# Connection privacy Canonical page: https://mitchi.app/privacy Learn how Mitchi handles optional service connections, access tokens, imported content and requests to disconnect or delete data. Last updated October 30, 2026 ## Privacy for Mitchi connections This notice describes the optional Canva, Google Ads, Meta Ads and social publishing connections operated by Mitchi. Contact [Mitchi support](mailto:work@zadlab.com) with questions. ## What this service receives When you connect an account, Google or Meta sends authorization credentials and information about the ad accounts you can access, including account identifiers, names, currency and time zone. Meta also provides an app-scoped user identifier so we can process disconnection and deletion requests. The service can read Facebook Page and linked professional Instagram identities that are needed for an ad. When you choose to create an ad, Mitchi sends the selected campaign settings and, for an image ad, the selected rendered image. The service forwards these to the ad platform. It does not receive your full project, source designs, media library, or Mitchi chat through this connection flow. ## Why we use it We use this data to connect your selected account, show its campaigns and available ad identities, and submit the campaigns you explicitly review and choose to create. Connecting an account does not publish ads or start spending. Google user data is used only to provide these requested features. It is not sold, used for targeted advertising by Mitchi, or used to train generalized AI or machine-learning models. Our use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. ## Canva imports When you connect Canva, the service receives read-only design metadata and export permissions. It stores encrypted Canva access and refresh tokens and requests PDF exports only for designs you choose. The [browser library](https://mitchi.app/canva) saves the selected PDF export, design identifier, title, page count and import date under your Mitchi account. PDF snapshots and connection credentials are encrypted on the hosted server. You can preview saved pages in the browser without installing Mitchi. The separate Mac import flow converts supported PDF layers into its workspace. This connection does not edit or publish your Canva designs. Use Disconnect Canva in the browser library to revoke its authorization and remove its hosted credentials. Saved imports remain until you remove them from the library. The browser library allows up to 10 imports and 100 MB per account. Mac connections are managed separately in the Import from Canva dialog. ## Social publishing Social publishing uses Mitchi's hosted Postiz service to connect your social accounts and publish the content you select. Postiz stores social authorization credentials, channel information and the publishing content you send. The selected content is shared with the social platform when you publish or schedule it. Mitchi keeps each user's connection to Postiz separate. Disconnecting removes a social channel from the connected-account list and requests removal of its scheduled posts. Published posts remain on the social platform. Disconnection does not erase all stored social connection and publishing records. See the social publishing section of the [deletion instructions](https://mitchi.app/data-deletion) to request deletion of that data. ## Storage and sharing for Canva and advertising Canva and advertising credentials are encrypted in the hosted connection service. Your desktop stores an encrypted connection credential; owner app secrets are never distributed with it. Credentials and account metadata remain until you disconnect or request deletion. Inactive desktop connections are removed after 180 days without use. Browser Canva connections and saved imports remain until you disconnect, remove the imports or request account-data deletion. Pending sign-ins expire after 15 minutes. Campaign submission receipts expire after 30 days. Selected campaign data is shared with Google or Meta to perform your request. Cloudflare and our hosting infrastructure process network traffic needed to operate this service. Private account-connection and authorization pages do not load analytics or advertising tags. Optional tracking on the public website is explained in the [website analytics notice](https://mitchi.app/product-privacy#website-analytics). A short-lived, HttpOnly cookie secures browser sign-in. Infrastructure may process technical connection and security logs. ## Your choices Connections are optional. For Google Ads or Meta Ads, use Manage → Remove connection in Mitchi to remove the advertising connection and its hosted credentials. You can also revoke access in your Google Account or Facebook Business Integrations settings. See [data deletion instructions](https://mitchi.app/data-deletion). Deleting a connection does not delete or stop ads already created in Google or Meta. ## Other Mitchi features This notice covers the connection service. Mitchi's local workspace and optional AI or media services have separate data flows controlled by the features you choose. Do not submit sensitive personal information as ad copy or images.