Privacy Policy
Explains how Luotopia collects, uses, stores and protects your personal information, and the rights you have.
This is an English translation provided for your convenience. If it differs from the Simplified Chinese original, the Simplified Chinese version governs.
1. Introduction
ClosedWHU Team (hereinafter “we”, “us” or “our”) values user privacy. This policy explains how we process personal information when you use the Luotopia client and related services, and how you can exercise your rights.
The design principle of this app is that academic and campus-life data is handled mainly by “on-device processing and on-device caching”; only when you use features that need a network connection — such as accounts, AI, weather, wallpapers or the open interfaces — does the app send to the relevant servers the data necessary to make those features work.
Please read this policy together with the Terms of Service and the Cross-Border Data Transfer Notice. If you do not agree with this policy, please stop using the app.
2. Types of Information We Process
2.1 Campus Identity and Session Information (Usually Stored Only On-Device)
After you sign in through CAS, the app may store locally on your device: CAS session cookies (which may include session-ticket fields), business cookies for systems such as academic affairs, sign-in and verification timestamps, and student-status display information obtained from the university's interfaces (such as your student ID number, name, school, major, class and year of study, following whatever the university actually returns). This information is used to keep you signed in and to call features such as grades, timetables, free classrooms, venues, the library and messages. By default it is not uploaded to Luotopia's own business servers.
2.2 Academic and Campus Business Data (Mostly Cached On-Device)
This includes but is not limited to: timetables and timetable-import data, grades and GPA-related data, academic progress, free-classroom search results, library seat-booking records, sports-venue bookings and order information, campus messages, shuttle-bus route and location data, and university-calendar display data. This data comes from Wuhan University's systems, is obtained with the authorisation of your sign-in session, and is mainly cached on your device so that it can be shown offline or faster.
2.3 Luojia E-card / Payment-Related
The E-card and payment-code features may reach Smart Luojia, the mobile gateway and pages related to the China Construction Bank campus card through a WebView or an interface chain. This process may involve session cookies, redirect parameters and bank-side identifiers (such as USERID and SKEY, following the actual chain). Payment and the handling of funds are completed by the bank's or the university's systems; we do not store your bank-card password or payment passcode.
2.4 Luotopia Account Information (If You Register / Sign In)
This may include your username, password (submitted to the server over a secure connection), optional email address, tokens, and profile fields (such as display name, bio and avatar, following the fields actually made available). It is used for account authentication and for the optional community and open capabilities. The server keeps a session record for each sign-in, which usually contains the sign-in IP address, the client User-Agent (including the app version and platform), the device identifier and the runtime-environment security conclusion (see 2.9); this is used to show you the “Signed-in devices” list and to let you revoke the corresponding sessions.
2.5 Local Content You Create
Agenda items, to-dos, notes, course-editing data, wallpaper choices, and preferences such as theme and language. These are saved on your device by default; notes and wallpapers may read album images that you authorise.
2.6 AI Assistant-Related
Conversation content, session history, the API key you configure, and your provider and model settings. The API key is kept in the system's secure storage; conversation content can be stored encrypted on your device. For what is sent to the AI provider, see Section 4 and the Cross-Border Data Transfer Notice.
2.7 Location and Weather
When you grant location permission, the app may use your precise or approximate location to provide weather and shuttle-bus-stop experiences; if you do not grant location permission, it may use an approximate, IP-based location. Weather data may come from a source you choose or from a default one, such as Open-Meteo, Mi Weather or AccuWeather, and is cached on your device.
2.8 Device and Permission-Related Information
To provide features such as notification reminders, exact alarms, Bluetooth watch pairing and album reading, the system may request the corresponding permissions from you. We will not collect data unrelated to the features — such as your contacts or text messages — without saying so.
2.9 Device Identifiers, Signed-In Devices and Security Checks
So that you can tell your own devices apart and manage them in the “Signed-in devices” list, the client generates a random installation identifier (a UUID). This identifier contains no personal information in itself and is not linked to your campus identity; the authoritative copy of it is kept in the system's secure storage (such as the Android Keystore, the iOS Secure Enclave, or a desktop platform's key store). The client also reports the device name (on Android the manufacturer and model; on iOS the model's marketing name; on Windows and macOS the computer name; on Linux the distribution name), the platform, the system version and the app version. These fields are submitted with the sign-in request and synced to the current session after a successful sign-in and on a cold start; you can revoke any device's session at any time.
The client has built-in runtime-environment security checks: on Android and iOS it uses the third-party SDK freeRASP (Talsec / AHEAD), and on desktop platforms it uses a local probe. The check conclusion (normal, at risk, app data cloned, or checks not supported on this platform) and the risk-type labels (such as root or jailbreak, injection frameworks, an attached debugger, an emulator, a tampered app signature, or running with administrator or root privileges) are reported to our server and shown in your own “Signed-in devices” list. To carry out its detection of malicious and hidden apps, this SDK may read information about some of the apps installed on the device.
Please note: these conclusions are reference information reported by the device itself and are used only to help you spot abnormal sign-ins and abnormal devices. We will not take action such as banning you on the basis of this information alone. On platforms that do not support the checks, the list will show “No data” or “Not supported” rather than recording them as “Secure”.
When the security SDK determines that the app data has been copied to another device, the client clears the credentials in this device's secure storage and regenerates the installation identifier, which signs you out. This measure runs locally and is meant to protect the security of your account.
The raw details collected by the desktop-platform probe (such as the system username and user groups) are shown only on a local developer page on the device and are not reported to our server.
2.10 Logs and Debugging Information
Development and debugging builds may output logs such as network status and error information (for example via debugPrint). The app also maintains a rolling diagnostic log file on the device, which usually contains timestamps, feature modules, network status and error summaries; this log is kept only on your device and leaves it only when you actively export or share it.
We have integrated three optional channels provided by Google Firebase: Analytics, Crashlytics and Performance. The corresponding toggles in Settings are off by default; the onboarding page shown on first launch presents a consent option for diagnostics and analytics, which is ticked by default. You can untick it before finishing onboarding, and you can turn it on or off at any time afterwards under “Settings → Privacy”. Collection begins only once you turn it on, and what may be collected includes crash and exception records (including the call stack and the reason for failure), together with the usage-analytics and performance data you choose to enable. On Android devices without Google Play services, Firebase is not initialised at all. After you turn it off, we stop any new collection; the processing of data already submitted is governed by Google's relevant rules.
If the server enables audit logs, rate limiting or human verification (such as Altcha), these are used only for security and operations, and not to sell user profiles.
3. Where and How Information Is Stored
On-device secure storage (wrapping system capabilities such as the Android Keystore / iOS Keychain): the Luotopia sign-in token and user profile, the AI API key, campus-authentication snapshots (cookies and the like), and the local encryption master key.
On-device encrypted storage: sensitive local data such as AI conversations can be encrypted at the application layer before being written to preference storage.
Ordinary on-device preferences and files: settings, timetables, agenda items, weather and shuttle-bus caches, grade-import caches, wallpaper files and metadata, and the onboarding-completion state.
WebView cookies: used to keep you signed in to CAS and to the various campus business sites.
Cloud: only when you use a Luotopia account, or cloud community / review features that may be enabled in the future, is the related data stored on our servers or those of a party we entrust (the client connects by default to api-whu-sb.tsinbei.cn; api.whu.sb has also been used in the past). By default, academic-affairs data is not uploaded for the purpose of “syncing to our cloud”. The session records kept on the server usually contain the sign-in IP address, the client User-Agent, the device identifier and device name, platform and version information, the runtime-environment security conclusion, and the device note you fill in yourself.
4. How We Use Information
To provide and maintain the features you choose to use (sign-in, lookup, booking entry points, display, reminders, AI conversations and so on);
To cache data on your device in order to reduce repeated requests and improve performance and the experience on weak networks;
To safeguard the security of accounts and sessions and to guard against abuse and attacks;
To improve the product experience (based on overall feature needs, not on selling personal data);
To fulfil the obligations set out in laws and regulations.
We do not sell your personal information.
5. Entrusted Processing, Sharing and Third Parties
Operators of the campus systems: when you use CAS sign-in and the various campus features, Wuhan University and the relevant systems (for example cas.whu.edu.cn, jwgl.whu.edu.cn, zyfzzd.whu.edu.cn, zhlj.whu.edu.cn, zsgx.whu.edu.cn, gym.whu.edu.cn, seat.lib.whu.edu.cn, bus.whu.edu.cn, msgp.whu.edu.cn and pay.whu.edu.cn, among others) process your identity and business data according to their own rules. We cannot control the privacy practices of the university's systems, so we suggest that you also read the university's own notices.
Banks and payment-related parties: scenarios such as the E-card payment code may involve services related to the China Construction Bank campus card (such as app.xiaoyuan.ccb.com), to which the bank's own rules apply.
Weather and geo services: Open-Meteo, Mi Weather, AccuWeather, OpenStreetMap Nominatim, and IP-geolocation services (such as api.ip.sb and ip-api.com) receive location or query parameters only when a feature needs them.
Wallpaper services: the Bing daily wallpaper may request Bing's relevant interfaces and cache the image on your device.
AI providers: the large-model API you choose receives the conversation and the agenda-summary context.
Security-check SDK: freeRASP (Talsec / AHEAD), used for runtime-environment integrity and device-binding checks. This SDK reports security events to its provider's back end; separately, we provide the random installation identifier generated by the client (see 2.9) to that provider as an external id, so that security events can be matched to the same device on our side. What is reported does not include your campus credentials, account passwords or chat content; security-alert emails are received at security@whu.sb. This provider's servers may be located overseas.
Push services: Google Firebase Cloud Messaging (fcm.googleapis.com), and Huawei Push Kit on devices without Google Play services. Our server stores the push token and the installation identifier in order to deliver notifications to you. Push is on by default and you can turn it off in Settings; once you turn it off, the client deletes the push token and stops registering.
IP-location lookup: when you open the “Signed-in devices” list, the client queries ip9.com.cn directly for the location and carrier of the IP addresses in the list, in order to show the “Region / carrier”. This request is sent by your device and does not pass through our server; it contains nothing beyond the IP address and the usual request headers. This service is located within mainland China.
Infrastructure and content distribution: the website, static resources and the friend-links configuration may be distributed through platforms such as Cloudflare; the server may use human verification such as Altcha.
Open-source and collaboration links: visits to GitHub, Weblate and similar sites are triggered by you, and the corresponding platform's policies apply.
Except where necessary to make a feature work, where we have your consent, or where the law requires it, we do not share personal information that can identify you with unrelated third parties.
6. Permissions
Network: to access the campus systems, weather, AI, website configuration and so on;
Location: for weather, shuttle-bus and related experiences (you can refuse; some features will be reduced);
Notifications and exact alarms: for class and agenda reminders;
Album / media reading: for wallpaper and note images;
Biometrics: for the optional grades privacy lock;
Bluetooth: for optional watch-companion communication.
You can manage permissions in the system settings; refusing a non-essential permission usually does not affect other, unrelated features.
7. Information Security and Retention Periods
We take reasonable technical measures to protect sensitive local data (for example through the system's secure storage and application-layer encryption) and the security of data in transit (for example HTTPS; a few of the university's or compatibility-related links may still use legacy compatibility configurations).
How long the local cache is retained depends on whether you sign out, clear the cache or uninstall the app. Cloud account data is retained for as long as the business needs require, until you close your account or it must be deleted by law.
The validity period of cloud tokens and sessions follows the server configuration and is usually as follows: an access token is valid for 15 minutes; a refresh token and a session are each valid for 720 hours (30 days), and each use during that period slides the expiry forward. If there is no activity for more than 30 days, the corresponding session and refresh token both expire and you need to sign in again.
Please note: no security measure can guarantee absolute security, so please strengthen the protection of your device.
8. Your Rights
Access and copy: you can view the cached content in the app, such as your timetable, grades and agenda;
Correct and delete: you can edit your local agenda and timetable, sign out of the campus account to stop using the corresponding cookies, or uninstall the app to clear the data on your device;
Withdraw consent: you can turn off permissions such as location, notifications and album access, or stop using optional features such as the AI and weather;
Session management: on the “Signed-in devices” page you can see the sessions of each device under your current account, revoke a single device's session, or revoke all sessions at once; if you change your password or your email address, all sessions under that account are revoked automatically and you need to sign in again on each device;
Account matters: if you use a Luotopia account, you can contact us through the published channels to handle account-closure or correction requests (subject to identity verification and to the extent permitted by law).
Display controls such as the grades privacy lock and spoiler protection are local experience features; they do not change the processing rules of the party the data comes from.
9. Minors
This app is aimed mainly at students and staff of higher-education institutions. If you are a minor, please read this policy and use the app under the guidance of a guardian.
10. Policy Updates
We may update this policy from time to time, and the “Last updated” date on this page is authoritative. For material changes, we will try to notify you by reasonable means such as the website or in-app prompts.
11. Contact Us
If you have questions, complaints or requests about this policy or about the processing of your personal information, please contact us through the ClosedWHU community channels (such as the ClosedWHU GitHub organisation or the entry point published on the website).