Notion
Notion collects extensive data about you by default, including your IP address, device identifiers, location, and browsing behavior, and shares that information with ad networks, third-party analytics firms, and data brokers — with limited ability on your part to stop it. Your data may be stored indefinitely anywhere in the world, can be handed over to law enforcement at Notion's discretion, and could be sold outright if the company is acquired or goes bankrupt. If you use a work email, your employer can read your workspace content and Notion may purchase additional personal data about you from outside sources. Accepting these terms is largely automatic — continuing to use the service after any policy update counts as agreement, and there is no self-service way to delete your account or data.
Last analyzed
Heads up: this analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original document before you agree — see our Terms.
Clause-by-clause breakdown
Every clause we flagged in Notion's agreement, with what it means for you.
Your data is kept indefinitely with no clear end date.
“We store the information we receive as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.”
Quoted verbatim from the agreement What this means: Notion keeps your data for as long as you use the service, and then for an undefined additional period to cover a broad list of business purposes. There is no maximum retention period stated, and the listed purposes — such as 'pursue legitimate business purposes' — are vague enough to justify keeping data almost indefinitely. This means your information may never be fully deleted even after you stop using the service.
What you can do: Submit a formal deletion request to [email protected] and ask Notion to confirm what data, if any, is retained after deletion and under which specific legal basis.
Using Notion after a policy update means you automatically agree to it.
“We may revise this Privacy Policy from time to time in our sole discretion. If there are any material changes to this Privacy Policy, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use the Services after the new Privacy Policy takes effect.”
Quoted verbatim from the agreement What this means: Notion can change its privacy rules whenever it wants, and simply continuing to use the app counts as your agreement to the new terms. You won't be asked to actively confirm you accept the changes — just logging in after an update is treated as consent. This means your rights can be reduced without you ever clicking 'I agree.'
What you can do: Watch for policy-change emails from Notion and review the updated policy before using the service again after any change notification.
Notion shares your browsing data with ad networks by default.
“In using the Website or Services, we may allow select third party advertising technology partners to place Technologies on the browser of your device to collect information about you as discussed above. These third parties (e.g., ad networks and ad servers) may use this information to serve relevant content and advertising to you as you browse the Internet, and access their own Technologies on your browser to assist in this activity. Request restriction on selling or sharing of "personal information": As explained in the "Information Automatically Collected" section above, we provide information about your device and online browsing activities to third-party advertising providers for targeted advertising and related purposes, so that we can provide you with more relevant and tailored ads regarding our Services. The disclosure of your information to these third parties to assist us in providing these services may be considered a "sale" of personal information under applicable law or the processing/sharing of personal information for targeted advertising purposes.”
Quoted verbatim from the agreement What this means: Notion shares your device identifiers, browsing patterns, and online activity with ad networks and ad servers. This sharing may legally qualify as a 'sale' of your personal data. While an opt-out link exists at the bottom of the website, the default is for this sharing to happen unless you actively opt out.
What you can do: Click the 'Do Not Sell or Share My Info' link in the footer at www.notion.com, and enable the Global Privacy Control (GPC) in your browser, which Notion says it will honor.
Notion tracks your activity across your devices and other websites.
“Cross-Device Tracking: Your browsing activity may be tracked across different websites and different devices or apps. For example, we may attempt to match your browsing activity on your mobile device with your browsing activity on your laptop. To do this our technology partners may share data, such as your browsing patterns, geo-location and device identifiers, and will match the information of the browser and devices that appear to be used by the same person.”
Quoted verbatim from the agreement What this means: Notion and its technology partners track you across multiple devices — linking your phone activity to your laptop activity — and across different websites you visit. This builds a detailed profile of your behavior beyond just your use of Notion. Geo-location data is also shared with these partners as part of this matching process.
What you can do: Opt out via the 'Do Not Sell or Share My Info' footer link and use browser-level privacy tools or a VPN to limit cross-site tracking.
Your data can be sold if Notion is acquired or goes bankrupt.
“Disclosure in the Event of Merger, Sale, or Other Asset Transfer: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of some or all assets, or transition of service to another provider, then your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.”
Quoted verbatim from the agreement What this means: If Notion is acquired, merges with another company, or goes through bankruptcy, your personal data can be sold or transferred to the new owner. You have no right to object to or opt out of this transfer. The new owner may have very different privacy practices.
What you can do: There is no direct action to prevent this. If Notion is ever sold, monitor communications from the company and review the new owner's privacy policy.
Deleting your data requires contacting Notion manually, not a self-service tool.
“Request Deletion of your information, subject to certain exceptions prescribed by law.”
Quoted verbatim from the agreement What this means: Notion acknowledges a right to request deletion of your data, but it is subject to exceptions. The policy does not describe a self-service deletion tool — it implies you must contact Notion to make this request. The process and timeline are not specified in the provided documents.
What you can do: Contact Notion at [email protected] to submit a data deletion request. Be aware that some data may be retained under legal exceptions.
Notion can share your data with law enforcement on its own judgment.
“Disclosures to Protect Us or Others: We may access, preserve, and disclose any information we store in association with you to external parties if we, in good faith, believe doing so is required or appropriate to: (i) comply with law enforcement or national security requests and legal process, such as a court order or subpoena; (ii) protect your, our, or others' rights, property, or safety; (iii) enforce our policies or contracts; (iv) collect amounts owed to us; or (v) assist with an investigation and prosecution of suspected or actual illegal activity.”
Quoted verbatim from the agreement What this means: Notion can hand over any of your stored data to law enforcement, government agencies, or other external parties based on its own 'good faith' judgment — not just when legally compelled by a court order. The phrase 'national security requests' is particularly broad and could include requests that bypass normal legal process. There is no mention of notifying you when this happens.
What you can do: Be mindful of what sensitive information you store in Notion, as it can be disclosed to authorities without a court order if Notion deems it appropriate.
Your employer can read your workspace content if you used a work email.
“Managing Workspaces for Organizations: If you register a Notion account or associate a Notion account with an email address provisioned by your organization, Notion may share information about you and any Workspaces owned or managed by you with your organization. Such information could include your name, email address, and profile picture, as well as the Workspace name, Workspace ID, membership size, creation date of your Workspace, email address, and content within your Workspace with your organization.”
Quoted verbatim from the agreement What this means: If you signed up for Notion using a work email address, your employer can access not just your profile details but also the actual content inside your Notion workspaces. This applies even if you use that workspace for personal notes. The only way to prevent this is to move your account to a personal email address.
What you can do: If you use a work email for Notion but store personal content, transfer your account to a personal email address by following the instructions at https://www.notion.so/help/account-settings.
Your data may be stored in countries with weaker privacy laws.
“All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live. When we engage in such transfers, we endeavor to safeguard your information consistent with the requirements of applicable laws.”
Quoted verbatim from the agreement What this means: Your data can be moved to and stored in any country, including countries with weaker privacy protections than your home country. Notion says it tries to follow applicable laws during these transfers, but provides no specific guarantees or mechanisms beyond that general statement in this section.
What you can do: EU/UK users can check Notion's Data Privacy Framework certification at https://www.dataprivacyframework.gov/ for details on transfer safeguards.
Third-party analytics firms track you under rules Notion can't control.
“Analytics: We may also use third-party service providers to collect and process analytics and other information on our Website or Services. These third-party service providers may use Technologies to collect and store analytics and other information. They have their own privacy policies addressing how they use the analytics and other information and we do not have access to, nor control over, third parties' use of cookies or other tracking technologies.”
Quoted verbatim from the agreement What this means: Notion uses third-party analytics companies that operate under their own privacy policies, which Notion says it cannot control. This means your usage data is governed by rules Notion itself doesn't oversee. You would need to review each third party's policy separately to understand how your data is used.
What you can do: Review Notion's Cookie Notice (linked in the policy) to identify which analytics providers are used, and opt out of their tracking directly where possible.
Notion buys extra data about work-email users from data brokers.
“In addition, if you register a Notion account or associate a Notion account with an email address provisioned by your organization, we may obtain information from third party data enrichment providers to help us to better tailor business-to-business marketing and sales outreach to you.”
Quoted verbatim from the agreement What this means: If you signed up with a work email, Notion buys additional information about you from data enrichment companies to improve its sales and marketing targeting. This happens without your explicit consent and supplements what you directly provided. You may not know what data these third parties hold about you.
What you can do: Contact [email protected] to ask what data enrichment providers Notion uses and to request that your enriched data be deleted.
Notion Mail reads your full Gmail content and contacts.
“Gmail API, Directory API, Workspace API, and Calendar API user data: To provide the Notion Mail Services to you: (a) we receive and send your email message content through the Gmail API; (b) we receive and process your contact and reply suggestions through the Directory API; (c) we receive your workspace member contact data through the Workspace API; and (d) receive your event response data (e.g. yes, no, maybe) through the Calendar API. All of this data from Google is processed to provide the requested Notion Mail functionality to you. Notion only processes Workspace API user data to provide the Notion Mail Services. We do not process Workspace API user data to develop, improve, or train generalized AI and/or ML models. Notion Mail's use of the Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.”
Quoted verbatim from the agreement What this means: If you use Notion Mail, Notion accesses the full content of your Gmail messages, your contacts, and your calendar responses. Notion explicitly commits not to use this Google data to train AI or ML models, which is a meaningful protection. However, the breadth of access — full email content plus contacts plus calendar — is significant and worth understanding before enabling Notion Mail.
What you can do: Only connect Notion Mail if you are comfortable with Notion accessing your full Gmail content and contacts; you can revoke access at any time through your Google account's security settings.
Notion automatically collects your IP, device IDs, location, and browsing behavior.
“Automatic Data Collection: We keep track of certain information about you when you visit and interact with our Website or Services. This information may include your Internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, mobile advertising and other unique identifiers, details about your browser, operating system or device, location information (including inferred general location based off of your IP address), Internet service provider, pages that you visit before, during and after using the Website or Services, information about the links you click, information about how you interact with the Website or Services, including the frequency and duration of your activities, and other information about how you use the Website or Services.”
Quoted verbatim from the agreement What this means: Notion automatically collects a wide range of technical and behavioral data about you, including your IP address, MAC address, mobile advertising identifiers, inferred location, browsing history before and after visiting Notion, and detailed usage patterns. This is a broad sweep of device and behavioral data collected by default.
What you can do: Use a VPN to mask your IP address and inferred location. Manage cookie and tracking preferences in Notion's settings to limit some of this collection.
Notion can freely use or share your 'de-identified' data for any purpose.
“De-identified and Aggregated Information Use: We may use de-identified and/or aggregated information that can no longer be reasonably linked to you or your device from the information we collect. De-identified and/or aggregated information is not subject to this Privacy Policy, and we may use and disclose such information in a number of ways, including research, internal analysis, analytics, and any other legally permissible purposes.”
Quoted verbatim from the agreement What this means: Notion can take your data, strip out obvious identifiers, and then use or share it freely for any purpose — including selling it — without any of the privacy policy's protections applying. 'De-identified' data can sometimes be re-identified, and this clause removes all restrictions once that label is applied.
What you can do: There is no direct opt-out for this use. Be mindful that data you contribute to Notion may be used in aggregated research or analytics products.
Notion ignores your browser's Do Not Track setting.
“We do not currently respond to Do Not Track signals. However, as discussed below in the "Your Privacy Rights" section, we do honor legally-recognized browser-based mechanisms (such as the Global Privacy Control designed to signal your opt out choices under certain state laws).”
Quoted verbatim from the agreement What this means: Notion ignores the standard 'Do Not Track' browser signal that many users enable to request privacy. It only honors the Global Privacy Control (GPC) signal, and only where state law requires it. If you rely on Do Not Track, it will have no effect on Notion's tracking of you.
What you can do: Switch from 'Do Not Track' to the Global Privacy Control (GPC) in your browser settings — Notion states it will honor GPC signals.
Google Contacts data is used only for autocomplete, nothing else.
“Should you choose to use the Google Contacts feature within our Services, we will have the ability to view your contacts via the Google People API. The sole use of this data is to populate the auto-completion of your contacts when sending invitation emails. Notion will not use this data for any other purpose.”
Quoted verbatim from the agreement What this means: Notion explicitly limits its use of your Google Contacts data to autocomplete only and commits not to use it for any other purpose. This is a clear, narrow data-use commitment that protects users who connect their Google Contacts.
Notion won't use your Google Workspace data to train AI models.
“We do not process Workspace API user data to develop, improve, or train generalized AI and/or ML models.”
Quoted verbatim from the agreement What this means: Notion explicitly commits that data accessed via the Google Workspace API will not be used to train or improve AI or machine learning models. This is a meaningful protection for users of Notion Mail, as it prevents their professional communications data from being fed into AI systems.
Notion provides in-product controls to manage your cookie preferences.
“You have the right to decide whether to accept or reject Cookies. Notion provides settings for you to update your Cookie preferences in our Website and Services. These settings can be found in the footer of our Website. If you have a Notion account and are logged in to the Services, you can access your Cookie settings in the”
Quoted verbatim from the agreement What this means: Notion provides in-product cookie controls and links to industry opt-out tools, giving users meaningful ability to manage tracking preferences. Logged-in users can access these settings directly in their account menu, and non-logged-in users can use browser controls or footer settings.
What you can do: Use the cookie settings in Notion's website footer or in 'Settings & Members' under 'My notifications & settings' to manage your preferences.
Frequently asked questions
Is Notion's Terms & Conditions agreement fair?
- BeforeYouClick grades Notion D on an A–E scale, where A is the fairest. Its agreement contains 6 critical clauses, 8 warnings and 4 good practices.
What are the biggest problems with Notion's terms?
- The most serious clauses we flagged are: Vague, Open-Ended Data Retention Period, Policy Changes Accepted by Continued Use and Browsing Data Shared With Ad Networks.
How long does it take to read Notion's terms?
- Notion's agreement takes about 33 minutes to read in full, across 18 clauses we reviewed. The summary on this page covers the same ground in under a minute.
When was Notion's agreement last analyzed?
- We last read Notion's Terms & Conditions on July 3, 2026. Companies change their terms without notice, so check the original document for the current version.
Is this analysis legal advice?
- No. This analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original agreement before you agree to it.
More agreements to read
- PosteoProductivityGrade A
- TutaProductivityGrade B
- KagiProductivityGrade C
- FastmailProductivityGrade D
- ProtonProductivityGrade D
- AppleProductivityGrade E