I set the permission for an item so donors only get it. the permission node is itemjoin.item.donated.effects and everyone gets the item, whether they have this permission or not

You need to enable item permissions in your config.yml by setting Permissions.Obtain-Items to true

EDIT: Marking this as answered, if this did not resolve your issue please re-open it.