Privacy
Your copy, your key, your call.
Everything here describes our own copy and our own behaviour. It is written to be checked.
UniAGI is not affiliated with, endorsed by or connected to any university.
What UniAGI is
UniAGI lets your own AI assistant read your own course information: a browser extension, running in your Chrome with the session you are already signed in with, copies what you can already open on your university's course site into your own UniAGI account, and your AI reads it from there. It is read-only. It cannot submit work, post, enrol, message anyone, or start a quiz attempt.
What we hold is a copy of material you can already open, kept for your AI, encrypted with a key that only unlocks for you, deleted when you say so.
What leaves your browser, and what never does
| Leaves the browser | Never leaves the browser |
|---|---|
| Course list: id, code, shortname, name, term, link | The course site's session cookie (MoodleSession), any other cookie value, the university sign-in cookies |
| Course outline: sections, item names, types, links, visibility, week | The course site's session key (sesskey) |
Deadlines and calendar events, submission status (true/false/unknown) | File binaries (PDF, PPTX, DOCX) — only extracted text is uploaded |
| Assessment briefs, rubric criteria and levels, open/close/due | Quiz questions, answers, attempt pages — never fetched at all |
| Extracted text of files the student can open, plus name, size, mime, sha256, revision | Other students' submissions and grades, participant lists and grading views — those pages are never requested. Other students' forum posts, and their names as authors — never uploaded |
| Grades: item, grade, range, percentage, teacher feedback text | Any password (no password login exists) |
| Announcements from staff: title, staff name and role, date, text | Anything from a site other than the one course site |
| The student's own group status line and group name | Raw HTML, and any URL carrying a credential-shaped parameter |
Technical: the student's course-site user number, extension version, sync trigger, as_of, coverage, error classes | E-mail addresses made of a student number, student-number-shaped identifiers and phone numbers that our patterns recognise — removed in the browser before upload (every other e-mail address, staff addresses included, is kept) |
Marks and feedback are listed above before that part of the product is switched on for every account, so that this table never has to catch up with the product.
The text extracted from your course files is stored in your own encrypted space: it is encrypted with a key that unlocks only for your account, and it is never pooled with anyone else's.
Collecting the text of your course files is off until you turn it on: the extension shows this table once and waits for you to press Turn on materials sync. You can turn it off again in the extension or on your account page, for everything or for one course.
People mentioned in your course content
- Staff. Names and roles are kept as the course site shows them, because "the convenor said this, the tutor marked that" is the point of the product. E-mail addresses that appear in course text are kept unless they are made of a student number.
- You. Your own group status line and group name are kept.
- Identifiers in any text, whoever they belong to. E-mail addresses made of a student number, student-number-shaped identifiers and phone numbers that our patterns recognise are removed in your browser before anything is uploaded — from announcements, feedback, pages and the text of files alike. When that happens the count travels with the document, so your AI can tell you "a contact detail was removed" and where to open the original.
- Other students. Their submissions and grades, the participant list and every grading view are on pages the extension never requests. A forum's own page can list other students' posts and names, and replies can sit under a staff announcement: the extension opens those pages in your browser to record the forum's name and link and the staff posts, and uploads nothing written by another student. Discussion threads are not collected.
- What we cannot promise. The removal above works on patterns, and an e-mail address written with a name rather than a student number is not one of them: it stays, whoever it belongs to. A name or a detail a lecturer wrote inside a slide or an announcement is part of that text and stays in your copy; we do not read your content, so we cannot review it for you.
Marks and markers' feedback are the most sensitive thing we hold. They sit behind their own category that you can leave unapproved for any AI client; they never appear in our logs, diagnostics or test data.
How we use it — Limited Use
UniAGI's use and transfer of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use your course information only to answer your own AI assistant's questions. We do not sell it, do not use it for advertising, do not use it to train any model, and no person at UniAGI reads it — it is encrypted with a key that unlocks only for your account.
What we never do with it:
- share any of it between users — there is no pooled index, no shared cache and no "other students also read";
- train or fine-tune a model on it, ourselves or through anyone who processes data for us;
- publish it or serve it without sign-in — it is reachable only through the AI clients you approved, under your own grant;
- read anything your own session on the course site does not already show you;
- accept a credential from your university: no password, no cookie and no session key ever reaches us. The extension uses the course site's session key inside your browser, for the same read calls the site's own pages make; it never stores it and never sends it to us, and it has no permission to read cookies.
When you connect an AI client and approve categories for it, that client receives what it asks our tools for, and its own privacy terms apply from there. You choose the client, and you can disconnect it at any time on your account page.
How long we keep it
| What | Kept | Then |
|---|---|---|
| Current-term course content, announcements, feedback and marks | while the course is current | moves to the past-term clock |
| Past-term text of course files | 12 months after the course end date, unless you pin the course | shredded |
| Past-term outline, assessments, marks and feedback | 12 months after the course end date, unless you pin the course | shredded |
| An earlier version of a file that was replaced | up to 14 days (sooner if your older versions take up a lot of space) | shredded |
| Everything, when you ask | — | shredded immediately: Delete my data or Delete my account on your account page |
| Your sign-in identity after you delete your data | 12 months | purged |
The clock runs on our side, not in the extension, so an extension that is uninstalled, paused or broken cannot extend it. It counts from the course end date the course site gives; where our copy carries no end date it counts from the end of the term the course belongs to.
Deleting
Delete means shred, materials included: Delete my data on your account page destroys the encryption key for everything we hold for you — course lists, outlines, the text of your files, assessments, marks, feedback, announcements and the search index built from them — disconnects every extension and every AI client, and then removes the encrypted objects. Without the key the objects cannot be read by anyone, us included. Delete my account does the same and removes your sign-in.
What your AI can and cannot tell you
Every answer carries the time of the sync it came from and says what is missing. Your AI is told to speak about our copy, not about your university:
| When | Your AI says something like | It never says |
|---|---|---|
| a fact is not in what was captured | "I do not have this; it is usually on the course outline page" | "this is not in the university's system" |
| a file is listed and its text has not been captured yet | "that file is in the list but I have not got its text yet; another sync may bring it" | "there is nothing in that week" |
| we got no text out of some pages | "no text extracted from pages 4–6" | "these pages are images" |
| a file is over the automatic download size | "that file is too large to fetch automatically; you can fetch it from the extension" | "the file is unreadable" |
| a recording, an external tool or quiz content | "this connection cannot read that; here is the link" | "sync again" |
| the course lists an item the site would not open for your account | "here is the link; the site will show its own message" | "that item does not exist" |
| only part of your courses synced | names the missing courses | "nothing is due" |
| a category you did not approve | names the category and how to approve it | "nothing found" |
| a contact detail was removed from a text | "a contact detail was removed" | the removed detail |
The extension fetches files up to 24 MiB by itself; a larger one is listed, and you can fetch it from the extension yourself, one file at a time, up to 64 MiB. Archives, programs and password-protected files are recorded as refused, with the reason, and are not read.
Who we are
UniAGI is operated by UniAGI Pty Ltd (Australia).
Contact: security@uniagi.com.au.
Where it is stored and who processes it
Your data is stored in Australia, in the Sydney region of Amazon Web Services, encrypted with a key held in AWS's key service that unlocks only for your account. AWS also delivers the sign-in codes we e-mail you. Nobody else processes your data for us, and we do not send it outside Australia.
The AI client you connect is your choice, not our processor. It receives what it asks our tools for, and it may process that outside Australia — the companies behind the clients we support are based in the United States — under its own terms. If you would rather that did not happen for a category, leave it unticked for that client.
Your rights
We follow the Australian Privacy Principles whatever our size. You can see what we
hold per course on your account page, correct it by syncing again, stop collection by pausing, and delete
everything at any time. For anything else about your data, write to security@uniagi.com.au.
Complaints. If you think we have handled your information wrongly, write to the same address and say so; a person will answer. If our answer does not settle it, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
University staff, IT teams and rights holders: see the campus page and write to
campus@uniagi.com.au.
This website
This website uses Vercel Web Analytics: cookieless, aggregate page counts with no personal identifiers, so we can
see which pages are read. If you join the beta waiting list, we store the address you give us until we email you
about access or you ask us to delete it — write to support@uniagi.com.au and we will.
Last updated: 18 October 2026.