Privacy Policy

Canvas to Notion: Web App & Chrome Extension

Last Updated: September 10, 2026

This Privacy Policy ("Policy") explains how Canvas to Notion ("we," "us," or "our") collects, uses, shares, and protects your personal information when you use our Chrome browser extension and related web services (the "Services"). By using the Services, you agree to the terms of this Policy.

1. Information We Collect

1.1 Personal Information

We collect the following personal information:

Email addresses: Used for Firebase authentication and account identification
Google account information: When using Google Sign-In, we collect your name, email, profile picture URL, and email verification status
Display names: Either provided during signup or derived from your email address
User IDs: Firebase-generated unique identifiers for account management

1.2 Canvas Academic Data

When you visit Canvas pages (*.instructure.com), our extension accesses:

Course information: Course ID, name, course code, and workflow state
Assignment data: Assignment ID, name, description, due dates, points possible, and HTML URLs
Enrollment data: Only courses from the last 4 months where you are actively enrolled as a student
Canvas session data: Accessed automatically when you visit Canvas pages

Important: We do NOT collect grades, private course content, or personal communications.

1.3 Authentication Tokens and Credentials

Firebase authentication tokens: ID tokens, refresh tokens, and custom tokens for extension communication
Google OAuth tokens: For secure authentication via Chrome Identity API
Canvas API tokens: Used to fetch your assignments and course data
Notion API tokens: Used to create and update content in your Notion workspace
Session cookies: Authentication cookies from canvastonotion.io domain

1.4 Technical and Usage Data

Extension usage data: When you interact with Canvas pages and sync assignments
Sync preferences: Your selected Notion page and sync settings
Error logs: Technical information for debugging (stored locally, not transmitted)
Performance data: Sync operation status and timing

1.5 Billing and Subscription Data

When you purchase a paid plan, we collect and store:

Plan and tier: Whether your account is on the free, Pro, or Lifetime plan
Stripe identifiers: Your Stripe customer ID, subscription ID, payment intent ID, and invoice ID
Subscription state: Subscription status, current billing period end date, and whether a cancellation is scheduled
Purchase and refund records: Lifetime purchase date, refund eligibility window, and refund date if a refund is issued

We do not collect or store your card number or full payment details. Payment card details are entered on and stored by Stripe, not by us.

2. How We Collect Your Data

Directly from you: When you authenticate, grant permissions, or configure settings
Automatically via extension: When you visit Canvas pages and the extension is active
From third-party APIs: Canvas and Notion APIs when syncing data
Through authentication: Google OAuth and Firebase authentication services
From Stripe: Subscription and payment status via secure webhooks when you start, change, or cancel a paid plan

3. Data Storage Locations

3.1 Local Storage (Chrome Extension)

Firebase authentication tokens and timestamps
User email, user ID, and profile information
Selected Notion page information and sync preferences
Canvas token identifiers
Authentication tokens (encrypted in production, plain text in development)

3.2 Firebase Realtime Database

User profiles linked to email addresses
Notion access tokens and workspace information
Account creation dates and last login information
Sync status and preferences
Billing and subscription records (plan tier, Stripe customer and subscription IDs, subscription status, billing period end, and purchase and refund dates)

3.3 Browser Cookies

Session cookies for authentication (authToken, sessionid)
Authentication state cookies (isAuthenticated) - production only
Cross-domain cookies for web app and extension communication

4. How We Use Your Data

We use your data to:

Sync functionality: Transfer Canvas assignments to your selected Notion database
Authentication: Verify your identity and maintain secure sessions
Data processing: Process and simplify Canvas assignment data, including removing HTML formatting from descriptions
Account management: Maintain your user profile and preferences
Technical support: Respond to support inquiries and troubleshoot issues
Service improvement: Analyze usage patterns to improve functionality (no external analytics services used)
Billing: Process payments, manage your Pro subscription or Lifetime access, issue refunds, and prevent duplicate or fraudulent charges
Transactional email: Send billing notifications such as upgrade, renewal, cancellation, refund, and failed-payment notices

5. Data Sharing and Third-Party Services

5.1 Required Third-Party Services

We share data with the following services to provide our functionality:

Vercel: Hosting for our web app and backend API (served from api2.canvastonotion.io)
Firebase (Google): Authentication, user profiles, and database services
Google (Gmail): Sending account and billing notification emails
Canvas API: Read-only access to your course and assignment information
Notion API: Write access to create and update content in your connected Notion workspace
Google OAuth: Authentication services and profile information
Stripe: Payment processing, subscription management, and refunds. We share your email address and a user identifier with Stripe; Stripe collects and stores your payment card and billing details under its own privacy policy.

5.2 Data Processing

Assignment and course data is sent to your connected Notion workspace
Authentication data is processed by Firebase/Google services
Data is transmitted to our backend services at api2.canvastonotion.io
HTML content is stripped from assignment descriptions before syncing
Billing events are received from Stripe via webhooks and stored on your user record

5.3 No Data Sales or Marketing

We do not sell, rent, or share your personal information with third parties for marketing purposes. We do not use behavioral analytics or advertising cookies.

6. Chrome Extension Permissions

Our Chrome extension requires the following permissions:

storage: Stores authentication tokens and user preferences locally in your browser
cookies: Accesses authentication cookies from our domain for secure login
identity: Uses Chrome Identity API for secure Google OAuth authentication
activeTab & tabs: Detects when you are on Canvas pages to enable sync functionality
scripting: Injects content scripts only on Canvas pages (*.instructure.com)
host permissions: Allows secure API calls to Canvas, Notion, and our backend services

7. Data Security and Retention

7.1 Security Measures

Encryption: HTTPS encryption for all API communications
Token security: Authentication tokens are encrypted in production and automatically refreshed every 50 minutes
Secure cookies: HttpOnly, Secure, and SameSite attributes on authentication cookies
Access control: Firebase security rules restrict database access to authenticated users only
Token expiration: Authentication tokens expire after 1 hour for security

7.2 Data Retention

User account data: Stored until account deletion or extension uninstall
Sync data: Assignment data retained only as long as needed for sync functionality
Authentication tokens: Automatically expire and are refreshed; cleared upon logout
Local storage: User data removed from local storage upon logout
Billing records: Retained as required for tax, accounting, and legal compliance (typically up to 7 years), even after account deletion

8. International Data Transfers

Our services are hosted in the United States through Vercel (frontend and backend, served from api2.canvastonotion.io) and Firebase, and payments are processed by Stripe in the United States. By using our Services, you consent to the transfer of your data to the U.S. and processing by third-party services. Your data may be subject to U.S. data protection laws and may be accessible to U.S. government authorities under applicable laws.

9. Your Rights and Control

You have the following rights regarding your data:

Access and deletion: Request access to or deletion of your personal data by contacting us (we may retain billing records as described in Section 7.2 where required by law)
Disconnect services: Disconnect Notion integration or log out at any time
Manage billing: View, change, or cancel your subscription, or request a Lifetime refund, from the Settings page
Revoke permissions: Revoke Google OAuth permissions through your Google account settings
Uninstall extension: Remove the extension entirely through Chrome settings to stop all data collection
Data portability: Request a copy of your data in a portable format

To exercise these rights, email us at canvastonotioninfo@gmail.com. We verify requests using your account email address.

9.1 Legal Bases for Processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

Performance of a contract: To provide the Services you sign up for, including authentication, syncing, and paid-plan features
Legitimate interests: To secure, maintain, and improve the Services, prevent fraud and abuse, and communicate with you about the Services
Legal obligation: To keep billing and tax records and to respond to lawful requests
Consent: Where we ask for it, such as certain optional communications; you may withdraw consent at any time

9.2 EEA and UK Rights

Subject to applicable law, you have the right to access, correct, delete, or receive a portable copy of your personal data; to restrict or object to certain processing; and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority. We do not use your data for automated decision-making that produces legal or similarly significant effects.

9.3 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access to or deletion of that information, to correct inaccurate information, and not to be discriminated against for exercising these rights. In the past 12 months we have collected the categories of personal information described in Section 1 and disclosed them to service providers (such as Firebase, Vercel, and Stripe) solely to provide the Services. We do not sell or share your personal information as those terms are defined under California law, and we do not knowingly collect or sell the personal information of anyone under 16.

10. Technical Implementation

For transparency, here are key technical details about our data processing:

Extension runs background scripts that maintain authentication state
Content scripts are injected only on Canvas pages (*.instructure.com)
Data is transmitted securely via HTTPS to Firebase and Notion APIs
Local storage is used for caching authentication tokens and user preferences
Background processing handles large sync operations
Cross-origin requests are restricted to authorized domains

11. Payments and Subscriptions

Paid plans (Pro and Lifetime) are sold and processed through Stripe. Your payment card details are entered on Stripe's checkout and stored by Stripe, not by us. We store the billing and subscription data described in Section 1.5 so we can provide paid features, manage renewals and cancellations, and process refunds.

Stripe processes your payment information as an independent controller under its own privacy policy. Lifetime purchases are refundable within 7 days of purchase; see our Terms of Service for details.

12. Children's Privacy

This extension is not intended for children under 13, and we do not knowingly collect personal information from anyone under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. Updates will be posted on our website and within the extension interface. The "Last Updated" date at the top of this policy indicates when it was last revised. For material changes, we may also notify you by email. Continued use of the Services after changes indicates your acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Email: canvastonotioninfo@gmail.com

We will respond to your inquiry within a reasonable timeframe.