Privacy Policy

Canvas-Notion Assignment Sync — Last updated: September 10, 2026

Overview

Canvas-Notion Assignment Sync ("the Extension") is a Chrome extension that synchronizes assignment data from Canvas LMS to a Notion database. This policy describes what data the Extension accesses, how it is stored, and who it is shared with.

Data We Collect

The Extension collects and stores the following data, all provided directly by the user or retrieved from APIs the user has authorized:

• Canvas API token (optional) — stored only if you choose to provide one. By default the Extension authenticates to Canvas using your existing browser session and stores no Canvas credential.
• Notion integration token — used to authenticate requests to the Notion API
• Notion database ID — identifies which Notion database to sync assignments to
• Assignment data — titles, due dates, point values, submission statuses, grades, course names, and assignment descriptions retrieved from the Canvas API
• Notion page IDs — identifiers for synced pages, used to update existing entries instead of creating duplicates

The Extension also collects the limited usage and reliability analytics described below unless you turn it off. It does not collect browsing history or keystrokes, or track your activity on unrelated websites.

How Data Is Stored

• Any API tokens you provide are encrypted using AES-GCM 256-bit encryption with a unique 96-bit initialization vector before being saved to chrome.storage.local.
• Assignment data is cached locally in chrome.storage.local with a 30-day time-to-live. Expired entries are automatically removed.
• Credentials and the assignment cache are stored on your device. Assignment data is sent directly to your Notion database for syncing. Analytics is sent directly to Google; there is no server operated by the Extension developer in between.

Third-Party Services

The Extension communicates with these external services:

• Canvas LMS API (*.instructure.com, *.canvaslms.com) — to retrieve course and assignment data, authenticated with your existing Canvas browser session (or with a Canvas API token, if you provided one)
• Notion API (api.notion.com) — to create, update, and query pages in your Notion database using your Notion integration token
• Google Analytics 4 (www.google-analytics.com) — to measure setup completion, feature use, and sync reliability while analytics is enabled

Usage and Reliability Analytics

Analytics is on by default, including when existing users upgrade to the version introducing analytics. Turn it off at any time using "Share usage and reliability data" under Settings → Advanced in the Extension popup. Your choice is saved locally and survives updates. Turning analytics off attempts one final opt-out event with the random installation identifier and extension version, then stops analytics. This event contains no academic content or credentials. The installation ID stays on your device while analytics is off. Re-enabling reuses it to connect future activity with earlier activity; nothing is collected or replayed from the opted-out period. Clear All Data preserves both your installation ID and analytics preference.

Analytics includes installation/update events, popup and manual-sync usage, setup milestones and outcomes, which setting was edited (never its value), sync source, counts of created/updated/skipped/deleted assignments and errors, sync duration, and fixed error/skip categories. Events include the Extension version, a randomly generated installation identifier, and, for foreground activity, a session identifier. The Extension does not link these identifiers to your Canvas or Notion account. This is pseudonymous data, not guaranteed anonymous data.

Analytics never includes Canvas or Notion tokens, database or page IDs, names or email addresses, course names, assignment titles/descriptions, grades, URLs, raw error messages, or sync logs. Requests omit cookies and referrers. Google receives your IP address and ordinary network metadata when receiving an HTTPS request. See Google's Privacy Policy for its processing practices.

We use analytics to improve this Extension's setup and reliability. We do not sell this data or use it for advertising. Requests explicitly deny advertising use and personalization. Turning analytics off cancels pending sends, clears the active session and activity checkpoints, and attempts one final opt-out event. No further analytics are sent while off. The installation identifier is retained locally and reused when analytics is turned back on; Clear All Data also retains this identifier and your analytics preference.

Data Retention and Deletion

• Cached assignment data expires automatically after 30 days.
• "Clear All Data" deletes locally stored credentials, configuration, cached data, and analytics session/activity state, while preserving your installation ID and current analytics preference. If analytics was on, it remains on with the same identifier; if it was off, it remains off.
• Event-level and user-level analytics retention is set to 14 months. New activity resets the retention period for the user identifier, so identifiers for returning installations may be retained longer than 14 months. Aggregated reports may be retained longer. Clearing local data, opting out, or uninstalling does not delete analytics already received by Google.
• Uninstalling the Extension removes all locally stored data.

Permissions

The Extension requests the following Chrome permissions:

• storage — to persist encrypted credentials, cached data, preferences, and analytics identifiers
• activeTab — to interact with Canvas LMS pages
• scripting — to inject the content script into Canvas pages
• alarms — to run periodic background syncs (every 30 minutes)
• notifications — to display sync status notifications
• Host access to *.instructure.com, *.canvaslms.com, and api.notion.com — to communicate with the Canvas and Notion APIs
• Host access to www.google-analytics.com — to send the optional usage and reliability events described above

Children's Privacy

The Extension is not directed at children under the age of 13 and does not knowingly collect personal information from children.

Changes to This Policy

If this privacy policy is updated, the revised version will be posted at this URL with an updated date. Continued use of the Extension after changes constitutes acceptance of the revised policy.

Contact

If you have questions about this privacy policy, please open an issue on the GitHub repository.