Canva web app privacy

Last updated October 30, 2026 · Learn Today Inc.

Google sign-in

Sign in to JooShow with Google before connecting Canva. Google sends a signed identity token to our web server. We verify its signature, audience, issuer, expiry and browser-specific nonce, then discard it. We store only a hash of your Google account identifier with a hashed session key. Sign-in lasts for 30 days after use and renews at most once per day while you use this web app. Expired records are deleted by hourly cleanup. We do not store your Google name, email address, Google password, Google access token or Google refresh token. We request no Google Drive, Gmail or Calendar access.

What you choose to send

When you connect Canva, JooShow requests permission to create designs and read your Canva profile. We fetch your Canva display name and user ID to show exactly which Canva account is connected and will receive new designs. We store these account details with the connection and remove them when you disconnect, sign out, or token refresh is rejected. We do not request your Canva email address. Choosing Canva in the JooShow extension sends only the guide you are exporting and its title to this web application. After Google sign-in and Canva authorization, the web app automatically uploads that presentation and opens the resulting design. You can cancel before importing. Alternatively, you can select your own PPTX and press Create design in Canva; selecting a file alone does not upload it. Canva authorization and importing are performed by this web application.

Where data is stored

The JooShow web server manages your connection through an opaque session cookie. In HTTPS deployments it is Secure, HttpOnly, host-only, and SameSite=Lax. JavaScript cannot read the cookie. Canva access and refresh tokens are encrypted with AES-GCM in our Convex backend. Token exchange, refresh, revocation, and Canva REST API requests happen on the server. The extension and browser JavaScript never receive Canva tokens or our client secret.

Temporary guide on your device

To continue across sign-in and Canva authorization, this web app temporarily stores the exported PPTX and title in your browser, separately from your original JooShow guides. The export expires after 30 minutes and cannot be resumed after that time; expired files are removed when this web app next checks its storage. The temporary copy is removed after a successful import, when you cancel this export, or when you disconnect or sign out in this tab. Closing a tab does not immediately delete browser storage. Your original guide remains in the extension.

Retention and deletion

Uploaded PPTX files are deleted when the import finishes, whether successful or failed, or within one hour by scheduled cleanup. Import records, including title, job status, and design links, are retained for seven days. Incomplete authorization attempts expire after 15 minutes. Tokens are retained while your connection is active and removed on Disconnect Canva or rejected token refresh. Authenticated JooShow sessions expire after 30 days without use. The authenticated browser cookie is renewed to match the server expiry when you return. Expired session rows are removed by hourly cleanup. An anonymous cookie used to bind Google sign-in expires after 30 days and grants no access.

Disconnect Canva revokes the Canva refresh token and removes the stored connection while keeping your JooShow sign-in. Sign out of JooShow revokes the app session, disconnects Canva, and expires the web cookie. Your Canva connection is linked to a hash of your verified JooShow account identifier, so signing in to the same Google account restores it after cookie loss or session expiry. Clearing cookies does not itself revoke server tokens. Older connections that cannot be matched to a verified account may require reconnection; contact joo@learntoday.kr to request deletion. Your original guide and presentation files on your device are not deleted by JooShow. Designs created in Canva remain in your Canva account and can be deleted there.

Service providers

Vercel hosts the web application and its web server. Convex stores encrypted tokens and temporary import files. Google provides identity verification under its privacy policy. Canva processes the imported file and created design under its privacy policy. We do not sell these files or tokens or use them for advertising. Hosting providers may process technical request metadata under their own policies.

Your requests

For access, correction, deletion, or privacy questions, contact Learn Today Inc. at joo@learntoday.kr. The general JooShow privacy policy describes other JooShow functions.