the relay and thereby processes connection data: IP addresses in the access log, room codes, and encrypted payload. Hetzner Online GmbH is the vendor's processor for hosting. Whether the institution wants a data processing agreement with the vendor for this connection data is for its data protection officer to assess; the vendor provides a template on request. Alternatively the institution can restrict LehrPuls to local operation, or run its own relay: the relay address can be redirected with the environment variable LEHRPULS_RELAY_URL, and the relay server is documented as a Docker container; the vendor provides source code and installation guide to institutions on request.
Website and license purchase: when a license is bought, the vendor processes the licensee's name, e-mail address, and billing data (privacy policy on lehrpuls.com, sections 2 and 3). This concerns instructors, not students.
Legal basis for teaching use: the model privacy notice shipped with the application describes participation as voluntary and the purpose as conducting and didactically evaluating the course. The institution determines the applicable legal basis (for example Art. 6(1)(e) GDPR in conjunction with national higher-education law, or consent).

3. Data categories

The table lists what LehrPuls can store locally, based on the database schema of version 1.21.1. What is actually collected depends on the join mode chosen per session (section 9.1).

Category	Data	Data subjects	Note
Course roster	Display name, optional e-mail address, note, import reference (such as a student ID number), internal short code, import source, timestamps	Students	Entered by the instructor or imported from Excel/CSV. Needed only for the join modes "By name" and "Name + student ID".
Course	Name, semester, description, deletion date	—	The deletion date drives anonymization (section 9.2).
Session	Join mode (anonymous, pseudonym, by name), join code, start, end, course, playlist name, question language	—	—
Participation in a session	Display label (name, pseudonym, or placeholder), random device ID, join time, reference to the roster entry (only "By name" and "Name + student ID"), short code for switching devices	Students	Anonymous sessions have no identity beyond the device.
Answers	Answer content as JSON (chosen options, free text, numbers, sketches as vector data, references to uploaded files), submission time, time taken, confidence, instructor's grade and comment, group assignment, exclusion flag	Students	Free text can contain names that the instructor must review (section 9.2).
Questions from participants (Q&A wall)	Text, author label, reach, tag, votes, attachment	Students	The author is removed by the course deletion date.
Participant files	Photos and files attached to answers and questions, content-addressed in the `media` folder	Students	Deletable per session or by age (section 9.4).
Groups	Compositions per course and session	Students	Removed with the course deletion date.
Trash	Deleted courses, sessions, questions, and playlists as JSON, with deletion date	Students	30-day limit (configurable 1 to 3650).
License	Instructor's name, e-mail address, license type, purchase date	Instructor	Signed file; never transmitted.
Co-teaching hand-off ("Staffelstab")	Partner's name from their license, hand-off history	Instructors	Only when the hand-off feature is used.
Settings	Hash of the read API access key, minimum group size, deletion periods	—	The key itself is not stored.

In the participant's browser: a random device ID per browser and session (reconnecting after an interruption); with review enabled, the resolved questions with the participant's own answers for one day; with follow-up enabled, the recap for one to fourteen days. This data never leaves the device and disappears with the browser's site data; nothing is kept for it on the relay or on the instructor's computer.

Special categories (Art. 9 GDPR) are not provided for by LehrPuls; they can appear in free-text answers if a question invites them.

4. Purposes

LehrPuls processes data to conduct and didactically evaluate a course: live polling and quizzes, peer instruction, feedback on learning progress, item analysis (difficulty, discrimination, times), and longitudinal views across semesters. Longitudinal statistics work on anonymized data after the course deletion date has been applied. Whether the institution uses LehrPuls for additional purposes (attendance, grading) is its own decision and must be reflected in its legal basis and notice.

5. Storage location

Application data: the database lehrpuls.db, images and participant files in the media folder, and the license file are stored in the user's application data directory: ~/Library/Application Support/com.hollomey.lehrpuls/ (macOS) or %APPDATA%\com.hollomey.lehrpuls\ (Windows).
Data folder (optional): for shared lecture-hall computers, IT can set the user environment variable LEHRPULS_DATA_DIR, for example to %OneDrive%\LehrPuls. LehrPuls then works on a local working copy and saves to the data folder every five minutes (only when something changed) and on exit; the database never runs directly inside the OneDrive folder. The data thereby stays within the institution's tenant. The data folder must not be shared with other people: it contains personal data and the personal license.
Relay: holds only ciphertext and connection data, in memory and in a cache that is cleared on every start, on a server of Hetzner Online GmbH in a data center in the EU (Nuremberg, Germany).
Vendor: holds no application data at all.

6. Retention

Data	Retention
Sessions and answers on the instructor's computer	No automatic deletion. The instructor deletes sessions (trash) or applies the course deletion date, which anonymizes names while keeping the statistics (section 9.2).
Course roster	Until the course deletion date set by the instructor (reminder on the start page) or until manual deletion.
Trash	30 days by default (configurable 1 to 3650 days); entries are permanently removed at the next program start after expiry; "Empty trash" acts immediately.
Participant files	Until deleted per session or by age (30, 90, 180, or 365 days) in expert mode, or when the session is deleted and the trash emptied.
Relay: routing table	In memory only, for the lifetime of the connections.
Relay: room reservation (`reservierungen.json`)	Join code, `host_token`, and expiry, only for interrupted sessions; default 180 days set in the cockpit, at most 366; a regular session end releases the code immediately. File readable only by the service (mode 0600).
Relay: encrypted files	Deleted when the session ends regularly; otherwise 12 hours after the last access; 15 minutes after a connection loss if no host returns. The cache directory is cleared on every start.
Relay: usage log (`auslastung.jsonl`)	Permanent; numbers only (connections, devices, joins, questions, messages, bytes per hour and per ended session), no codes, IP addresses, IDs, or content. About 3 MB per year.
Relay: reachability check (`/selftest/{nonce}`)	Timestamp of a random token for 10 minutes.
Reverse proxy access log (Caddy)	IP address, time, requested address, response code, bytes, referrer, browser identifier; at most 90 days: Caddy rolls the log file at 100 MB and deletes rolled files after 90 days (default `roll_keep_for`).
Participant's browser	Device ID for the session; review one day; follow-up one to fourteen days; removed with the browser's site data.

7. Sub-processors

Party	Role	Data	Location
Hetzner Online GmbH	Hosting of the relay and of lehrpuls.com, as the vendor's processor	Connection data of the relay (IP addresses, room codes, ciphertext), web server logs	Data center in the EU
Paddle.com Market Limited	Reseller for online license purchases (not involved in the application)	Licensee's payment data, name, e-mail address, country, product	United Kingdom (EU adequacy decision)
oja.at	Mailbox provider for office@lehrpuls.com (not involved in the application)	E-mail correspondence	Austria

No party processes participant data on the vendor's behalf. There are no analytics providers, no telemetry, and no crash reporting.

8. Third-country transfers

None for application data. The relay runs in the EU. The only third-country element is the payment processor Paddle in the United Kingdom, covered by the European Commission's adequacy decision, and it concerns the licensee's purchase data only.

9. Security and privacy functions

9.1 Join modes — data minimization as the instructor's choice

Join mode	What is collected	Course roster needed
Anonymous	No name, no linkage; only distributions. Each device gets a random ID for the session.	no
Pseudonym	Self-chosen name; answers of the same person are linkable within the session without the instructor knowing who it is.	no
By name	Name selected from the course roster; answers attributable to a person. With Allow guests (default on), people not on the roster may join and are marked "Guest".	yes
Name + student ID	Family name (a prefix suffices) and student ID are checked against the roster; only matches get in. The roster never reaches the devices. Five failed attempts lock the device for a minute. No guests.	yes, with student IDs

A course can also be attached to anonymous and pseudonymous sessions so that they appear in the course filter of the analytics, without collecting names. No join mode requires an account, an e-mail address, or an app installation.

9.2 Deletion date per course

In the course dialog the instructor enters a deletion date, typically the end of the semester. When it is reached, the start page shows a reminder with course name, date, and number of affected names; the instructor can postpone by 30 days or open the deletion dialog. The dialog states beforehand how many names will be removed and how many sessions and answers remain. The names in the roster are deleted; in the sessions, placeholders such as "Participant 12" replace them, questions on the Q&A wall lose their author, group compositions disappear, and trash entries of this course are permanently deleted at once. Sessions and answers remain as anonymized statistics, so longitudinal analyses across semesters stay intact. Untouched is what participants wrote or uploaded themselves: a name in a free-text answer or a file stays there, so such answers should be reviewed first.

9.3 Trash

Deleted playlists, topics, questions, courses with participants, and sessions go to the trash first and can be restored. After the period expires (default 30 days, configurable 1 to 3650), LehrPuls removes the entry permanently at the next start; Delete permanently and Empty trash act immediately. The trash also holds names and answers: whoever deletes a course for privacy reasons empties the trash afterwards, or uses the course deletion date, which acts immediately and permanently.

9.4 Participant files

Files and photos attached to answers are stored in the media folder next to the database under content-derived names, not their original file names. The Files from participants card shows count and size per session and, in expert mode, deletes files per session or all files of sessions older than 30, 90, 180, or 365 days. The answers themselves remain; the answer then reads "File deleted". Whether participants may attach files at all is set per question ("Allow file or photo"); the Q&A wall has its own switch.

9.5 Anonymized analytics, export, and read-only API

Minimum group size. The raw data export and the read API can omit questions with fewer than a minimum number of answers (default 5, configurable 1 to 100) and round timestamps to the hour or day. In the analytics, the topic mastery indicator is grayed out below n = 10 answers so that small groups are not over-interpreted.
Exclusion. Individual answers or whole questions can be excluded from the analytics (for example test submissions) without deleting them.
Read-only API (http://127.0.0.1:8716/api/v1): off after installation; read-only; access key valid for 1, 7, 30, or 90 days (no unlimited access), of which LehrPuls stores only a hash. The default Participants anonymized (on) replaces names with "Participant 1", "Participant 2", and so on; User anonymized omits the instructor's name. Reachable on the network (default off) opens the API to the local network after a warning that the connection is unencrypted; IT can block the API entirely with the user environment variable LEHRPULS_API_SPERRE=1. Which programs receive the data is decided solely by the instructor; LehrPuls itself passes nothing on.
AI assistant (--mcp): uses the same API on the same computer, opens no additional port, and is subject to the same block.

9.6 Model privacy notice

A button on the course page opens a pre-written privacy notice for participants (German and English) that the instructor can copy into the course materials. It states the join mode, the data processed, the purpose, voluntariness, retention, and data subject rights, and contains a placeholder for the controller. It is a template, not legal advice; it describes local operation and contains an addition for online operation about the relay that cannot read the content.

9.7 Review and follow-up

Whether participants may review the resolved questions with their own answers on their device, or keep a recap for one to fourteen days, is decided per session by the instructor (default off). This data lives only in the device's browser; for exam questions both switches stay off.

9.8 Transport and infrastructure security

End-to-end encryption online. The cockpit generates a random 32-byte symmetric key per online session. It sits only in the fragment of the join URL (…/j/483920#k=…); URL fragments never leave the browser toward a server, so the relay never receives the key. Every message is encrypted with AES-256-GCM and a random 12-byte IV (cockpit: RustCrypto aes-gcm; participant app: Web Crypto crypto.subtle). The relay treats the payload as an opaque string and never decrypts, inspects, or logs it.
Join information encrypted. The join mode, the roster for "By name", and the guest setting travel encrypted from the cockpit to the device. For "Name + student ID" the roster never leaves the computer; the device sends its input encrypted to the cockpit for checking.
Files on a second track. Images and files are stored on the relay as ciphertext under meaningless IDs; files from participants take the same route in reverse, and the cockpit fetches, decrypts, and deletes them on the relay.
TLS. The relay sits behind the reverse proxy Caddy with a Let's Encrypt certificate; all traffic to it is HTTPS and WSS.
Stateless relay and abuse limits. Per source address at most 3,000 concurrent connections and 2,000 join attempts replenished at 50 per second, so a lecture hall behind one NAT address gets through while probing codes becomes hopeless. An interrupted room can be resumed only by the cockpit holding the same host_token; any other cockpit receives room_taken, so nobody can push questions to the devices during an interruption.
Local operation. In the shared-Wi-Fi mode and on the in-room path of the hybrid mode, devices connect to the instructor's computer over plain HTTP in the local network; anyone in the same network with the code can join. This path contacts no external service and works without internet.
Signed installers. The Windows installer is signed with a code-signing certificate (publisher "Dr. Florian Hollomey"); the macOS application is signed and notarized by Apple. SHA-256 checksums are published on the download page. LehrPuls never updates itself; it only shows a notice.
License offline. The license is a signed file on the computer; there is no activation server and no binding to a machine.
No telemetry. The only outbound contact beyond the relay is the update check against https://lehrpuls.com/latest.json, which sends the version number as LehrPuls/<version> in the user agent and nothing else; it can be turned off in the settings.

10. Data subject rights

Because all content stays with the instructor, requests from participants are handled by the instructor or the institution in the cockpit: access and rectification through the course roster and the session views; erasure by removing a participant, applying the course deletion date, deleting a session, or deleting files; restriction by excluding answers from the analytics; portability through the raw data export (CSV or JSON). The vendor cannot fulfill such requests for application data because it holds none. For connection data of the relay (IP addresses in the access log, at most 90 days) and for license purchases, requests go to office@lehrpuls.com; the supervisory authority for the vendor is the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).

11. Architecture

LehrPuls consists of three parts, all produced by the same program on the instructor's computer:

Cockpit — the instructor's program (a Tauri application with a local SQLite database). It manages topics and questions, courses with rosters, playlists, sessions, answers, and analytics.
Projector window — a second window for the projector with join code, QR code, question, and results.
Participant app — a web page loaded by the participants' browsers. In local operation it is served by the cockpit's built-in web server, in online operation by the relay.

Two optional vendor services process no content:

The relay (relay.lehrpuls.com) — a stateless broker for online and hybrid operation. It forwards WebSocket messages between the cockpit and the participant apps of a room and holds encrypted files for the duration of the session.
The website (lehrpuls.com) — downloads, the manual, and the file latest.json for the update notice.

Mode	Data path	Encryption	Typical use
Shared Wi-Fi	Devices connect directly to the instructor's computer (TCP 8712, fallback 8713–8715). No external service is contacted.	Local network connection without transport encryption (HTTP).	Own laptop in the lecture-hall Wi-Fi or on a hotspot; works offline.
Online (relay)	Cockpit and devices connect outbound to the relay over TLS; messages are additionally end-to-end encrypted.	TLS to the relay plus AES-256-GCM end to end; the relay does not know the key.	Lecture-hall computers and Wi-Fi in separate networks; online and hybrid teaching. Preselected since version 1.19.
Online with room	As online; in addition the cockpit server listens in the local network, devices in the room join directly, all others via the relay.	The in-room path is local operation and not end-to-end encrypted.	Hybrid teaching on the instructor's own laptop.

All paths lead into the same session; answers, groups, and analytics do not distinguish between them.

12. Data flows

No.	From	To	What	When	Can be disabled
1	Participant device	Instructor's computer, TCP 8712–8715	Participant app, join, questions, answers, images (plain text in the local network)	Shared Wi-Fi or in-room path	yes (choose online)
2	Instructor's computer	`relay.lehrpuls.com`, TCP 443	WebSocket with encrypted messages; encrypted files (PUT/GET/DELETE)	Online mode	yes (choose local)
3	Participant device	`relay.lehrpuls.com`, TCP 443	Loading the participant app; WebSocket with encrypted messages; fetching encrypted files	Online mode	—
4	Instructor's computer	`lehrpuls.com`, TCP 443	Fetching `latest.json`; user agent `LehrPuls/<version>`, no other identifier	Program start, then at longer intervals	yes (Settings → Updates)
5	Programs on the same computer	`127.0.0.1`, TCP 8716 (fallback 8717–8719)	Read-only API for analytics (access key, anonymized by default)	Only when the instructor enables it	yes; centrally blocked with `LEHRPULS_API_SPERRE=1`
6	Instructor's smartphone	Instructor's computer (local network) or `relay.lehrpuls.com`, TCP 443	Remote control: one-time code, keys, and session status; via the relay end-to-end encrypted like the questions, without joining as a participant	Only when the instructor opens it; locally in the shared network, online via the relay (since version 1.22)	yes

Exports that leave the computer: Back up data writes database, images, and license to a folder of the instructor's choice (a complete copy with all personal data). A course export (.lpx) contains the roster; LehrPuls warns that the file contains personal data and may be passed on only with a legal basis. Hand-off packages (.lpx) for sharing topics and playlists with colleagues contain topics, questions, images, and playlists, but no courses and no rosters; they carry the sender's name from the license and a random ID of the installation, and personal notes only if explicitly included. The raw data export and the read-only API are anonymized by default.

13. What the relay sees — and what it does not

The relay sees	The relay does not see
The six-digit join code (room) and the role of the connection (host or device)	Questions, answers, names, pseudonyms, rosters, Q&A posts
Connection IDs (`cid`) and the addressee of a message within the room	The session key (only in the URL fragment)
The IP address of each connection (for per-address limits in memory and in the reverse proxy's access log)	The content of images and files (ciphertext only)
Size and number of messages and files	Which answer belongs to which person
The secret `host_token` with which a cockpit resumes its room after an interruption	Who the instructor is (no license data, no installation ID)

What the relay stores and for how long is listed in section 6. In short: routing in memory only; a small reservation file with code, token, and expiry for interrupted sessions; encrypted files until the session ends or 12 hours idle; a usage log with numbers only; and the reverse proxy's access log with IP addresses for at most 90 days.

14. Comparison with cloud tools

Aspect	LehrPuls	Typical web services (cloud response systems)
Where does the data run?	On the instructor's computer; online via a relay that sees only ciphertext	On the provider's servers
Accounts	None, neither for instructors nor participants	At least for instructors, often for participants too
Processing agreement for content	Not needed: no provider sits in the data path of the content	Data processing agreement with the provider required
Third-country transfer	None for content; relay in the EU	Depends on the provider; often the USA
Works without internet	Yes (shared Wi-Fi)	No
Deletion	In the instructor's hands: deletion date, trash, file deletion; no copy at the vendor	Depends on the provider's deletion concept and backups
Telemetry	None; only the update notice (can be turned off)	Common
Cost	One-time purchase per seat	Annual subscription

Privacy in LehrPuls is not a setting but the architecture: there is no provider reading along, because none stands in the data path of the content.

15. DPIA template

The table follows the usual DPIA questions. The column "LehrPuls" is pre-filled with the vendor's answers; the column "Institution" is for the reviewing body. Whether a DPIA is required at all is the institution's decision; anonymous and pseudonymous sessions without a roster collect no names.

Item	LehrPuls (pre-filled)	Institution (to fill in)
Controller	Instructor or institution for all content	Name, institution, contact: ______________________
Processor	For content: none. For relay connection data: the vendor (Dr. Florian Hollomey, Ragnitz, Austria) with Hetzner Online GmbH as sub-processor	Assessment of relay use: ☐ online mode allowed ☐ local only ☐ own relay
Categories of data subjects	Students and other participants; instructors (license)	______________________
Data categories	Depending on join mode: no identity (anonymous), self-chosen pseudonym, name from the roster, optional e-mail address, note, and student ID; answers, times, free text, sketches, uploaded files, Q&A posts, groups; instructor's grades	Permitted join modes: ☐ anonymous ☐ pseudonym ☐ by name ☐ name + student ID
Special categories (Art. 9)	Not provided for; may occur in free text if the question invites it	Rules for free-text questions: ______________________
Purposes	Conducting and didactically evaluating the course; feedback on learning progress; longitudinal view across semesters (anonymized)	Further purposes (attendance, grading): ☐ no ☐ yes: ______
Legal basis	To be determined by the controller; the vendor's template describes participation as voluntary	☐ Art. 6(1)(e) ☐ (a) consent ☐ other: ______
Storage location	Instructor's computer; optionally a data folder in the institution's OneDrive (`LEHRPULS_DATA_DIR`); relay holds only ciphertext and connection data in the EU	☐ local ☐ OneDrive tenant ☐ other: ______
Retention	No automatic deletion of sessions; course deletion date anonymizes names (reminder at start); trash 30 days (configurable); participant files deletable by age; relay: files until session end or 12 hours, access log at most 90 days, reservation up to 180 days (configurable)	Course deletion date: ______ ; trash period: ______ ; files older than: ______
Recipients	None outside the computer unless the instructor exports (backup, `.lpx`, raw data, read API)	Permitted exports and recipients: ______________________
Third-country transfers	None for content. Relay in the EU. Online license purchase: Paddle (United Kingdom, adequacy decision), licensees only	☐ none ☐ ______
Technical measures	End-to-end encryption AES-256-GCM online; TLS to the relay; key only in the URL fragment; stateless relay; per-address limits; room reservation with `host_token`; signed installers; no telemetry; read API off, local, with time-limited key	Additional measures (disk encryption, device lock, backup): ______________________
Organizational measures	Model privacy notice; warning before exports with roster data; join mode per session; expert mode for deletion and API functions	Training, policy, approval: ______________________
Risks	Local operation without transport encryption in the Wi-Fi; free text and files with names survive anonymization; data folder must not be shared; read API on the network is unencrypted	Assessment: ☐ low ☐ medium ☐ high — measures: ______
Data subject rights	Access, rectification, erasure by the instructor in the cockpit (roster, exclusion of answers, course deletion); portability via raw data export	Procedure and contact point: ______________________
Consultation	—	Data protection officer involved on: ______ ; result: ______

16. IT approval checklist

Every item is backed by this fact sheet or the IT guide; IT ticks what it has checked or decided.

Installation and distribution

☐ Installer obtained from https://lehrpuls.com; SHA-256 checksum verified against the download page.
☐ Windows: installer carries a valid code signature (publisher "Dr. Florian Hollomey"). macOS: application signed and notarized by Apple.
☐ Installation for all users (/S /AllUsers) on lecture-hall computers; the program never writes to its program directory.
☐ Updates are distributed like the initial installation; LehrPuls never updates itself.
☐ Microsoft Edge WebView2 Runtime present or distributed.

Network

☐ Outbound TCP 443 (HTTPS and WebSocket) to relay.lehrpuls.com allowed; a TLS-inspecting proxy passes WebSocket to this host.
☐ Outbound TCP 443 to lehrpuls.com allowed, or the update notice turned off in the settings.
☐ No inbound rules needed on lecture-hall computers; confirmed.
☐ Instructors' own laptops in the Wi-Fi: local operation on TCP 8712–8715 is intended, or instructors use online mode.
☐ Per-address connection limits in firewall or proxy allow up to 500 devices per lecture hall.

Data and privacy

☐ Data folder decision: LEHRPULS_DATA_DIR set to %OneDrive%\LehrPuls (or %OneDriveCommercial%\LehrPuls) as a user variable via Group Policy or Intune, or deliberately left local.
☐ Data folder never shared between instructors; the exchange folder for hand-offs kept separate from it.
☐ Controlled Folder Access (Defender): lehrpuls.exe added as an allowed app if active.
☐ Read-only API: decision taken — left to instructors (default off, local, anonymized) or centrally blocked with LEHRPULS_API_SPERRE=1.
☐ Online mode via the vendor's relay approved, or local operation only, or own relay via LEHRPULS_RELAY_URL.
☐ Data protection officer has seen the DPIA template (section 15); join modes and deletion periods defined for the institution.
☐ Instructors know the model privacy notice and the course deletion date (manual, section 4.5).
☐ Disk encryption and device lock on computers holding rosters (institutional measure).

Test after setup

☐ Test according to section 9 of the IT guide performed (data folder, relay check, joining with a smartphone, lock with two computers).

17. Sources

All statements in this fact sheet come from the vendor's documentation as of November 2026:

Privacy policy on lehrpuls.com (version of November 5, 2026), in particular section 5 "The LehrPuls application" and section 1 (logs, Hetzner).
Relay protocol (specification of the relay server, October 27, 2026) and the relay source code: end-to-end encryption, second track for files, reservations, usage log, per-address limits.
LehrPuls manual (in the application and as PDF on lehrpuls.com): sections 4.5 deletion date and privacy, 5.7 relay, 6.2 join modes, 10.3 trash and files from participants, 10.9 read API, 11.4 data folder.
Database schema of version 1.21.1 (tables for courses, participants, sessions, answers, Q&A, files, trash, license, hand-off).
Model privacy notice in the application (German and English).
Analytics concept (minimum base n = 10 for topic mastery) and flyer (comparison with cloud services).

This fact sheet is a technical description, not legal advice. The legal assessment is made by the institution.