Is Save ChatGPT to Notion safe?

Medium risk

Save ChatGPT to Notion sends failed Notion-save payloads and user identifiers to chatgpt2notion telemetry.

When Notion block appending fails, the extension posts error details to chatgpt2notion telemetry. For invalid URL failures, that telemetry includes the full Notion block payload generated from the ChatGPT conversation, along with a client ID, stored subscriber or Notion email when available, and save metadata.

aluov11.0.0Chrome Web Store
45Risk
Who publishes it

org - 6 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
aluo
Declared legal entity
org
Registered address
xianganwanjiaonailuchengjie, 345num, 九龍, 香港 510000, CN
Registered contact
strongerzhou
Website
github.com/joysey/chatgpt-to-notion/issues

Same store account

6 other listings published from this account, 7k+ users between them. 2 of them carry a finding.

ChatGPT to Evernote2k+CleanEmail Hunter Pro1k+CleanAIExportHub: Bulk Export AI Chats1k+LowChatGPT Prompts Hub1k+Cleanmidjourney to notion1k+MediumChatGPT to PDF - One-Click Export & Batch Save1k+Medium

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

payv2.chatgpt2notion.com
Also called by 7 other listings, including Save ChatGPT to Obsidian markdown file, Export Gemini AI Chats to PDF
cfnodeapi.chatgpt2notion.com
Also called by 8 other listings, including Perplexity to Notion - Batch Export, Export Gemini Chats to Notion
nodeapi.chatgpt2notion.com
Also called by 9 other listings, including Save ChatGPT to Obsidian markdown file, Claude to Obsidian & Markdown Export

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Notion append failures send ChatGPT save payloads to telemetry endpoint

When a Notion append fails while saving a ChatGPT chat, the extension can send the failed block payload and user identifiers to nodeapi.chatgpt2notion.com: DOM content, page URL, title, and stored IDs like client ID or Notion email.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

A user starts a Save ChatGPT to Notion action and the Notion append operation fails.

The extension did this

The extension builds a failure log that can include the generated Notion block payload, user identifiers, and save metadata, then posts it to the chatgpt2notion telemetry endpoint.

Captured request
POSThttps://nodeapi.chatgpt2notion.com/aluoapiserver/userActionLog
Fields in the request
  • ChatGPT conversation content
    Question and answer text from the saved chat (illustrative)

    The failed Notion block payload can contain conversation text generated from the ChatGPT page.

  • Current page URL
    https://chat.openai.com/c/example-chat (illustrative)

    The request can include the page address associated with the save action.

  • Page title
    ChatGPT - Project notes (illustrative)

    The request can include the visible title of the ChatGPT page being saved.

  • Stored user identifiers
    user@example.com (illustrative)

    The request can include a generated client ID or subscriber or Notion email read from extension storage.

Where it sends data

Destinations our analysis observed Save ChatGPT to Notion contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • nodeapi.chatgpt2notion.com

    Save ChatGPT to Notion sends data to nodeapi.chatgpt2notion.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026bknieejaaomeegoflpgcckagimnbbgdp