LehrPuls Data-Flow Statement

For privacy offices, IT security and procurement · LehrPuls 1.21.1 · November 8, 2026 · Dr. Florian Hollomey, Rohr 17, 8413 Ragnitz, Austria · office@lehrpuls.com

This statement describes which components LehrPuls consists of, which data moves between them, and what never leaves the instructor's computer. It is written to let an institution decide whether a data processing agreement is needed (in our reading it is not, because the vendor never receives institutional data) and to answer the questions "Where is the data hosted?" and "What does the vendor see?". Every statement here is based on the released source code and on the published privacy policy (version of November 5, 2026).

1. Components

2. Diagram

3. Data flows in detail

3.1 Inside the laptop (always)

The cockpit writes everything it holds — courses with participant lists, questions, sessions, answers, grades, notes, uploaded files — into the SQLite database and the media folder in the user's profile. The projector view is a second window of the same process. Exports (XLSX, CSV, JSON raw data, PDF reports, .lpx exchange files) are written to the location the instructor chooses. None of this involves a network.

Read-only interface (optional). When the instructor enables it, a local HTTP API on 127.0.0.1 answers requests from programs on the same computer (Power BI, Excel, R, Python, or an AI assistant via the Model Context Protocol). It requires a bearer key that expires after at most 90 days, returns anonymized data by default, and uses a read-only database connection. Network reachability must be enabled separately after a warning. IT can lock the interface with LEHRPULS_API_SPERRE=1.

3.2 Local route: room network

When a session starts, the session server listens on the laptop (TCP 8712, fallback 8713–8715). The projector shows a QR code and a room code; participants' browsers load the participant app from the laptop and exchange questions and answers with it over HTTP and WebSocket. What travels: the current question (text, options, images), the participant's answers, and — depending on the join mode the instructor chose — a pseudonym, a name, or a name and student ID (checked against the course list on the laptop; the list itself is not sent). What does not travel: passwords (there are none), other participants' answers, course lists, results of earlier sessions. The connection is unencrypted HTTP because a TLS certificate cannot be issued for a private, room-dependent IP address; the data stays within the room network or the instructor's hotspot.

The session server accepts up to 500 devices per session. It stops when the session ends; outside sessions no port is open.

3.3 Online route: relay

When participants are not on the laptop's network (separate lecture-hall and Wi-Fi networks, remote participants), the cockpit connects outbound to relay.lehrpuls.com over TLS (HTTPS/WSS, TCP 443). Participants connect to the same relay. End-to-end encryption: every message and every file is encrypted on the laptop or the device with AES-256-GCM. The session key is part of the join link's URL fragment (#k=…), which browsers never transmit to any server. The relay forwards opaque ciphertext between the host and the devices of one room.

What the relay sees: the six-digit room code, connection metadata (IP addresses, timing, message sizes, a per-connection routing ID), and ciphertext. What the relay stores: room reservations (room code, a random host token, expiry) so an interrupted session can be resumed; encrypted files (question images, participants' attachments) for the duration of the session, deleted when the session is ended and otherwise at most 12 hours after the last access; usage counts per hour and per ended session (connections, devices, joins, messages, bytes — numbers only, no codes, addresses or identifiers). The web server in front of the relay logs IP address, time and request path; logs are deleted after at most 90 days. What the relay cannot do: read questions, names, answers or files; it never holds the key.

The relay is open source and can be self-hosted by the institution (LEHRPULS_RELAY_URL). In the hybrid mode "room joins over Wi-Fi as well", devices on the laptop's network use the local route while others use the relay.

3.4 Smartphone remote

The instructor's own phone can control the session over the local network (same mechanism as the local route) or, since version 1.22, online through the relay: the phone opens the session's join link with a remote-control marker and connects like a device, but never joins as a participant. A one-time code from the cockpit (valid ten minutes, one device) grants access; the code, the key presses and the session status travel end-to-end encrypted inside the same channel as the questions, so the relay sees only ciphertext. The remote shows the state of the session and the next action; it carries no participant data beyond what the cockpit shows.

3.5 Update check (optional, vendor contact)

At startup and at a configurable interval, the cockpit fetches https://lehrpuls.com/latest.json (one HTTPS GET). The request carries the program identifier LehrPuls/<version> as User-Agent and nothing else from the application: no device, license or installation identifier, no usage data. The file contains the latest version number, the address of the download page and a short note. Nothing is downloaded or installed automatically. The web server log (IP address, time, path, user agent) is kept for at most 90 days and evaluated only in aggregate. The check can be switched off in Settings; the application then makes no outbound connection on its own.

3.6 License purchase and activation (outside the application)

Licenses are bought on lehrpuls.com/license.html, either by invoice (form data: name, e-mail, institution, billing address, license type, seats, optional VAT and purchase-order number; stored in the vendor's customer database at Hetzner) or online through Paddle.com Market Limited as reseller and merchant of record. Paddle collects payment data; the vendor never sees it. Paddle passes name, e-mail, country, product and (for companies) company name and VAT number to the vendor so the license key can be issued. Paddle's script loads only after the buyer clicks "Pay online".

The license key is an ed25519-signed token containing product, licensee name and e-mail, license type, purchase date and the covered major version. The application verifies the signature offline with the vendor's embedded public key. There is no activation server and no contact with the vendor during activation or use.

3.7 Website visits and e-mail

Visiting lehrpuls.com creates a standard web server log entry (90 days). The site sets no cookies and embeds no analytics or third-party content. E-mail to office@lehrpuls.com is hosted by the Austrian provider oja.at.

4. What never leaves the laptop

• The database and media folder: courses, participant lists, questions, all answers and results, grades and notes, uploaded files.
• Course lists during a session with name and student-ID verification: the check runs on the laptop; devices receive only the result.
• In online mode, any readable content: the relay receives ciphertext only.
• Any identifier of the installation, device or license toward the vendor: the update check carries only the version number; the license is verified offline.

5. Roles under GDPR and FERPA (vendor's reading)

• Session data: the institution or instructor is the controller. The vendor is not a processor — it never receives the data. No data processing agreement is required for the desktop application.
• Relay: the vendor operates a forwarding service that handles ciphertext and connection metadata. We describe this in the privacy policy; institutions that prefer full control can self-host the relay or use the local route only.
• Purchase data: the vendor is the controller for the buyer's contact and billing data (privacy policy, section 2); Paddle is an independent controller for the payment.
• FERPA: no third party ever holds education records; the data remains on the institution's device like a grade sheet in a spreadsheet.

6. Settings that change the flows

Data-Flow Statement, LehrPuls 1.21.1, November 8, 2026. Sources: application source code, relay source and protocol specification, privacy policy of November 5, 2026.