Privacy policy

TUMCulus Quest is the study game for the course Calculus for Management Studies at the Technical University of Munich (TUM). This page explains what data the app stores, why, who can see it, and your rights.
Last updated: 19 October 2026.

The privacy policy of the TUM School of Management applies to this app as well: mgt.tum.de/privacy-policy. This page adds what is special about the data you provide in the app.

Who is responsible

Controller: Technische Universität München, represented by its President, Arcisstraße 21, 80333 München, Germany, poststelle@tum.de.

Contact for this app: Prof. David Wuttke, TUM School of Management, david.wuttke@tum.de.

TUM's data protection officer: Arcisstraße 21, 80333 München, beauftragter@datenschutz.tum.de.

What we store

  • Your account: the username you choose, your TUM email address, your matriculation number and your login code. We keep the login code so the course team can restore it if you lose it.
  • What you do in the app: your answers, whether they were right, how long they took and when; the XP, level, streak, streak savers and daily goal that follow from them; your duels and Tower games; and your place in the weekly league.
  • Signing in: one cookie, tum_math_session, which keeps you signed in for up to 7 days. It is strictly necessary and is not used for tracking. The app sets no other cookies for students (the course team's preview page uses one more strictly necessary cookie, for 12 hours).
  • Only on your device: your theme and a few display settings, saved in your browser's local storage. They are never sent to us.

For professors and tutors, we also store their name, email address and a hash of their password.

Why, and on what legal basis

We use your data to run the study game for the course: to show your progress, to run the daily challenge, streaks, leagues and duels, and to show the teaching team where the class needs help.

Scientific research: we also use the data for scientific research. We publish only analyses based on aggregate outcomes, which do not allow anyone to identify the performance of any single participant.

No grading: we do not use any of your data for individual performance assessment or grading.

Using the app is voluntary. By creating an account, you consent to this processing, including the use for research (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by asking us to delete your data (see “Your rights”). This does not affect processing that happened before.

Who can see your data

  • Classmates: only your username, with your level, XP, streak and league rank.
  • Tutors: only anonymous numbers for the whole class, never you individually.
  • Your professor: your progress, with your username, TUM email and matriculation number.
  • The app's administrator: all stored data, but only to run and maintain the app and to help you, for example to restore a lost login code.

We do not sell your data or pass it on to anyone else. The app has no analytics, no advertising and no tracking. Fonts and maths rendering come from our own server.

Solution videos (YouTube)

After a daily challenge is over, you can watch a tutor explain its solution. These videos are hosted on YouTube. Until you press play, nothing is loaded from YouTube: the preview image comes from our own server.

When you press play, the video loads from YouTube in its privacy-enhanced mode (youtube-nocookie.com). Your browser then connects to YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and technical data about your browser and may process them under its own privacy policy: policies.google.com/privacy. Google may also process data in the USA. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by pressing play. If you do not press play, no data goes to YouTube.

Where it is stored

On a server in the Munich Scientific Network (MWN) in Munich, Germany. Your account and learning data do not leave the European Union. To keep the service running and secure, the web server may briefly record technical access data such as IP address, time and requested page. These records are not linked to your account.

How long we keep it

Your account stays as long as the course uses the app. For research, we keep the data in line with academic standards for 10 years after the publication of the analyses, and then delete it. If you ask us to delete your data, we delete it from the app and from the research data. Copies in our database backups remain until those backups are deleted.

Your rights

You have the right to access your data (Art. 15 GDPR) and to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18). You also have the right to receive it in a portable format (Art. 20) and to object to its processing (Art. 21). You can change your username yourself on your profile.

Have all your data deleted: at any time, write to Prof. David Wuttke at david.wuttke@tum.de, ideally from your TUM email address, and we will delete all of your data. This also removes you from the game.

For anything else, write to the contact for this app or to TUM's data protection officer (see above).

You can also complain to the supervisory authority: Der Bayerische Landesbeauftragte für den Datenschutz, Wagmüllerstraße 18, 80538 München, poststelle@datenschutz-bayern.de, datenschutz-bayern.de.

No automated decisions

The app does not make automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR). XP, streaks and leagues are game mechanics.

Changes

If we change this policy, we update the date at the top of this page.

← Back to TUMCulus Quest