Let me add to the rant. I complained to the Swedish Data Protection Authority (IMY) twice about such school apps. Their answers were consistently "we don't have the resources to pursue this case".

With such a weak regulatory environment, the result is fairly expected. GDPR and data protection is not just a Google and Facebook thingy. My privacy needs to be respected by both big and small players.