Privacy Policy

EFFECTIVE 17 SEPTEMBER 2026 · VERSION 1.0.0

SlipClip for Notion is a Firefox extension that copies web pages into your own Notion workspace. It has no server, no account and no analytics. This policy covers both the extension and this website, and describes the software as published at github.com/todorx/slipclip, where the behaviour below can be read in full.

What the developer collects

Nothing. There is no SlipClip server, no database and no endpoint operated by the developer. No clip, page address, search term or identifier is ever transmitted to the developer, and no usage or crash reporting of any kind is included.

What is stored on your device

The extension keeps the following in your browser's local extension storage. It never leaves your browser and is removed when you uninstall the extension.

• Your Notion OAuth access token, refresh token and expiry time.
• The OAuth client identifier your copy of the extension registered with Notion.
• The last destination you clipped to, so the popup can remember it.
• An error message from the most recent failed sign-in, so it can be shown to you.
• Highlights you have saved but not yet synced — the passage itself, the page's address and title, the site it came from, and when you saved it. They are held here so they survive closing the tab, and each one stays until it reaches Notion or you delete it from the Highlights tab.
• The database or page you chose for highlights, and — for a database — which of its columns holds which field.

Pressing Disconnect deletes the tokens and the stored sign-in error. These values are stored unencrypted, as browser extension storage has no secret store; anyone with access to your Firefox profile directory can read them, the same as for any signed-in extension.

What is sent to Notion

Notion Labs, Inc. is the only third party the extension communicates with, at mcp.notion.com, authorised by the token you granted. It receives:

• When you press Clip: the page's address and title, its metadata (site name, author, publication date, duration where present), your highlighted text if any, and — for pages detected as articles — the extracted article text. This is the content of the clip; it becomes a page in your workspace.
• When you type in the search box: the search term, to find destinations.
• When you select a destination page: a request for that page, so its inline databases can be listed.
• When you open the popup with highlights waiting: those highlights and the details listed above, written as rows into the database you chose, or appended as quotes to the page you chose. Nothing is sent while you are only saving highlights — capture writes to your device alone.
• When you set up the highlights destination: a request for that page or database, so its kind and columns can be read — or a request to create a database, if you asked for one.

Notion's handling of that data is governed by Notion's Privacy Policy, not this one. Nothing is sent to Notion except in response to one of the actions above.

Permissions, and why each exists

• activeTab and scripting — to read the page you are clipping, at the moment you click Clip, in the tab you are looking at. No other tab is accessed and nothing runs in the background.
• storage — to keep the items listed above.
• identity — to run Notion's sign-in flow and receive the result.
• webRequest and webRequestBlocking — used for exactly one thing: removing the browser Origin header from requests to mcp.notion.com, which that endpoint rejects. No request is inspected, recorded or redirected, and the rule applies to no other address.
• Host access to https://mcp.notion.com/* — the only address the extension is permitted to contact.

This website

slipclip.todorx.dev is a set of static files with no analytics, no cookies and no tracking scripts. Two things about it are still worth stating plainly:

• It is hosted on GitHub Pages. GitHub receives your IP address and request details as part of serving the page, under GitHub's Privacy Statement.
• Its typefaces are served from this same site, not from a third-party font host, so loading the page contacts no one but GitHub.

Children

The extension is not directed at children and collects nothing from anyone, of any age.

Changes

If this policy changes, the effective date above changes with it and the previous versions remain readable in the repository's history.

Contact

Questions and corrections belong in the issue tracker, where the answers stay public and searchable.