Privacy policy
In short: Toledo+ shows your own Toledo and KU Loket data differently, and that data stays in your browser. No tracking of who you are; just an anonymous daily ping you can turn off.
Which websites Toledo+ uses
Toledo+ only has access to these addresses (the host_permissions in its manifest):
toledo.kuleuven.beandultra.edu.kuleuven.cloud: Toledo and the Blackboard Ultra course pages.webwsp.aps.kuleuven.be: KU Loket, for your timetable, exams and shortcuts.cloud.timeedit.net: the personal timetable feed (iCal) KU Loket gives you, as a fallback when KU Loket itself can’t be reached.api.toledoplus.be: Toledo+’s own server (a Cloudflare Worker), only for the anonymous usage ping and feedback you send yourself.
When you download a file, your browser fetches it through Toledo’s own signed download links.
Your session
Toledo+ uses your existing, signed-in session in your own browser. It never sees or stores your password.
What Toledo+ reads
Exactly what Toledo and KU Loket already show you: your enrolments, notifications, unread mail (the count only), links, course content, announcements, deadlines and teachers’ names and e-mail addresses. From KU Loket: your classes (course, time, room, teacher), your exams and the link to your timetable feed.
From Ultra also your first name, only to greet you; it stays on your device and is never sent anywhere.
Grades and submissions are never read.
What Toledo+ writes back
Only when you ask for it, and only if Sync with Toledo is on: marking notifications as read, seen or dismissed. These go to Toledo’s own API. Toledo+ never writes to KU Loket.
Storage on your device
- Settings (language, appearance, nicknames, colours, your own deadlines …) in
chrome.storage.sync. If browser sync is on, your browser syncs them between your own browsers. - A cache of Toledo and KU Loket data, visit times and what you ticked off, in
chrome.storage.localon this device. - The search index for ⌘K: titles, kinds and folder paths of the items in your courses, without file contents. Only in
chrome.storage.local, never synced or sent anywhere. Turn it off or rebuild it in Settings → Search.
Anonymous usage ping and feedback
By default, Toledo+ sends one anonymous ping a day to https://api.toledoplus.be with exactly four things: a random install id (created at install, not linked to you), the Toledo+ version, the browser and the interface language. That tells us how many people use Toledo+ and which versions are still around.
- No name, no e-mail address, no student number and no Toledo or KU Loket data.
- Your IP address is not stored.
- Turn it off in Settings → About or right in the welcome card. Nothing is sent after that.
Feedback you send from Toledo+ goes to the same address. It only includes contact details if you fill them in yourself.
The server runs on Cloudflare Workers; Cloudflare processes the requests as the hosting provider.
What Toledo+ does not do
- No tracking of who you are: no analytics services, crash reporting, ads or third-party trackers.
- No third-party services, fonts or CDNs. All code ships inside the extension; the only server of its own is
api.toledoplus.befor the anonymous ping and feedback. - Your Toledo and KU Loket data is never shared with the developer, KU Leuven, other institutions or anyone else.
- No remote code: the extension never downloads or executes code.
Deleting your data
Settings → Data → Reset, or remove the extension (chrome://extensions → Remove). That deletes everything Toledo+ stored; nothing is stored anywhere else. The anonymous ping stops as soon as you turn it off or remove the extension.
This website
toledoplus.be is a static website on GitHub Pages. It uses no cookies, no analytics and no external fonts or scripts. As the host, GitHub may keep technical server logs (such as IP addresses) under its own privacy statement. The demo runs entirely in your browser with fake data and sends nothing anywhere.
Unofficial
Toledo+ is an independent student project and is not affiliated with KU Leuven, the institutions of the KU Leuven association or Blackboard/Anthology Inc. Your use of Toledo and KU Loket remains subject to KU Leuven’s own terms and privacy policy.
Questions
Ask in Discussions on GitHub. Security issue? See SECURITY.md. Changes to this policy are published on this page and in the repository.