Privacy Policy — Asana AI

Last updated: September 12, 2026

Asana AI ("the extension") is a browser extension that adds an AI assistant sidebar to Asana. It summarizes tasks, detects risks, prioritizes work, surfaces warnings, enables chat actions, and creates Quick Tasks and Automation Rules. This policy explains what data the extension handles and where it goes.

1. The short version

• No account with us. The extension does not require you to create an account with us and does not send any data to our servers — because we don't run any servers.
• Your Asana data stays between you and Asana. The extension calls the official Asana API directly from your browser using a Personal Access Token (PAT) that you provide. The token and the data returned by Asana are stored only in your browser's local extension storage.
• AI runs locally. Summaries, risk detection, prioritization, and chat are generated by a language model running on your machine (Ollama or LM Studio at 127.0.0.1). Your task content is sent only to localhost / 127.0.0.1 on your own computer — never to the internet.
• No analytics, no telemetry, no tracking. The extension contains no third-party analytics, advertising, or tracking SDKs.

2. Data we collect

We (the developer) do not collect, transmit, or store any personal data. The extension has no backend service. Everything below happens entirely inside your browser.

3. Data stored on your device

The following is stored in Chrome's local extension storage (chrome.storage.local) and never leaves your device unless you explicitly export it:

• Asana Personal Access Token (PAT) — you paste this in Settings. It is sent only to app.asana.com as an Authorization header when the extension calls the Asana API on your behalf.
• Asana task/project data — fetched from the Asana API to populate the sidebar. Cached locally for the session and discarded on reload.
• Your settings — sidebar preferences, AI provider URL, selected models, warning rules, Quick Task templates, Automation Rules, holiday lists.
• Selected project — the Asana project you were last viewing, remembered between sessions.

You can erase all of this at any time by removing the extension from Chrome, or by clearing extension storage in chrome://extensions → "Service Worker" → Storage.

4. Data sent to third parties

• Asana (app.asana.com) — API requests authenticated with your PAT. Subject to Asana's Privacy Policy.
• Your local machine (127.0.0.1 / localhost) — task text is sent to your local Ollama or LM Studio instance so the AI can generate responses. This traffic never leaves your computer.

No other third parties receive any data.

5. Permissions and why we need them

• storage — save your PAT, settings, and cached data locally.
• identity — reserved for optional Asana OAuth flows.
• alarms — schedule periodic warning scans and automation runs.
• Host permission for app.asana.com — call the Asana API and inject the sidebar UI.
• Host permission for localhost:11434 / localhost:1234 — talk to your local Ollama / LM Studio server.
• optional_host_permissions — requested only if you enable a feature that needs an additional origin; granted per-origin with an explicit Chrome prompt.

6. Children's privacy

The extension is intended for professionals using Asana and is not directed at children under 16. We do not knowingly collect any data from anyone.

7. Changes to this policy

Material changes will be reflected by updating the "Last updated" date above and, where significant, noted in the extension's release notes.

8. Contact

For privacy questions, open an issue at github.com/aramoj/asana-ai/issues.