Chrome Extension

Privacy Policy

ITATS Extension · Last updated: October 13, 2026

Overview

ITATS Extension is a Chrome extension for students of Institut Teknologi Adhi Tama Surabaya (ITATS) who use classroom.itats.ac.id. It fills in attendance, turns photos or documents into PDFs for assignment uploads, and names assignment files automatically.

Some features run entirely in your browser, others go through our server:

Attendance, Request Mode (default): The extension sends an attendance request to our server, and the server fills in attendance on Classroom on your behalf. This mode is on from the moment you install the extension. You can turn it off with the “Gunakan Request” option in the settings.
Attendance, Manual Mode: Runs in your browser. The extension opens each unfilled class one at a time (up to 15 classes per run), picks an answer, and clicks the save button, the same steps you would take yourself. This mode sends nothing to our server.
Foto → PDF (Photo to PDF): The extension combines photos or images (JPG, PNG, WebP, GIF, BMP, AVIF, SVG, and other formats your browser can read) into one PDF in your browser and does not send the images to our server. The PDF goes into the assignment upload form, and you press Kirim Tugas yourself.
Dokumen → PDF (Document to PDF): The extension sends the Word, Excel, or PowerPoint file you pick to our server. The server passes it to Adobe PDF Services for conversion, and the extension puts the resulting PDF into the assignment upload form.
Automatic file renaming: The extension builds the assignment file name from the parts you choose: the original file name, NPM, name, course, or class. This happens in your browser.

Data processed on your device

Extension settings: Default attendance answer, auto-run, notifications, step delay, navbar and button display, Request Mode, the Foto → PDF and Dokumen → PDF buttons, and the file name layout. The extension stores these in chrome.storage.sync. If Chrome sync is on, Google syncs them to your Chrome account.
NPM and name: The extension reads your NPM and name from your Classroom profile page to show them in the settings and use them in file names. It keeps a copy in chrome.storage.local and does not send it to our server.
Classroom page content: The extension reads the class list, attendance forms, assignment upload forms, and course and class names on classroom.itats.ac.id. It runs only on that domain.
Images for Foto → PDF: The extension processes images in browser memory and does not keep them after the PDF is built.
Temporary attendance status: The list of classes already processed and the Manual Mode queue in the current tab. The queue holds class names and addresses, the attendance answer, and the result for each class. The extension keeps both in sessionStorage and deletes the queue once the run finishes or stops. All of it is cleared when you close the tab.

Data sent to our server

Our server runs on Supabase. Request Mode, Dokumen → PDF, and the server status check on the settings page use it. The extension handles the following data:

Anonymous account: The first time it contacts the server, the extension creates an anonymous Supabase Auth account with no email, name, or password. It stores the access token, refresh token, anonymous user ID, and expiry time in chrome.storage.local.
Classroom session cookies: Request Mode and the verification for Dokumen → PDF need access to Classroom on your behalf. For that, the extension reads your classroom.itats.ac.id login cookies (classroom_itats_session, laravel_session, XSRF-TOKEN), encrypts them on your device with RSA-OAEP-256 and AES-256-GCM, and sends them to the server. Only the server can decrypt them. The server uses the cookies in memory while the request runs, and never stores, logs, or sends them back.
Student identity: The server reads your NPM and name from your Classroom profile page to confirm that the Classroom session being used belongs to you. It stores your NPM as part of the verification session. The server sends your name back to the extension only and does not store it.
Attendance request data: If you start attendance from a class page, the extension sends that page's address (including the class token, if there is one). From any other Classroom page, it sends the address of the Classroom home page. It also sends your attendance answer value (1 to 4). The server returns a per-class result summary to the extension without storing it.
Documents for Dokumen → PDF: The contents of the DOC, DOCX, XLS, XLSX, PPT, or PPTX file you pick (up to 15 MB) and its file type. The extension does not send the file name. The server passes the file to Adobe PDF Services, then keeps the resulting PDF until the extension downloads it.

The server stores the following data in Supabase's database and storage:

Verification session: Anonymous user ID, NPM, verification time, expiry time (2 hours after verification), and last-active time.
Duplicate-submission records: Anonymous user ID and a SHA-256 hash of the user ID, class token, week, and lecture type combined, with its status and processing times.
Rate-limit records: One record per request, holding the limit type, a SHA-256 hash of the user ID, IP address, or request ID, and the request time. Our code does not store raw IP addresses.
Document conversion records: Anonymous user ID, file type and size, a SHA-256 hash of the IP address, status, page count and size of the resulting PDF, error code, and processing times. The server does not store the document contents in the database.
Converted PDFs: PDF files in a private Storage bucket. The server hands each one only to the anonymous account that requested that conversion.

How long the data is kept:

Verification session: deleted 7 days after it expires.
Duplicate-submission records: completed records are kept for up to 180 days. Records that never completed are deleted after 1 day.
Rate-limit records: deleted after 1 day.
Document conversion records: deleted after 30 days.
Converted PDFs: deleted as soon as the extension downloads them. PDFs that are never downloaded are deleted after 15 minutes.
Files at Adobe: the server deletes them from Adobe right after conversion. If that deletion fails, Adobe deletes them on its own after 24 hours.
Anonymous account: stays in Supabase Auth until you ask us to delete it.

The server runs this cleanup when it receives requests, not on a fixed schedule. Data can therefore stay longer than the limits above until the next cleanup runs.

How the data is used

We use the data only to:

run the attendance and document conversions you ask for,
confirm that the Classroom session being used belongs to you,
keep the same attendance from being submitted twice, and
prevent abuse of the service.

We do not sell the data, use it for advertising or profiling, or share it with anyone other than the service providers listed below. The use of information received by this extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Data not collected

The extension does not collect passwords, browsing history, location, or contacts, and it does not read data from any site other than classroom.itats.ac.id.

Third-party services

Supabase: Provides the server, anonymous authentication, database, and storage for Request Mode, Dokumen → PDF, and the server status check. As an infrastructure provider, Supabase may keep technical logs such as IP addresses. Supabase's own privacy policy covers those logs.
Adobe PDF Services: Converts documents to PDF, only when you use Dokumen → PDF. Adobe receives the document contents from our server, not directly from your browser. Adobe's privacy policy covers its processing.
Google Fonts: The popup and settings pages load fonts from fonts.googleapis.com and fonts.gstatic.com. When the fonts load, Google receives your IP address and browser information.
jsDelivr and cdnjs: The settings page loads the Bootstrap stylesheet from cdn.jsdelivr.net and Font Awesome icons from cdnjs.cloudflare.com. When these files load, those CDN providers receive your IP address and browser information.
Chrome Sync: Used for extension settings, only if you have turned it on in Chrome.

Permissions used

storage: to save settings, the anonymous account token, and the NPM and name used for file names on your device.
tabs: to find or open the Classroom tab when you click the extension icon, and to tell which Classroom tab sent a request to the server.
cookies: to read classroom.itats.ac.id login cookies. This permission is used in Request Mode and during verification for Dokumen → PDF.
Host access to classroom.itats.ac.id: to run the extension's scripts on Classroom pages.
Host access to csctwkgmfezyvlfzcinp.supabase.co: to talk to our server.

Security

All communication uses HTTPS. The extension also encrypts session cookies on your device before sending them.
The server rejects requests without a valid anonymous account token. Attendance through the server also needs an active verification session whose NPM matches the Classroom profile.
The server processes each encrypted request only once (replay protection).
The server limits the number of requests and conversions per user and per IP address.

Even so, no system is completely free of risk.

Your choices

Turn off Request Mode in the settings. Attendance then runs in your browser, and the extension stops sending Classroom cookies for attendance.
Hide the Dokumen → PDF button in the settings if you do not want documents sent to our server.
Press the reset button on the settings page to clear your extension settings.
Uninstall the extension to remove all data it stored on your device.
Log out of Classroom so the session cookies that were used stop working.
Email us your NPM to ask us to delete your data on the server.

While the settings page is open, the extension checks the server status every 30 seconds, even with Request Mode off. This check uses the anonymous account and sends no cookies or Classroom data.

Changes to this policy

We may update this policy when the extension changes. The date of the latest update is always shown at the top of this page.

Contact

If you have questions about this privacy policy, contact us at support@itats-extension.web.id