# Connection privacy

Canonical page: https://doodi.app/privacy

How Doodi handles optional connected-service data and credentials.

Last updated October 22, 2026 

## Privacy for Doodi connections

This notice describes the optional Canva, Google Ads, Meta Ads and social publishing connections operated by Doodi. Contact [Doodi support](mailto:work@zadlab.com) with questions.

## What this service receives

When you connect an account, Google or Meta sends authorization credentials and information about the ad accounts you can access, including account identifiers, names, currency and time zone. Meta also provides an app-scoped user identifier so we can process disconnection and deletion requests. The service can read Facebook Page and linked professional Instagram identities that are needed for an ad.

When you choose to create an ad, Doodi sends the selected campaign settings and, for an image ad, the selected rendered image. The service forwards these to the ad platform. It does not receive your full project, source designs, media library, or Doodi chat through this connection flow.

## Why we use it

We use this data to connect your selected account, show its campaigns and available ad identities, and submit the campaigns you explicitly review and choose to create. Connecting an account does not publish ads or start spending.

Google user data is used only to provide these requested features. It is not sold, used for targeted advertising by Doodi, or used to train generalized AI or machine-learning models. Our use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements.

## Canva imports

When you connect Canva, the service receives read-only design metadata and export permissions. It stores encrypted Canva access and refresh tokens and requests PDF exports only for designs you choose. The desktop downloads the exported PDF and converts its supported layers into your Doodi workspace. This connection does not edit or publish your Canva designs. Disconnect Canva in the Import from Canva dialog to revoke access and remove the hosted credentials.

## Social publishing

Social publishing uses Doodi's hosted Postiz service to connect your social accounts and publish the content you select. Postiz stores social authorization credentials, channel information and the publishing content you send. The selected content is shared with the social platform when you publish or schedule it. Doodi keeps each user's connection to Postiz separate.

Disconnecting removes a social channel from the connected-account list and requests removal of its scheduled posts. Published posts remain on the social platform. Disconnection does not erase all stored social connection and publishing records. See the social publishing section of the [deletion instructions](https://doodi.app/data-deletion) to request deletion of that data.

## Storage and sharing for Canva and advertising

Canva and advertising credentials are encrypted in the hosted connection service. Your desktop stores an encrypted connection credential; owner app secrets are never distributed with it. Credentials and account metadata remain until you disconnect or request deletion. Inactive connections are removed after 180 days without use. Pending sign-ins expire after 15 minutes. Campaign submission receipts expire after 30 days.

Selected campaign data is shared with Google or Meta to perform your request. Cloudflare and our hosting infrastructure process network traffic needed to operate this service. We do not use analytics or advertising cookies on these pages. A short-lived, HttpOnly cookie secures browser sign-in. Infrastructure may process technical connection and security logs.

## Your choices

Connections are optional. For Google Ads or Meta Ads, use Manage → Remove connection in Doodi to remove the advertising connection and its hosted credentials. You can also revoke access in your Google Account or Facebook Business Integrations settings. See [data deletion instructions](https://doodi.app/data-deletion). Deleting a connection does not delete or stop ads already created in Google or Meta.

## Other Doodi features

This notice covers the connection service. Doodi's local workspace and optional AI or media services have separate data flows controlled by the features you choose. Do not submit sensitive personal information as ad copy or images.