Privacy policy

Draft status: this text is under legal review. It describes what the platform does today, as read from its source code on 8 September 2026. Values in square brackets are not yet confirmed. It is not the binding version.

This policy covers the Olympiads app (iOS, Android, macOS, Windows and Linux), the olympiad websites you sign in to (auth.main-team.org and each olympiad's my. site), and this site, hub.main-team.org.

Who is responsible

The controller for your data is Main Team Organisation GmbH (Germany).

Main Team Organization LLC (United States) also appears in the terms you accept at registration. Its role — joint controller, processor, or operator of specific services such as the Grand Final — to be confirmed by Main Team.

Contact for privacy questions: privacy contact e-mail — to be confirmed. Postal address: see the Imprint.

The short version

• We collect what an olympiad needs: who you are, your school, which exams you sit, your answers and your results.
• During a supervised exam the app records your camera and, on a computer, your screen. No audio is recorded. The recording is the condition for sitting a supervised exam; there is no "continue without recording" in the app.
• Payments go through Stripe. Your card details never reach us.
• We do not sell your data and we do not run advertising.
• This website sets no cookies and uses no analytics.

What we collect and why

Your account

When you register you give us:

• first name and last name (they cannot be changed afterwards; the form warns you);
• date of birth and gender;
• the country you live in, your school's city, your school's name and your grade;
• an e-mail address, which we confirm with a code before the account is created;
• a phone number;
• a password, unless you sign in with Google.

The platform gives you a username. If your school registers you, the school gives us these details instead of you.

At registration you accept the terms. A second, optional box agrees to promotional e-mails about Main Team programs, events and services; leave it unticked and you get service e-mails only.

Why: to run your account and your exams (contract). Promotional e-mails: your consent, which you can withdraw at any time.

Signing in

You sign in with your e-mail and password, or with Google. If you use Google, Google gives us your Google account ID, e-mail address and first and last name, and we link that ID to your account. Google sees that you signed in to Main Team; Google's own privacy policy applies to that.

On the olympiad websites one cookie holds your sign-in refresh token, and a second short-lived cookie exists only while a Google sign-in is in progress. The apps use no cookies; they keep the same token in the operating system's secure storage (Keychain, encrypted preferences, or the desktop keyring).

Your devices

Every call the app makes carries a device identifier generated on first launch, the app version, and which client it is (schola_client_id). For each signed-in installation we keep the device identifier, platform, device model, app and operating-system version, the IP address of the last sign-in or refresh, and when it was last seen. My devices in the app shows this list and lets you sign any device out.

A sign-in history is kept and deletes itself automatically. Period — to be confirmed.

Why: account security — a stolen token can be spotted and revoked (contract, and our legitimate interest in keeping accounts safe).

Exams, answers and results

For each exam you sit we store your registration, when you started and handed in, every answer as you give it, your result, any report or certificate issued, extra time granted by an administrator, and survey answers if you fill one in afterwards.

Certificates and reports have a public verification page reachable by their ID. It shows the name and username on the certificate, the exam category, language and date, so a school or jury can check it is genuine.

Why: running and grading the exam and issuing results (contract).

Supervised exam recordings

Some exams are supervised. For these the app records:

• your camera — you at your desk. One camera is usual; an exam may allow up to five, including an external USB camera or a phone you pair by QR code as a second angle;
• your screen — on computers only. On a phone or tablet the app pins itself to the screen instead;
• still frames from those sources every few seconds, sent separately so a reviewer can scrub through the session.

No audio is recorded. The recording protocol has no audio track anywhere, and the apps do not ask for microphone permission.

Recording starts when you set up your cameras on the readiness screen — before the paper opens — and stops when you hand in; the rules screen says so. Video is sent to us in pieces while you work. If your connection drops, the pieces wait in the app's own storage on your device and are sent when it returns; the app tells you when something is still waiting.

A phone paired as a second camera records only while its grant is valid, and the grant expires with the exam window. That phone does not need an account.

Where the video goes: an Amazon S3 bucket in the EU (Frankfurt, eu-central-1) region, encrypted at rest with a customer-managed AWS KMS key and shared by all Main Team olympiads. Only Main Team staff with the recording-review permission can open a recording, through time-limited links. Uploads that never complete are discarded after one day.

How long: recordings are kept for exam supervision, review and appeals. Retention period — to be confirmed by Main Team. No automatic deletion rule is currently set on completed recordings.

Why: supervision and integrity of the exam (contract — the recording is a condition of a supervised exam — and our legitimate interest in preventing and detecting cheating).

Exam log

During an exam the app writes an event log to our server. Each entry has your exam registration, the time, the IP address the request came from, an action and details. In plain words, the actions are:

• exam started, time up, auto-submitted, submitted; extra time started;
• an answer given (the log is also how a lost answer is recovered after a crash);
• you left the exam window or tab;
• a screenshot was taken; screen capture started or stopped;
• text was pasted into an answer;
• the same exam opened in more than one tab or browser;
• camera and recording events: permission granted, recording started, a camera disconnected, reconnected, skipped or unskipped, pieces dropped, recording torn down;
• lockdown started or unavailable, quit refused, exam environment changed, low disk, recording helper unusable.

On a desktop computer the log also records at exam start how many displays are connected (a second one must be disconnected before the exam can start), whether a virtual camera was present, whether the app runs inside a virtual machine, and whether a remote-control program was running. Each entry carries a device block: operating system and version, app version, screen resolution, CPU cores and memory size.

The log does not contain keystrokes, the contents of other apps, or files from your device.

Why: exam integrity and recovering answers after a crash (legitimate interest, and contract).

Crash and diagnostic data

The apps contain no crash-reporting or analytics library. The exam log above is the only diagnostic data they send us. The support code the exam room can show identifies your exam session, nothing more.

Payments

Exam fees (on the web and on the desktop app) and Grand Final participation fees are paid through Stripe. On the web and desktop you pay on Stripe's hosted checkout page; in the mobile apps the Grand Final fee is paid through Stripe's in-app payment sheet. Your card number never reaches us. We keep the amount, the currency, the status of the payment and Stripe's transaction reference, and we e-mail you a confirmation.

The mobile apps do not take exam-fee payments at all; an unpaid exam simply shows Payment pending.

Why: contract, and the legal duty to keep accounting records.

E-mail

We send e-mail through Mailgun, from no-reply@main-team.org: the verification code and welcome message at registration, password-reset codes, and payment confirmations. Whether exam announcements are also sent by e-mail — to be confirmed. Promotional e-mails go only to people who ticked the optional box at registration. How to unsubscribe — link or address to be confirmed.

Notifications

On iOS and Android the app can show push notifications about your exams and announcements, if you allow it in the operating system. We then store the push token Apple (APNs) or Google (FCM) gives the device, with the device identifier and app version, so we can address that device and drop the token when you sign it out. The desktop has no push: the app asks our server for new announcements about once a minute and shows a normal system notification.

Why: your consent, given through the operating system's permission dialog. Turn it off there at any time.

The Grand Final

If you take part in the Grand Final we store your registration for the event, your group, your challenge submissions and your results. Some challenges offer AI-assisted image or page generation. The text you type into such a challenge is sent to Amazon Bedrock in AWS's US West (Oregon) region to produce the result, and the generated image is stored with your submission. Which challenges use this in the current season — to be confirmed.

This website

hub.main-team.org is a static site served from Amazon S3 through Amazon CloudFront. It:

• sets no cookies;
• runs no analytics and loads nothing from third parties at run time — fonts are served from this site;
• stores one value in your browser's localStorage (hub-theme) if you choose light or dark mode by hand. Nothing reads it but the page;
• fetches its status, release and download data from this same site.

The desktop app checks this site for updates: that request carries your operating system, CPU architecture and the app version you are running. Whether CloudFront access logs (IP address, requested path) are enabled for this site — to be confirmed.

Legal bases

Under the GDPR we rely on:

• Contract (Art. 6(1)(b)) — your account, registrations, exams, answers, results, certificates, payments, devices, service e-mail, and the recording that is a condition of a supervised exam.
• Legitimate interest (Art. 6(1)(f)) — supervision, anti-cheating checks, the exam log, account security, and defending results in an appeal.
• Consent (Art. 6(1)(a)) — promotional e-mail and push notifications. You can withdraw it at any time.
• Legal obligation (Art. 6(1)(c)) — keeping payment records as long as tax and commercial law require.

Who receives your data

We use these processors; each sees only what it needs.

App stores (Apple App Store, Google Play) receive what their own policies describe when you install the app. We do not share your data with advertisers, and we do not sell it.

If your school registered you, it is responsible for having the right to give us your details, and its supervisors can see your registrations and results for the exams they entered you in. Main Team staff see what their role allows.

International transfers

Some of the companies above process data in the United States. Where that happens we rely on EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework — to be confirmed per processor. Exam recordings and uploaded files stay in the EU.

How long we keep data

• Account data — while your account exists (see below).
• Answers, results, certificates — period — to be confirmed; they are part of the olympiad's record.
• Recordings and the exam log — period — to be confirmed; kept for review and appeals.
• Payment records — as long as tax and commercial law require period — to be confirmed.
• Device records and push tokens — until you sign the device out or it is revoked. Sign-in history expires automatically.
• Incomplete recording uploads — one day.

Deleting your account

You can delete your account from your account settings on the olympiad website. Two things to know:

• Deletion is refused while a paid exam or Grand Final registration exists on the account, because we must keep those records for accounting.
• When an account is deleted, the platform removes it from the active user database and keeps an archived copy. Retention of that archive, and what it is used for — to be confirmed by legal review.

Your rights

You can ask us to:

• tell you what we hold about you and give you a copy (access);
• correct what is wrong (rectification);
• delete your data (erasure) — we may refuse for recordings, logs and results while an exam review or appeal needs them, or where the law requires us to keep them;
• give you your data in a machine-readable form (portability);
• stop processing based on legitimate interest (objection) or limit it (restriction);
• stop promotional e-mail or push (withdraw consent).

Write to privacy contact e-mail — to be confirmed. We answer within one month.

You can also complain to a data protection authority. For Main Team Organisation GmbH the competent authority is the supervisory authority of the German state where the company is registered — to be confirmed.

Children and parents

Many of our students are under 18. We do not ask for a parent's details at registration, and the platform does not enforce a fixed age limit. If the law where you live requires a parent's or guardian's consent for a child to use an online service, that consent must be in place before the account is created. A parent can exercise every right above on the child's behalf by writing to the contact address with the student's username. Age threshold and how consent is verified — to be confirmed by legal review.

Security

Connections are encrypted in transit; recordings are encrypted at rest with a key we control. Access tokens expire after five minutes and are renewed from a token that rotates on every use — a reused old token revokes every session on the account. The apps keep tokens in the operating system's secure storage and upload with short-lived signed links; they hold no storage credentials.

Changes to this policy

We will post changes here with a new date at the top. If a change matters to how we use your data, we will tell you by e-mail or in the app before it takes effect.

Contact

Main Team Organisation GmbH — registered address — to be confirmedprivacy contact e-mail — to be confirmedData protection officer, if one is appointed — to be confirmed