Privacy & Permissions

The extension’s full source is public, so every claim here is verifiable against the code. This page summarises the policy; the canonical version is extension/PRIVACY.md.

The short version

No user data is sent to any third-party service.
No analytics or usage tracking leaves your device by default. (Optional, opt-in, local-only telemetry exists — see below.)
No ads, no tracking pixels, no accounts, no PII.
All network traffic goes only to: the Salesforce org you’re already authenticated with, your own http://127.0.0.1:7654 when you start sfdt ui, and an optional local native-messaging host you install yourself.

Manifest permissions

These are the permissions the built manifest (v0.12.0) actually requests:

Permission	Why
`storage`	Save your per-feature toggles and opt-in local telemetry counters
`clipboardWrite`	Copy reports (e.g. Flow Health Check) to your clipboard on demand
`cookies`	Read `sid` session cookies to discover which Salesforce orgs you’re logged in to
`contextMenus`	Add the opt-in right-click “Inspect this record” item on your Salesforce pages — it only ever forwards a record Id to the inspector; it reads no cookies or session data
`sidePanel`	Open the tools in a docked side panel (Chrome only) alongside the Salesforce page. On Firefox the same panel is a native `sidebar_action` sidebar, which needs no permission

Host permissions

Host	Why
`https://.salesforce.com/`	Run feature scripts on Salesforce pages
`https://.salesforce-setup.com/`	Setup pages
`https://.my.salesforce.com/`	My Domain orgs
`https://.lightning.force.com/`	Lightning Experience
`https://.my.salesforce.mil/`, `https://.lightning.force.mil/`	Gov-cloud (US government) orgs
`https://.sfcrmapps.cn/`	Salesforce orgs in China
`https://.mcas.ms/`	Orgs fronted by a Microsoft Defender for Cloud Apps proxy
`http://localhost/`, `http://127.0.0.1/`	Talk to the local sfdt CLI bridge on your own machine

Chrome blocks fetches from an https:// content script to http://127.0.0.1 unless the host is explicitly permitted at install time — that’s why the localhost hosts are listed.

The gov-cloud, China, and Defender-proxied hosts are listed so the extension can detect your Salesforce session on those org families the same way it does on a standard *.salesforce.com org. The manifest also enables split incognito, so an incognito window runs its own isolated copy of the extension rather than sharing your normal profile’s session state.

How session data is handled

The extension resolves and caches your Salesforce session only inside the service worker, in memory-backed chrome.storage.session. That store is cleared automatically when the browser closes, is never synced, and never includes the raw session id — only what’s needed to know which org a tab belongs to. Content scripts on the page never see or store it.

Data stored locally

All state lives in chrome.storage.local in your Chrome profile; none of it is synced or transmitted off your device.

Key	What it is
`sfut.settings`	Per-feature toggles, AI provider preferences, bridge token
`sfut.killswitch.cache`	Most-recent server-disabled feature list from the bridge ping
`sfut.telemetry`	Opt-in local feature-use counters

Telemetry (opt-in, local-only)

Telemetry is off unless you turn it on in the options page. Even when enabled:

Counters are kept in chrome.storage.local under sfut.telemetry.
The schema is a per-feature { activated, errored, disabled_remote } integer triple keyed by feature id, plus a monthKey like 2026-05.
Counts reset to zero at the start of each calendar month and are capped at 500 feature ids.
No PII — no org names, usernames, Flow names, record ids, IPs, or timestamps beyond the month.
No outbound network requests — the data is read back into the options page so you can see your own usage.

When you also run the local CLI, the extension may push a snapshot of these counters to <project>/.sfdt/telemetry-snapshot.json so sfdt extension stats can render them. That file stays on your machine.

Salesforce data

The extension reads Flow metadata and runs SOQL/REST/SOAP calls through your existing Salesforce session, from the page you’re already on. Queries, requests, and responses stay between your browser and the org you’re authenticated to.

When you use a bridge feature (e.g. “Deploy this Flow”), the extension sends the Flow’s developer name to http://127.0.0.1:7654 so the local CLI can run the deploy. It never leaves your device.

Generate query (soql-nl-generate, off by default) sends the description you typed plus a schema table for the objects involved — object and field API names, labels, data types, whether a field is required, and inline help text — through the same local bridge. It does not send record data: the prompt is built from the object describe only, and a check refuses the send if a value from the results table currently on screen appears in the assembled prompt. What the CLI then does with the prompt is covered under Third parties. See Generate query.

Destructive writes. Several features delete things you asked them to delete — Flow versions, debug logs, trace flags, or whatever you aim rest-explore at. Only one deletes arbitrary business records, in bulk, from a query result set: soql-bulk-delete. That is why it is the destructive feature that ships switched off. It requires no new permission either: the deletes go through the same worker-proxied session as every other call.

Before it deletes anything it generates a backup CSV of the affected rows and hands it to your browser as a normal download. That file is produced locally and is not transmitted anywhere, but it contains whatever Salesforce data your query returned — treat it the way you’d treat any exported CSV.

To be precise about what is and is not guaranteed: SFDT verifies that the CSV it generated contains every record Id it is about to delete, and that the browser minted a blob URL so the download could be handed off — if either fails, nothing is deleted. It cannot confirm the file reached your disk, or even that the download completed. Doing so would require the downloads permission, which is not in the manifest and which we would rather not hold, since it grants visibility into your download history well beyond this one feature. Instead the confirm dialog names the file and asks you to check. The backup also contains only the columns your query selected.

Third parties

None. The extension bundles no third-party SDK, analytics service, error reporter, ad network, or telemetry endpoint. The optional AI features send your prompts to a Claude / Gemini / OpenAI key you supply, billed to you and governed by that provider’s policy — the extension is a pass-through and does not see, log, or store prompts or completions.