Student360 Connector — Privacy Policy

Last updated: 2026-07-28

The Student360 Connector extension connects your Ben-Gurion University (BGU) account to Student360. It is designed around one principle: your BGU password never leaves your device.

What the extension does

When you click “connect” in the extension panel and enter your BGU username and password:

1. The password is used only inside the extension’s background service worker, in function scope, to mint a Moodle web-service token (wstoken) by calling BGU’s own login/token.php endpoint directly from your browser.
2. Only the resulting token (not the password) is handed to the open Student360 tab and sent over HTTPS to Student360’s server, which verifies it against BGU and stores it encrypted.
3. The password used for this step is discarded from memory the moment the connect action finishes. It is never sent to Student360 in any network request, and never logged.

For the BGU Student Portal and Minhal (academic records), the extension reads the data client-side, in your browser, reusing your existing BGU session cookies, and sends only the resulting schedule/records to Student360. Those scrapes also never transmit your password to Student360.

Separately — and distinct from the connect flow above — your password is also cached locally on your device to support silent session refresh and auto-login (both described below). That cache never leaves your device either.

Auto-fill sign-in on BGU sites (auto-login)

Once connected, the extension can automatically fill in and submit your stored BGU username, password, and ID number on BGU login pages — Minhal, the Student Portal, Moodle, and the exam-booklet system (gezer1.bgu.ac.il) — so you don’t have to retype them. This is on by default. You can turn it off, per BGU site, from the toggle in the extension’s side-panel footer at any time; turning it off takes effect the next time you load that site.

Bulk course-material download

From the Student360 website (not the extension), you can sync your current Moodle course files to a folder on your own computer. The extension’s only role is to fetch the file bytes from Moodle (using your token) and hand them to the page, which writes them straight to your chosen folder using your browser’s own file-access permission. Nothing is uploaded to Student360 and no record of which files you downloaded is kept anywhere but your own disk (a small manifest.json file the browser writes next to the downloaded files).

Minhal document downloads

On request, the extension can fetch 5 academic documents from BGU Minhal: transcript, exam schedule, enrollment confirmation, registration printout, and time-extension letter.

• Transcript and exam schedule are also sent to Student360’s server, because sync features (grades, exam calendar) depend on them.
• Enrollment confirmation, registration printout, and time-extension letter are saved straight to your computer’s Downloads folder. They never reach the Student360 page or server.

What data the extension handles

• BGU password — used transiently in memory to mint the Moodle token; never persisted or transmitted to Student360. Separately, a copy is cached on your device only so the extension can silently re-log-in when a BGU session expires and can auto-fill BGU login forms (see above): an AES-GCM-encrypted copy in chrome.storage.local (persists on disk until you disconnect or remove the extension) and a decrypted copy in chrome.storage.session (memory only, cleared when the browser closes). The encryption key ships inside the extension itself, so this protects against casual inspection of your files but not against someone with access to your unlocked device.
• Moodle wstoken — transmitted over HTTPS to Student360 and stored encrypted server-side. This is the credential Student360 uses to sync your courses.
• Schedule / academic records — read in-browser and sent to Student360 (your own data, shown back to you in the app).
• Downloaded documents & course materials — Minhal PDFs and bulk-synced Moodle files are written directly to your computer; most never reach Student360 at all (see above for the two Minhal documents that are the exception).
• Throttle timestamps — small “last refreshed at” timestamps in chrome.storage to avoid re-scraping too often. No personal data.

What the extension does NOT do

• No analytics, no tracking, no telemetry, no third-party SDKs.
• No advertising; no selling or sharing of any data.
• No access to any site outside the narrow host list below.

Host permissions (why each is needed)

• moodle.bgu.ac.il — mint + use the Moodle token.
• portal.bgu.ac.il — read your class schedule.
• bgu4u22.bgu.ac.il, reports4u22.bgu.ac.il — read your Minhal academic records (must run from your IP).
• gezer1.bgu.ac.il — auto-fill and submit the exam-booklet login form using your stored credentials (auto-login, see above); no other data is read from this site.
• student360-platform.com — hand the verified token/data to the open Student360 tab, same-origin.
• spike-platform.com — the platform’s former domain (Student360 migrated from it). Still listed because it remains in the extension’s host list; it is not a third party.

The extension requests no webRequest permission and does not intercept request bodies.

Children’s data

Student360 is intended for university students. It is not directed at children under 13, and we do not knowingly collect data from children under 13.

Data retention & deletion

The extension itself retains: throttle timestamps (no personal data) and the locally-encrypted BGU-password cache described above. Both are cleared by removing the extension; the password cache is also cleared automatically the moment Student360’s server reports your account as disconnected. Data sent to Student360 is governed by the Student360 privacy policy and can be deleted via the in-app account-deletion flow, which removes your stored token and synced data.

Contact

Questions: support@student360-platform.com

For product problems (sync failures, reconnect issues), see Student360 support.