No. Secretariat only reads Canvas and never turns in work, posts in a class or changes anything there; checking something off, moving it or adding a note stays inside Secretariat.
Why a Canvas token is safe here
A Canvas access token can't be limited to reading, so the promise lives in Secretariat's code, which only ever reads. The token is encrypted with AES-256 before it's stored and never shown to anyone.
You can delete the token any time in Canvas, under Account, Settings, Approved integrations.
Your calendars too
The same goes for Google Calendar, Outlook and your to-do apps. Where an app lets access be limited to reading, as Google and Microsoft do, that's all Secretariat asks for.
If you want your list in Google Calendar, you can send it there as a separate one-way "Secretariat" calendar. Your own calendars stay untouched.
When Canvas moves a date
Secretariat doesn't move your to-do on its own. You get a Move or Keep choice, and your pick stays put.