Privacy policy — OmniStudio Finder

Last updated: 31 October 2026

The short version

Finder queries your Salesforce org from your browser using your existing session. It does not send org data to the author. Settings may sync through Chrome Sync; a detection note and temporary navigation information are stored in your browser.

What it reads, and when

The extension does nothing until you open the popup.

Your Salesforce session. To query your org as you, it reads the sid session cookie for the org shown in your current tab and uses it as the Authorization header on calls to that same org. When that address has no session cookie (for example on a Visualforce or Setup page), it looks through the browser's Salesforce sid cookies for the one that belongs to the same org, by the org id at the start of its value, and uses only that one; the others are not read further or kept. The cookie is held in memory for as long as the popup is open and then discarded. It is never written to storage, never logged, and never sent anywhere other than the Salesforce org it came from.

The URL of your current tab. Used only to work out which org you are looking at, so results and designer links point at the right place. If the tab is not a Salesforce domain, the extension stops there.

OmniStudio metadata. Names, types, subtypes, languages, authors, version numbers, active flags, last-modified dates and record ids, read from OmniProcess, OmniDataTransform and OmniUiCard, or their managed-package equivalents. It also reads the object descriptions to find out which fields exist in your org before it queries them.

Lightning app names. On each load the extension also queries AppDefinition and keeps the apps whose developer name or label contains "OmniStudio" (id, developer name and label), so it can offer them as a navigation context in Settings. Any other apps in the result are discarded and never stored. If your profile cannot query AppDefinition the step is skipped.

This is metadata about your OmniStudio configuration. The extension does not read the data your OmniScripts process, does not run them, and does not touch customer records.

What is stored

The extension stores settings, org detection details and temporary navigation information as described below. It does not store your session cookie.

• Your settings — designer preference, namespace override, any custom designer URL patterns, whether links open in a new tab or the current one, and an optional Lightning app id to scope pages to. These live in chrome.storage.sync, so if you have Chrome Sync switched on they follow your Google account to your other devices, exactly as any extension setting does.
• A detection note — what the popup last saw in an org so the Settings page can label its controls without a session of its own: the org's host, the detected designer flavour and package namespace(s), the OmniProcess object name, and the OmniStudio app list described above. No records, no field values, no credentials. Lives in chrome.storage.local.
• A navigation hand-off — some openings take more than one page load, and the popup closes after the first. With a Lightning app pinned, a managed-package designer opens in two steps: switch the tab to the app, then follow through to the designer once it has loaded. And the managed Integration Procedure and DataRaptor designer links keep their route in the URL fragment, which Salesforce's session hand-off can drop on the first visit of a browser session, so the extension checks where the link landed and opens it once more if the route was lost. For either, the destination URL and a timestamp are held in chrome.storage.session, keyed by tab, and cleared the moment the navigation completes. chrome.storage.session is wiped when the browser closes in any case.

Asset lists are not cached. Each time you open the popup it queries your org afresh, so a version you just activated shows as active immediately. (Older builds did cache them; the current one deletes any such leftover entries on first run.)

What leaves your machine

API calls go to your Salesforce org over HTTPS. If Chrome Sync is enabled, Chrome also syncs the settings described above through your Google account.

The extension has no analytics, no telemetry, no crash reporting, no advertising, no accounts, and does not send org data to the author. Chrome Sync and links you choose to open are described separately above and below.

The Settings page contains a link to buycoffee.to, which opens in a new tab only if you click it. That site is operated by someone else and has its own privacy policy. No information about you is passed to it by this extension.

Permissions, and why each one exists

• cookies — to read the Salesforce session cookie described above. This is the only reason the permission is requested.
• storage — to keep your settings, the detection note, and the short-lived navigation hand-off described above.
• Access to *.salesforce.com, *.force.com, *.salesforce-setup.com and *.cloudforce.com — the domains Salesforce orgs are served from. A single org uses several of them: Lightning lives on lightning.force.com, the API on my.salesforce.com, and some managed-package designers on vf.force.com. No other site is accessed.

There is no remote code. Everything the extension runs ships inside the package.

It can only see what you can see

The extension acts as your Salesforce user and inherits your permissions exactly. If your profile cannot see an OmniScript, neither can this. It performs no writes: it reads metadata and opens designer URLs in a tab, nothing more.

That said, the popup lists the names of assets in whatever org you are signed in to, and those names can be commercially sensitive or identify the organisation. Bear that in mind before screen-sharing or screenshotting against a production org — the same care you would take with any Salesforce window. Your organisation's policies, any confidentiality agreements it is under, and data protection law such as the GDPR apply to what you see through this tool exactly as they do anywhere else.

The author provides this tool as-is and accepts no responsibility for how information viewed through it is handled or disclosed. This is a plain description of how the tool works, not legal advice.

Removing it

Uninstalling deletes the settings and the detection note along with the extension. There is nothing held anywhere else to delete.

Changes

If any of this ever changes, the policy will be updated and the change disclosed on the Chrome Web Store listing before the update ships.

Contact

Mikołaj Skrzypczyński — mskrz@proton.me

This is an independent, unofficial developer tool. It is not affiliated with, endorsed by, or sponsored by Salesforce, Inc.