How this extension handles your data — in plain language.
Summary. Salesforce OrgStudio — IDE + Inspector is a developer tool that runs entirely in your browser. It connects only to the Salesforce org you are already logged into and, optionally, to a GitHub repository you choose. The developer collects no data — no analytics, no tracking, no advertising, and no servers operated by us. All settings and credentials stay on your device.
“Salesforce OrgStudio — IDE + Inspector” (the “Extension”) is an independent developer productivity tool for the Salesforce platform. It is not affiliated with, endorsed by, or sponsored by Salesforce, Inc. or GitHub, Inc. “Salesforce” and “GitHub” are trademarks of their respective owners.
This policy is provided by the Extension’s developer (the “Developer”, “we”, “us”). Contact details are in the Contact section.
The Extension has a single purpose: to help a signed-in Salesforce user develop and administer their own Salesforce org — browsing, editing, creating and deploying metadata (Apex, Lightning Web Components, Aura, Visualforce, Static Resources), running SOQL queries, importing/updating records, inspecting records, and optionally version-controlling that source code in a GitHub repository the user selects. Every permission the Extension requests exists solely to serve this purpose.
The Extension processes the following categories of data locally, on your device, only to perform the actions you trigger:
| Data | Why it is used | Leaves your device? |
|---|---|---|
Salesforce session ID (the sid cookie) & OAuth tokens |
To authenticate API calls to your own Salesforce org so the Extension can read/write the metadata and records you request. | Only sent back to your Salesforce org’s domain. Never sent to the Developer or any third party. |
| Salesforce metadata & record data (Apex/LWC/Aura/VF source, SOQL results, records you view/edit/import) | To display, edit, deploy, query, import, and inspect the content you choose to work with. | Exchanged only between your browser and your Salesforce org (and GitHub, if you push code there). |
| GitHub Personal Access Token (only if you enable GitHub) | To pull and push your source code to the repository/branch you configure. | Only sent to api.github.com as a standard Authorization header. Never sent to the Developer. |
| Preferences & workspace state (theme, editor settings, open tabs, SOQL history & favorites, connected-org list, GitHub repo/branch config) | To remember your settings and improve your workflow between sessions. | No. Stored locally in extension storage only. |
chrome.storage.local): preferences, connected-org
records and tokens, GitHub configuration, snapshots of files you save, and recent files.localStorage for the in-app tools: your SOQL query history and
favorites.sid
cookie from your active Salesforce tab to reuse your login; it does not create new tracking cookies.The Extension only communicates with endpoints you direct it to:
| Destination | What is sent | When |
|---|---|---|
Your Salesforce org (*.salesforce.com, *.force.com, *.lightning.force.com, *.my.salesforce.com, *.visualforce.com) |
API requests bearing your session/OAuth token; the metadata/records you create or edit. | Only when you perform an action (connect, query, deploy, import, etc.). |
api.github.com |
Your GitHub token (as an Authorization header) and the source files you choose to push/pull. | Only if you enable GitHub and click pull/push. |
Salesforce login endpoints (login.salesforce.com / test.salesforce.com) |
Standard OAuth 2.0 (PKCE) authorization, only if you choose the optional OAuth sign-in. | Only during an OAuth login you initiate. |
| Permission | Justification |
|---|---|
storage | Save your preferences, connected-org tokens, GitHub configuration, SOQL history/favorites, and file snapshots locally on your device. |
cookies | Read the Salesforce sid session cookie from your active Salesforce tab so you can connect in one click without re-entering credentials. |
identity | Run the optional OAuth 2.0 (PKCE) login flow for users who prefer connecting via a Connected App instead of the current session. |
alarms | Schedule a periodic background check to refresh an expiring OAuth token so your session stays valid. |
downloads | Save exported SOQL results (CSV) and downloaded components to your computer when you click download/export. |
| Host access — Salesforce domains | Call the Salesforce REST, Tooling, and Metadata APIs against your connected org to read and write the code and data you request. |
Host access — api.github.com | Perform Git pull/push operations for optional version control of your source code. |
The Extension requests the minimum permissions consistent with its single purpose and executes no remotely hosted code (Manifest V3).
When you use the relevant features, your data is handled by the services you connect to, under their own policies:
Because all data is stored locally, you are in full control:
chrome://extensions to delete all locally stored
data, or clear it via your browser’s site/extension data controls.We hold no copy of your data, so there is nothing for us to delete on a server.
The Developer does not collect, sell, or share personal data, and does not act as a data controller for the content you access — that content belongs to your Salesforce org and your GitHub account. Where privacy laws such as the EU/UK GDPR or the California CCPA/CPRA apply, you retain your rights of access, correction, deletion, and portability with respect to those underlying services; exercise them directly with Salesforce, GitHub, or your organization’s administrator. Because we hold none of your data, requests to us will be answered accordingly.
We do not sell or share personal information and never use your data for advertising, credit, or lending purposes.
The Extension is a professional developer tool intended for business use and is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect data from children.
If our data practices change, we will update this page, revise the “Last updated” date, and — in line with Chrome Web Store requirements — provide prominent, proactive notice (for example, in the store listing and, where appropriate, within the Extension) before the change takes effect.
Questions about this policy or the Extension’s privacy practices: