# Permissions and privacy

Notion Source is built so that your credentials stay protected and no data leaves your website unnecessarily.

## The token stays on the server

- The Notion token lives solely in the plugin configuration (database table `#__extensions`) on your server.
- In the backend it is masked as a password field.
- It is **never** output to the frontend. All Notion requests run server-side; your visitors' browsers never see the token.

## Only Notion is contacted

The only external connection goes to the Notion API (`api.notion.com`). No other services, no statistics or tracking servers are contacted. The data fetched is cached locally (see [Entering the token and options](https://docs.graup-it.de/books/notion-source-en/page/entering-the-token-and-options)).

## The cache holds no secrets

The schema stored locally (under `administrator/cache/`) contains only database and field names, no token. It is stored as a PHP file with access protection, so calling it directly in a browser reveals nothing.

## Image and file URLs from Notion

<div class="callout info" id="bkmrk-files-and-cover-imag">Files and cover images from Notion are embedded via URLs hosted by Notion. For uploaded files these URLs are **time-limited** and may expire after a while. For images embedded permanently, better use an external URL in Notion or load the image into the Joomla media manager.

</div>## Who may change the settings

The plugin configuration — and with it the token — is accessible only to users with the corresponding backend permissions (usually administrators). Notion Source creates no frontend forms of its own and accepts no input from visitors.

<small>Applies to version 1.2.3.</small>

[Deutsche Fassung](https://docs.graup-it.de/link/111)