Русский · English · Privacy Choices
Timora Privacy Policy
Version of September 26, 2026
1. General provisions
1.1. This Privacy Policy (the “Policy”) sets out the procedure and conditions for processing the personal data of users of the Timora software (the “Service”) and the measures taken to protect such data. The Policy has been prepared in accordance with Federal Law No. 152-FZ “On Personal Data” of July 27, 2006 (the “Personal Data Law”) and pursuant to Article 18.1(2) of that law.
1.2. The personal data operator (controller) is the developer of the Timora software (the “Operator”). Enquiries regarding the processing of personal data are accepted by email at timora-supp@yandex.ru and via Telegram: @y0rence.
1.3. The Policy applies to all personal data that the Operator obtains about a user through the Timora mobile apps for iOS and Android and the Timora mini apps in Telegram and VK.
1.4. The user reads the Policy before starting to use the Service. The user gives consent to the processing of personal data separately in the Service interface — for specific purposes and categories of data, where such consent is required by law (Section 3).
1.5. The current version of the Policy is permanently available at https://mytimora.ru/app/privacy-en.html. In the event of any discrepancy between language versions, the Russian version prevails.
2. Definitions
- Personal data means any information relating directly or indirectly to an identified or identifiable natural person (data subject) (Article 3(1) of the Personal Data Law).
- Processing means any operation or set of operations performed on personal data, with or without automation, including collection, recording, organisation, accumulation, storage, adaptation (updating, alteration), retrieval, use, transfer (provision, access), anonymisation, restriction, erasure and destruction (Article 3(3)).
- Anonymisation means actions that make it impossible, without additional information, to attribute personal data to a specific data subject (Article 3(9)).
- Cross-border transfer means the transfer of personal data to the territory of a foreign state (Article 3(11)).
- User means a natural person who uses the Service.
- EIOS means the electronic information and educational environment (student portal) of the educational institution where the user studies.
3. Legal bases for processing
3.1. The Operator processes personal data on the following legal bases (Article 6(1) of the Personal Data Law):
- the user’s consent (Article 6(1)(1)). Consent is expressed through actions in the Service interface taken after reading a notice with a link to the Policy: signing in to an account via Telegram, VK, Apple or EIOS; enabling storage of the EIOS password on the server; enabling attendance records (with a separate confirmation of consent to the processing of the user’s full name); granting access to location and notifications through the operating system;
- the performance of an agreement to which the user is a party, namely the provision of the Service’s features (Article 6(1)(5));
- the legitimate interests of the Operator in ensuring the security and proper operation of the Service, provided that the user’s rights and freedoms are not violated (Article 6(1)(7));
- compliance with obligations imposed on the Operator by the laws of the Russian Federation (Article 6(1)(2)).
3.2. The user may withdraw consent to the processing of personal data at any time (Section 9 and Privacy Choices).
4. Personal data processed
| Category | Purpose | Legal basis | Required |
|---|---|---|---|
| Selected educational institution and study group | Showing the schedule, basic settings | Performance of an agreement | Yes |
| Service settings (theme, tab bar style, reminders, display of breaks and notes) | Interface operation, sync across devices | Performance of an agreement | Yes |
| Random device identifier and session token | Technical communication with the server | Legitimate interest | Yes |
| First and last name | Identification within the account | Consent | Only when signed in |
| Email address (if provided) | Display in the profile, replies to the user’s enquiries | Consent | No |
| Telegram user ID and username | Sign-in with Telegram, bot notifications | Consent | Only with Telegram sign-in |
| VK user ID and name | Sign-in with VK | Consent | Only with VK sign-in |
| Apple ID identifier (Sign in with Apple) | Sign-in with Apple | Consent | Only with Apple sign-in |
| Profile photo (uploaded by the user or obtained from Telegram/VK) | Display in the profile | Consent | No |
| EIOS login and password | Signing in to EIOS on behalf and at the instruction of the user to obtain grades and certificate requests | Consent | Only for EIOS features |
| Grades, examination information, certificate requests | Showing academic performance and certificate status | Consent | No |
| Full name, study group, role (student, group leader, deputy), verification status | Attendance records | Consent | No |
| Class attendance marks; class locations specified by the group leader | Attendance records | Consent | No |
| Distance to the class location and location accuracy | Confirming presence at a class | Consent | No |
| Device coordinates — only at the moment of class check-in or route planning; not stored | Check-in, routes | Consent | No |
| Personal class notes | “Class notes” feature | Consent | No |
| Group leader notes for the group | “Group leader notes” feature | Consent | No |
| Push token, educational institution and group | Delivering notifications | Consent | No |
| Text of support enquiries (“Report a problem”) | Handling the enquiry | Performance of an agreement | No |
| Number of Service launches per day linked to the account or device identifier | Usage statistics | Legitimate interest | Yes |
| Aggregated data on banner impressions and clicks (not linked to the user) | Counting ad impressions | Legitimate interest | Yes, unless ads are turned off |
| IP address, request time and path | Security, abuse prevention | Legitimate interest | Yes |
4.2. The Operator does not request or process special categories of personal data (Article 10 of the Personal Data Law). If the user enters such information in a note or enquiry, it is stored encrypted and used only for the operation of the respective feature.
4.3. The Operator does not process biometric personal data (Article 11 of the Personal Data Law).
4.4. The Operator does not sell personal data, does not use it to track users across third-party apps and websites, and does not display advertising personalised on the basis of the user’s personal data.
5. Purposes of processing
- providing the Service’s features: class schedules, academic performance and examination information, attendance records, certificate ordering, notes, maps and routes;
- creating and maintaining the account, synchronising data across devices and mini apps;
- sending notifications enabled by the user;
- handling user enquiries;
- ensuring the security of the Service, preventing abuse and fixing errors;
- analysing the use of the Service in aggregated form, including counting ad impressions;
- complying with the laws of the Russian Federation.
5.2. The Operator does not make decisions that produce legal effects concerning the user or otherwise affect the user’s rights and legitimate interests based solely on automated processing of personal data (Article 16 of the Personal Data Law).
6. Procedure and conditions of processing
6.1. Personal data is processed by automated means, to the extent necessary to achieve the purposes of processing (Article 5 of the Personal Data Law).
6.2. Some data is stored on the user’s device: settings, saved schedules, the EIOS password. In the iOS app, the password, tokens and profile are stored in the Keychain; in the Android app, in storage encrypted with an Android Keystore key. This data is not included in device backups.
6.3. On the server, full names, email addresses, EIOS logins and Telegram and VK usernames are stored encrypted (AES-256-GCM). The EIOS password is stored on the server only with the user’s express permission (“EIOS password on server”, off by default), encrypted with a separate key. Encryption keys are stored separately from the database; the password is decrypted automatically and only for requests to EIOS made at the user’s instruction.
6.4. The mini apps use the messenger browser’s local storage (localStorage) for settings and cache. The Service does not use third-party analytics tools, advertising identifiers or tracking cookies.
6.5. The Operator keeps personal data confidential and does not disclose it to third parties without the user’s consent, except as set out in Section 7 and as required by the laws of the Russian Federation (Article 7 of the Personal Data Law).
7. Disclosure to third parties. Cross-border transfer
7.1. Personal data is disclosed only to the extent necessary for the purposes of processing:
| Recipient | Data | Purpose | Country |
|---|---|---|---|
| Educational institution (EIOS) | EIOS login and password, requests for grades and certificates | Signing in to EIOS at the user’s instruction. Requests go through a proxy server in the Russian Federation over HTTPS | Russian Federation |
| Telegram | User ID and username, bot messages | Sign-in with Telegram, notifications | Outside the Russian Federation (Telegram infrastructure) |
| VK (VK LLC) | User ID, name | Sign-in with VK | Russian Federation |
| Apple Inc. | Apple ID identifier; push token | Sign-in with Apple, notification delivery (APNs) | United States |
| OSRM routing service (router.project-osrm.org) | Route start and end coordinates | Route planning at the user’s request | Germany |
| 2GIS, Yandex Maps, Google Maps, Apple Maps — as chosen by the user | Route coordinates or address | Opening the route in the chosen service | Depends on the chosen service |
| Hosting providers | All data stored on the Service’s servers | Hosting the servers | Netherlands (main server), Russian Federation (auxiliary server) |
| Public authorities | As required by law | Compliance with the law | Russian Federation |
7.2. The Service’s main server is located in the Kingdom of the Netherlands. An auxiliary server that forwards mini app requests is located in the Russian Federation (Novosibirsk).
7.3. The Netherlands is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and is among the states providing adequate protection of the rights of data subjects (Article 12(1) of the Personal Data Law). Cross-border transfer is carried out in the manner established by Article 12 of the Personal Data Law.
7.4. Class schedules and information about rooms and teachers are obtained from publicly available sources of educational institutions. Map data © OpenStreetMap contributors.
8. Retention periods
| Data | Period |
|---|---|
| Account data, notes, attendance data | Until the account is deleted or consent is withdrawn |
| Database backups (stored encrypted) | No more than 30 days from creation |
| Server logs (IP address, request time and path) | No more than 7 days |
| Server cache of grades and certificate requests | No more than 10 minutes |
| Attendance journal export file (for group leaders) | No more than 15 minutes |
| Aggregated statistics not linked to users | No time limit |
8.2. Upon deletion of the account or withdrawal of consent, personal data is destroyed within a period not exceeding 30 days (Article 21(5) of the Personal Data Law), unless otherwise required by federal law.
9. User rights
9.1. The user has the right to (Articles 14, 20 and 21 of the Personal Data Law):
- obtain information about the processing of their personal data;
- request the rectification, restriction or destruction of personal data that is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
- withdraw consent to the processing of personal data;
- lodge a complaint about the Operator’s actions or omissions with Roskomnadzor or with a court.
9.2. The user can delete the account and manage data processing in the Service settings — see Privacy Choices.
9.3. Requests should be sent to the Operator by email at timora-supp@yandex.ru or via Telegram @y0rence. A request must contain information that allows the user to be identified in the Service (for example, the Timora profile number or the linked Telegram account). The Operator responds within 10 business days of receiving a request; this period may be extended by no more than 5 business days with a reasoned notice (Article 14(3) and Article 20 of the Personal Data Law).
10. Security measures
10.1. The Operator takes legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision and dissemination (Articles 18.1 and 19 of the Personal Data Law), including:
- transmitting data only over secure connections (HTTPS/TLS);
- application-level encryption of personal data and passwords before they are written to the database; keys stored separately from the database;
- encryption of backups with a key whose private part is not stored on the server;
- the database is not reachable from the Internet; administrative access to servers is possible only with cryptographic keys;
- issuing each device its own revocable token;
- rate limiting and input validation to protect against brute-force attacks and abuse;
- excluding personal data and secrets from server logs;
- limiting the retention of logs and backups.
10.2. Only the Operator and persons authorised by the Operator who are bound to keep it confidential have access to personal data.
10.3. Upon discovering an unlawful or accidental transfer of personal data that has violated users’ rights, the Operator notifies Roskomnadzor within 24 hours of discovering the incident and, within 72 hours, of the results of its investigation (Article 21(3.1) of the Personal Data Law), and takes measures to eliminate its consequences.
11. Personal data of minors
The Service is intended for students of educational institutions and is not directed at persons under 14 years of age. The Operator does not knowingly process personal data of persons under 14. A legal representative who becomes aware that such data has been provided may contact the Operator to have it destroyed.
12. Advertising
12.1. The Service displays advertising banners. Advertising is not personalised: personal data is not used to select ads and is not shared with advertisers. The Operator counts only the aggregated number of impressions and clicks for each banner.
12.2. The user can turn off advertising in the Service settings.
13. Changes to the Policy
13.1. The Operator may amend this Policy. A new version takes effect upon publication at the address specified in clause 1.5, unless the new version provides otherwise.
13.2. The Operator notifies users of material changes within the Service at least 10 days before they take effect.
14. Final provisions
14.1. Relations between the user and the Operator arising in connection with the processing of personal data are governed by the laws of the Russian Federation.
14.2. Timora is independent software and is not an official application of any educational institution.