audit report

Notion

warn

scanned 2026-04-16 23:31:26 utc permalink · /audit/notion

Notion's privacy policy accurately reflects the majority of observed third-party services, with explicit disclosures about analytics (Google Analytics, Hotjar, Amplitude), advertising networks (Google Ads, DoubleClick, Facebook Pixel, Twitter Ads), and chat support providers visible in the tech stack. The policy transparently acknowledges data sales/sharing under CCPA and provides user opt-out mechanisms. However, the observed presence of less-common tools (Metadata, TailorHQ, Gist, Sierra, Sprig, Statsig, Clearbit, Transcend) and specialized vendors (Memsource, Podscribe, GRSM, Tapad) significantly exceeds what the policy explicitly names, creating a disclosure gap for vendors not mentioned in the "named_third_parties" list.

claim vs. reality

“we collect information such as your name, email address, password, role within your team or enterprise, and an optional profile photo”

— Notion privacy policy

observed · html

Hotjar

findings

warn
Session replay tools detected

Session replay tools record user interactions. Observed: Hotjar. The policy should clearly disclose this and how recordings are stored.
```
            Hotjar
          
```
how we detected this →
warn
Observed vendors not named in policy

The policy names some third parties but omits these observed vendors. Undeclared: Customer.io, Amplitude, Twitter/X, Clearbit, Hotjar, Sprig, US Browser Speed, AppNexus, Twitter/X Ads Pixel, Microsoft Bing, Google DoubleClick, Facebook Pixel, Google Ads, Google AdSense, Google Tag Manager, LinkedIn, Marketo, PartnerStack, Splunk, TikTok, Vercel, GRSM, Hotjar, LI&A, Marketo, Tapad, Userleap.
```
            Customer.io
Amplitude
Twitter/X
          
```
how we detected this →
warn
Undisclosed third-party vendors exceed named examples

The privacy policy names only 9 specific third parties (Google Analytics, Google APIs, Network Advertising Initiative, Digital Advertising Alliance) but the site loads 92+ distinct third-party domains. Many high-frequency vendors have no explicit mention: Metadata (8 hits), TailorHQ (8 hits), Gist (6 hits), Sierra (5 hits), Sprig (3 hits), Clearbit (3 hits), Statsig (1 hit), Forethought (2 hits), Vercel (5 hits), Memsource (4 hits), GRSM/Tapad (tracking), and Transcend (1 hit). While the policy uses umbrella language about 'third-party service providers' and 'advertising partners,' this granular level of vendor diversity is not made transparent to users who review the policy.
```
            Policy lists only 9 named third parties under 'named_third_parties'
Observation shows 92+ third-party domains loaded
Metadata.io (8 hits), TailorHQ.ai (8 hits), Gist.build (6 hits), Sierra.chat (5 hits) have no corresponding policy disclosure
          
```
how we detected this →

note

Customer.io loaded (analytics)

Observed 5 time(s) on the page.


            CSP: https://assets.customer.io
CSP: https://track.customer.io

how we detected this →

note

Amplitude loaded (analytics)

Observed 4 time(s) on the page.


            CSP: https://cdn.amplitude.com
CSP: https://api.amplitude.com

how we detected this →

note

Twitter/X loaded (social)

Observed 4 time(s) on the page.


            CSP: https://platform.twitter.com
CSP: https://syndication.twitter.com

how we detected this →

note