BoilerSpace — Privacy Policy
Last updated: 3 September 2026 · applies to version 2.1.3 and later
BoilerSpace does not collect, transmit, or sell any data. There is no server, no analytics, and no third party. Everything the extension reads stays in your own browser.
That is the whole policy. The rest of this document explains precisely what it reads, what it keeps, and why — because "we don't collect anything" is easy to write and worth being specific about.
What BoilerSpace reads
BoilerSpace runs only on Brightspace pages: *.brightspace.com, plus any additional site you explicitly grant it from the extension's popup (see Permissions).
On those pages it reads:
- The page itself — to restyle it. Course names, grades, assignment titles and due dates pass through the extension's code so it can lay them out, colour them, and group them. None of this leaves the page.
- Brightspace's own API, using the session you are already signed in with:
| Endpoint | Used for |
|---|---|
/d2l/api/lp/1.25/enrollments/myenrollments/ | the list of your courses |
/d2l/api/le/1.25/calendar/events/myEvents/ | upcoming deadlines |
/d2l/api/le/1.25/{course}/content/root/ | locating an assignment's module |
/d2l/api/le/1.25/{course}/content/modules/{id}/structure/ | which items in a module can be opened in place |
/d2l/api/le/1.25/{course}/content/topics/{id} | confirming that match |
/d2l/api/le/1.25/{course}/dropbox/folders/{id}/submissions/ | whether you have submitted |
/d2l/api/le/1.25/{course}/dropbox/folders/ | the due date set on each assignment |
/d2l/api/le/1.67/{course}/quizzes/ | the due date set on each quiz |
/d2l/lms/quizzing/user/quizzes_list.d2l | how many quiz attempts you have used |
These are the same requests Brightspace makes for you. They go to your institution's Brightspace server and nowhere else.
The last of those is a page rather than an API call. Brightspace does not let a student read their own quiz attempts through its API — it answers "not authorized" — so the count is read from the quiz list page that Brightspace already shows you. It is requested in the background, read for the attempt numbers, and discarded; nothing from it is stored.
BoilerSpace makes no requests to any other host. It loads no remote scripts, fonts, or images.
Opening an item in place
Expanding an item on a content page loads that item's own Brightspace page inside a frame on the page you are already on, at the same address your browser would go to if you clicked it. Nothing is copied, proxied, or sent anywhere: it is the same request to the same server, made in the same session. The extension reads that frame only to hide the parts that repeat the row above it — the navigation, the duplicated title — and closing the item removes the frame.
What BoilerSpace stores
All of it is local to your browser.
In extension storage (chrome.storage.local):
| Key | Contents |
|---|---|
settings | your seven toggle choices |
cachedDeadlines | upcoming deadlines (title, due date, course), refreshed every 15 minutes |
bbSubmissions | whether each assignment has a submission, for 10 minutes |
bbModuleLinks | which content module an assignment belongs to |
bbHiddenDeadlines | overdue items you have chosen to hide from the panel |
bbMarkedDone | items you have marked done yourself, such as a group project someone else submitted |
In the page's own storage: a cached copy of your course list, so the dashboard does not re-fetch it on every load.
Uninstalling the extension removes everything in extension storage. The page cache is cleared with your normal browsing data for that site.
About the session fingerprint
Two people who use the same browser profile must not be shown each other's cached course list. To prevent that, BoilerSpace takes the session identifier Brightspace already puts on the page, runs it through a short non-reversible hash, and uses the result purely as a name for the cache.
The identifier itself is never stored and never transmitted. The hash is 32 bits — far too small to reconstruct anything from, which is exactly what is wanted here: it needs to distinguish two sessions, not identify one.
What BoilerSpace never does
- No data is sent to the developer or to any third party.
- No analytics, telemetry, crash reporting, or usage tracking.
- No advertising, and no sale or transfer of data to anyone.
- Nothing is read on any site other than the Brightspace pages listed above.
- No credentials are read, stored, or handled. BoilerSpace uses the session you already have; it never sees a password.
- Your data is not used to train anything.
Permissions
| Permission | Why it is needed |
|---|---|
storage | to remember your toggle settings and the caches above |
activeTab | so the popup can tell whether the tab you are looking at is a Brightspace page that needs to be enabled |
scripting | to start running on a self-hosted institution once you grant it |
declarativeNetRequest | to open course PDFs in a tab instead of downloading them, by adjusting a response header on PDF files served under /d2l/ |
*://*.brightspace.com/* | the domain D2L hosts most institutions on |
*://*/d2l/* (optional) | not granted at install. Many universities run Brightspace on their own domain. If you use one, the popup offers to enable BoilerSpace for that single site, and it only ever applies to sites you have approved. |
Children
BoilerSpace is a utility for students using their own institution's learning platform. It collects nothing from anyone, of any age.
Changes
Material changes to this policy will be published here alongside a version bump. Because the extension has no server, a change in what it does can only reach you through an extension update, which Chrome shows you.
Contact
Questions or concerns: open an issue at https://github.com/HonzikChoutka/boilerspace-privacy/issues.
BoilerSpace's source is not public. This policy describes what the published extension does; the package on the Chrome Web Store is the authoritative artefact, and Chrome shows you any update before it installs.
BoilerSpace is an independent project. It is not affiliated with, endorsed by, or sponsored by D2L Corporation or Purdue University. "Brightspace" and "D2L" are trademarks of D2L Corporation; "Purdue" and "Boilermakers" are trademarks of Purdue University. They are used here only to describe what this extension works with.