For universities
What this tool does, what it costs you, and how to stop it.
This address is printed in the header of every request the extension makes to a course site. It states; it does not argue.
UniAGI is not affiliated with, endorsed by or connected to any university.
What this tool is
UniAGI is a read-only connector between a student's own course information and that student's own AI assistant. A browser extension, installed by the student, reads what the student can already open on their university's course site and stores a copy in the student's own encrypted UniAGI account; the student's AI client reads that copy. The copy is of material the student can already open, kept for their AI, encrypted with a key that only unlocks for them, deleted when they say so.
Unofficial and unendorsed
UniAGI is built by UniAGI Pty Ltd, an independent Australian AI startup. No university has approved, reviewed or endorsed it. The product, the company and this domain carry no university's name, crest or branding. One page — a campus entry page at a separate address — names a university in plain text so students can find the tool; it carries no crest, claims no connection, and links here.
It reads only the signed-in student's own data, with their own session
The extension works inside the student's own browser, with the session they are already signed in with, and reads only pages that session already shows them. It never requests quiz questions, answers or attempts, the participant list, other students' submissions or grades, or any grading view. Where a page it does open lists other students — a forum's index, replies under a staff announcement — nothing written by them is uploaded. Every address it requests is rebuilt from the course site's origin, a fixed path and an integer id, and a shared deny-list is checked immediately before every request. The extension looks for marking or editing rights in each course and skips any course where it finds them, so a tutor's or marker's account does not sync other people's work. Nothing the extension does writes to the course site: it cannot submit, post, enrol, message or start an attempt.
What you will see in your logs: pages and files are requested with GET. The course list, the calendar and each
course's structure are read through the course site's own AJAX endpoint (/lib/ajax/service.php), which is
called with POST — the same calls, to the same read-only functions, that the site's own pages make. They are
reads that arrive as POSTs, and a short fixed list of read-only function names is all the extension can call there.
What it copies into the student's account: the course list and each course's outline; the text of files the student can open (never the files themselves); assessment briefs, rubric criteria and dates; the student's own submission and group status; the student's own marks and markers' feedback; staff announcements; and technical metadata about each sync. The full table, with what never leaves the browser, is on the privacy page.
No credential leaves the browser, and our servers never contact the university
No password and no cookie value is ever read by the extension, and it has no permission to read cookies. It does use the course site's session key, inside the browser, for the same read calls the site's own pages make; the key is never stored and never sent to UniAGI. Our servers make no request to any university system — all collection happens in the student's browser, and what is uploaded is text and metadata, never file binaries.
How to recognise our traffic
Every request the extension makes to the course site carries this header, and there is deliberately no setting that removes it:
X-UniAGI-Client: uniagi/<version> (+https://uniagi.com.au/campus)
The request budget
These limits are compiled into the extension. Our servers can lower three of them for every install without an update — requests per run, requests per hour and the spacing — and can never raise any. The rest change only with a new release of the extension.
| Control | Limit |
|---|---|
| Concurrent requests to the course site | 1 |
| Spacing between requests | at least 1 000 ms, plus a random extra so installs do not fall into step |
| Requests per run | at most 60, whatever triggered the run |
| Requests per student per hour | at most 200, whatever triggered them, counted across browser restarts |
| Length of one background run | at most 8 minutes; a sync the student starts by opening a course page is not cut off by the clock, only by the two caps above |
| After the student loads a page themselves | no background collection for 30 seconds; the short sync that page visit itself starts is the exception |
| On a 429 or 503 | Retry-After is honoured; without one, back off 15 minutes, doubling up to 4 hours |
| After 3 consecutive server errors or expired sessions | collection stops for 1 hour |
Files are re-checked with conditional requests, so an unchanged file costs a 304 and no download. We
expect roughly 40–60 conditional requests per student per day in steady state;
that figure is our estimate; the per-run and hourly caps above are the limits that hold in every case. A student's first sync of a term is
paced across hours, not sprinted.
How to stop us
Once we have read your message, we can stop all collection within 30 minutes — every install stops making any request to your course site, its regular background sync included. For a single course or item, our servers refuse its uploads within minutes, and every install stops requesting it within the same 30 minutes.
Write to campus@uniagi.com.au. We stop first, acknowledge within one business day,
and then talk. The 30 minutes are the longest an open browser goes between two checks of our servers'
instructions; the time it takes a person to read your message comes before that, which is why we say
so rather than promise a figure counted from your send time. A stop can cover everything, one course or one
item in a course. For a course or
an item, we stop collecting it at once and remove stored copies, confirming when done. A stop is enforced
twice, independently: the extension stops requesting, and our servers refuse every upload. If you block the
header above, we treat that as a request to pause; we will not remove or disguise it.
Retention and deletion
Past-term content is destroyed 12 months after the course end date unless the student pins the course; an earlier version of a replaced file is kept for up to 14 days; a student can delete everything they hold with us at any time. Every student's data is encrypted under that student's own key, and deleting means destroying the key. Details: privacy.
Data flow
The student signs in to the course site as usual. The extension, in that browser, requests the pages and files that session can open, extracts text in the browser, removes e-mail addresses made of a student number, student-number shaped identifiers and phone numbers that its patterns recognise, and uploads text and metadata — never binaries, never cookies, never the session key — to the student's UniAGI account, stored in Australia (AWS, Sydney) and encrypted per student. The student's AI client, after the student signs in to UniAGI and approves categories on a consent screen, reads that copy through read-only tools; every answer states when the data was collected. Nothing is shared between students, nothing is used to train a model, and no person at UniAGI reads it.
Contact
- University IT, teaching staff, rights holders, takedown requests:
campus@uniagi.com.au - Security reports:
security@uniagi.com.au
On request we provide a threat model, a description written for a privacy impact assessment, a data classification map, our retention schedule, the rate limits we accept and the source repository.
/.well-known/security.txt
Contact: mailto:security@uniagi.com.au
Expires: 2027-04-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://uniagi.com.au/.well-known/security.txt
Policy: https://uniagi.com.au/campus
Last updated: 18 October 2026.