For IT and Workspace administrators

Approving DuePilot for your domain

A student at your school asked for DuePilot to be reviewed. This page is the whole answer: every permission it requests, every permission it deliberately does not, and the two minutes of clicking that approves or denies it.

What it is

DuePilot collects a student's assignments from their own learning platforms into one list, estimates how long each will take, and writes study notes and practice questions for them. It is used by the student, on their own account. There is no teacher-facing product, no classroom management, and nothing that writes to your systems.

What it reads, and what it never reads

Requested

classroom.courses.readonly
the names of the student's own classes
classroom.coursework.me
their own assignments and due dates
classroom.student-submissions.me.readonly
whether they have handed their own work in
classroom.courseworkmaterials.readonly
materials attached to their own coursework
classroom.announcements.readonly
class announcements

Never requested

No roster access. No rosters, profiles, students or teachers scope, so it cannot read any other student's name or email.
No Drive. No drive.readonly, so it never sees a file.
No guardian data.
No write access that is ever used. It never submits, turns in, un-submits, creates, edits, deletes or grades anything.

One honest note on that last point. Google's catalogue currently does not offer the read-only variant of the coursework scope, so the consent screen says DuePilot can "see, create and edit coursework items". It never does. The build fails if any code calls a write method, and a second test fails the build if any code calls an endpoint those scopes forbid. The narrower scope will be adopted the day Google publishes it.

Where data goes

Assignment titles and due dates, for that one student, to show them their week.
Nothing is sold, and nothing is used to train a model. Material from Google Classroom is only ever sent to an AI provider that is contractually barred from training on it, and the app refuses to send it otherwise.
A student can delete their account and everything in it from inside the app, in one action, with no email to anybody.
Rankings between students share one 0–100 number per class with no name attached, and only between students who have each added the other.

Full detail: the privacy policy.

How to approve it

In the Google Admin console, at admin.google.com:

Security → Access and data control → API controls → Manage third-party app access.
Add app → OAuth App Name or Client ID.
Paste the client ID below, select DuePilot, and choose the organisational units it applies to.
Set it to Trusted, or to Limited with the Classroom scopes listed above. Either works.

App name:   DuePilot
Client ID:  72957368482-k5tqppl8tu57mdvjmndg6dndbp1q2ffk.apps.googleusercontent.com
            72957368482-runq8uvinlpd1srpfang696589j0bkf3.apps.googleusercontent.com
Project:    duepilot-510004
Contact:    [email protected]

Two client IDs because the desktop app and the iPhone app sign in separately. Approve both and DuePilot works on every device a student owns; approve one and it works on that one.

Or do it in one upload

The same screen takes a CSV, which is Google's own recommended route when an app has more than one client ID. Save this as duepilot.csv and use Bulk upload. Change / to an organisational unit path to scope it, and trusted to limited or blocked to change the decision.

type,id,ou,access
oauth,72957368482-k5tqppl8tu57mdvjmndg6dndbp1q2ffk.apps.googleusercontent.com,/,trusted
oauth,72957368482-runq8uvinlpd1srpfang696589j0bkf3.apps.googleusercontent.com,/,trusted

Both client IDs belong to the same OAuth-verified brand, so they appear together in your console under DuePilot rather than as two unrelated apps.

If the answer is no

That is a legitimate answer and DuePilot does not work around it. Students at your school can still use the app by exporting their own Google Calendar, which brings in their classes and due dates without any third-party app access at all. Nothing on our side attempts to detect, evade or re-request a domain that has declined.

Questions

Email [email protected]. A person answers, and we will put anything you need in writing.

DuePilot · getduepilot.com · Privacy · Support