Illini Dash — Privacy Policy
Last updated: 2026-09-18
Illini Dash runs entirely in your browser. It reads assignment and exam information from Canvas, Gradescope, PrairieLearn, PrairieTest, smartPhysics, and course websites you explicitly enable, using the login sessions already in your browser. It never sees or stores your password. All data is stored locally in your browser's extension storage, and nothing is sent to the developer or to any third party.
There is one exception, and you start it: if you connect Google Calendar, your deadline titles, courses and times are written to a calendar Illini Dash creates in your own Google account, under a permission that cannot read or touch any of your other calendars. It is off unless you turn it on, one switch turns it off, and turning it off deletes that calendar's events.
The extension also makes one network request to GitHub once a day to update its list of supported course websites; that request contains no personal data. Uninstalling the extension deletes all stored data.
What it reads
While you are signed in, and only from sites you have enabled:
| Site | What is read |
|---|---|
canvas.illinois.edu | Your active courses and your planner items, via Canvas's own API |
www.gradescope.com | Your course list and each course's assignments table |
us.prairielearn.com | Your course instances and their assessment lists |
us.prairietest.com | Your exam reservations and exams open for reservation |
smart.physics.illinois.edu | Your PHYS 211–214 enrolments and each one's prelecture, checkpoint and homework list |
| A course website you enable | Only the single page that course's adapter names |
campuswire.com (optional) | Only the posts already shown on a class feed you have open, and only if you switch Campuswire on |
piazza.com (optional) | Your class list and the announcements in those classes' feeds, and only if you switch Piazza on |
It requests the same pages your browser would if you clicked through the sites yourself, no more often than every 15 minutes, and only pages your own account can already see.
It also notices when a page on one of those same sites finishes loading in one of your tabs, and only then, so that signing in is noticed straight away instead of up to half an hour later. Chrome reveals a tab's address only to an extension that already has permission for that site, so this sees nothing it could not already read. It is not a history: the address is checked against the list above and discarded.
What leaves your browser
Nothing about you.
Nothing, unless you connect Google Calendar (below), in which case your own deadlines go to your own Google account and nowhere else.
The only other outbound request the extension makes that is not to one of the sites above is a daily fetch of one public file on raw.githubusercontent.com, listing which course websites are supported. That request is made without cookies and carries no information about you.
There is no server, no account, no analytics, no telemetry, and no error reporting. The developer receives nothing, ever, including from the Google Calendar feature.
What is stored, and where
Deadlines, course names, your per-source and per-course settings, and your manual corrections (hidden rows, merges, splits). All of it lives in chrome.storage.local on the device you are using. It is not synced between devices. Nobody else can read it, and neither can the developer.
Deadlines more than 60 days past are deleted automatically.
Permissions, and why each is needed
| Permission | Why |
|---|---|
storage | To keep your deadlines and settings on this device |
alarms | To check for new deadlines on a schedule and to fire reminders |
notifications | To show the reminders |
offscreen | To read fetched pages with the browser's own HTML parser, which a service worker does not have |
contextMenus | To add one right-click item, "Report this page to Illini Dash", which opens this extension's own settings page with the address filled in. It uploads nothing. |
cookies | To read one cookie — session_id on piazza.com — because Piazza's API requires its value back as a header and the cookie is HttpOnly. Only when you switch Piazza on, only for piazza.com, and it is never stored |
Access to piazza.com (optional) | Requested only when you switch Piazza on. Nothing is granted when you install |
identity | To ask Google for permission to write to a calendar it creates for you, and only if you connect Google Calendar. The permission it asks for (calendar.app.created) covers calendars this extension created and nothing else |
Access to www.googleapis.com (optional) | Requested only when you press Connect under Google Calendar. It is where the calendar events are written |
scripting | To run the Campuswire reader inside a Campuswire class feed you have open, and only after you switch it on. Nothing is registered until then, and switching it off removes it |
Access to campuswire.com (optional) | Requested only when you switch Campuswire on. Nothing is granted when you install |
| Access to the five sites above | To read your deadlines from them |
| Access to one course website (optional) | Requested only when you switch that course's site on, and only for that one site. Nothing is granted when you install. Many UIUC course sites are on their own domains rather than illinois.edu, so which host it is cannot be known in advance — Chrome names it in the prompt |
It does not request access to all websites, to your browsing history, or to your tabs.
Campuswire
Campuswire is off unless you switch it on, and switching it on is the only thing that asks Chrome for access to campuswire.com.
If you switch Campuswire on, Illini Dash reads the posts shown on a class feed while you have it open, on your computer, to find deadlines; it sends nothing to Campuswire and stores only the deadlines it found and which posts it has already read.
It reads only what that page has already drawn — the post titles, bodies, numbers and dates in the feed list. It does not read your Campuswire login, your token, your chat channels, your private messages, or any other page on the site, and it makes no request to Campuswire of its own. Nothing about a post leaves your browser, and the post text itself is not kept: what is stored is the deadline, and the post's number so the same post is not read twice.
Switching it off unregisters the reader immediately. Revoking the site in chrome://extensions does the same.
Piazza
Piazza is off unless you switch it on, and switching it on is the only thing that asks Chrome for access to piazza.com.
If you switch Piazza on, Illini Dash reads your class list and the announcements in your classes' feeds using your own Piazza session, every sync, on your computer. It reads the full text of each instructor announcement (not only the preview the feed shows), because that is where the deadline sentence usually is. It never posts, it never reads other students' private posts beyond what the feed shows you, it keeps no copy of any post, and it stores only the deadlines it found and which posts it has read.
It reads the same two things your browser would if you opened Piazza yourself: the class page, for the list of classes you are in, and each current class's feed. It reads the session_id cookie for one reason — Piazza's API requires that value back as a header — and sends it only to piazza.com, in the request it authenticates. It is never stored.
Switching it off stops every request immediately. Revoking the site in chrome://extensions does the same. ## Google Calendar
This is off when you install Illini Dash, and the only thing that turns it on is pressing Connect in Settings.
If you connect it, Illini Dash creates one new calendar in your Google account, named Illini Dash, and writes your deadlines to it: the course and the title of each piece of work, when it is due, the link to where you submit it, and which site it came from. Finished and hidden deadlines are removed from it.
The permission it asks Google for is a single scope, https://www.googleapis.com/auth/calendar.app.created. That scope allows an app to create a calendar and to read and write only calendars it created itself. Illini Dash cannot see your other calendars, cannot read your events, and cannot change or delete anything it did not put there. Google enforces this, not the extension.
Chrome holds the permission. The extension never sees your Google password and stores no Google token of its own.
Pressing Disconnect deletes the events and the Illini Dash calendar from your Google account, and forgets everything it knew about them. You can also remove the permission at any time at https://myaccount.google.com/permissions, and delete the calendar yourself in Google Calendar.
Nothing goes to the developer. The events go from your browser to your Google account directly.
Reporting a broken page
If you use "Report a broken page", the extension fetches that page, removes what it can recognise as identifying, and hands you a file. Nothing is uploaded. Whether that file goes anywhere is entirely your choice, and you should read it before attaching it to a public issue — the scrubber removes what it recognises, which is not a guarantee.
Contact
Open an issue at https://github.com/sushelan/illini-dash/issues.