◳Notion Widgets

Privacy Policy

Last updated: 2026-09-05

[YOUR LEGAL ENTITY NAME] ("we") operates Notion Widgets. This policy describes exactly what we store, why, and how to get it back or delete it.

What we store

  • Your Notion account identifier and workspace identifier, so we can recognise you when you sign in again.
  • An access token issued by Notion when you connect your workspace. It is encrypted with AES-256-GCM using a per-record key, which is itself wrapped by a master key held outside the database. A copy of our database alone does not reveal it.
  • For each widget you create: the widget type, the Notion database it points at, that database's title, your display configuration, a random public reference used in the widget URL, and a salted hash of the PIN. We never store the PIN itself.
  • Timestamps: when a connection or widget was created, last used, and revoked.

What we do NOT store

  • The contents of your Notion databases. Widget data is fetched from Notion on demand, held in memory to answer the request, and briefly cached in memory (tens of seconds) to stay within Notion's rate limits. It is never written to our database.
  • Your PIN in plaintext, anywhere.
  • Analytics or advertising identifiers. We set no tracking cookies.

Who else sees your data

  • Notion — we call Notion's API on your behalf using the token you granted.
  • Our hosting provider, which stores the database in [YOUR HOSTING REGION, e.g. EU (Frankfurt)].
  • No one else. We do not sell, rent, or share personal data.

Cookies and local storage

  • A signed, httpOnly session cookie keeps you logged in to the dashboard for up to 30 days. Signing out invalidates it server-side.
  • An embedded widget stores an opaque unlock handle in your browser's local storage so you do not re-enter the PIN on every page view. It is scoped to that one widget, expires, and stops working the moment the widget is rotated or its PIN changed. It is not your PIN.

Retention

  • Revoking a widget marks it revoked immediately; its URL stops working at once.
  • Disconnecting a workspace erases the stored Notion token and revokes every widget built on it.
  • Deleting your account removes your user record, connections and widgets. Encrypted backups roll off within 30 days.
  • Because Notion provides no way for us to revoke a token remotely, you should ALSO remove the integration in your Notion settings to be certain the grant is withdrawn on Notion's side.

Your rights

  • Export — download everything we hold about you as JSON from your dashboard, or at /api/account/export.
  • Deletion — delete your account and all associated records from your dashboard.
  • Correction, restriction and objection — contact us and we will action it.
  • To exercise any of these, or to complain, write to [[email protected]]. You also have the right to lodge a complaint with your local data protection authority.

Security

  • Tokens are encrypted at rest with envelope encryption; the master key is held separately from the database.
  • Widgets are PIN-gated, with server-side attempt limiting and lockout.
  • Widget pages may only be framed by Notion, and enforce a Content Security Policy that prevents injected script from sending data off-origin.
  • No system is perfect. If you believe you have found a vulnerability, please tell us at [[email protected]] before disclosing it publicly.