sf-access-explainer

Privacy Policy: SF Access Explainer

Last updated: 2026-09-22

SF Access Explainer (“the extension”) is a Chrome extension that helps Salesforce administrators and developers understand why a given user does or does not have access to a record, by querying the Salesforce REST API directly from the browser.

What data the extension accesses

• Salesforce session cookie (sid). The extension reads the session cookie for the Salesforce domain you are currently logged into, using the Chrome cookies permission. This cookie is used only to authenticate REST API calls made directly from your browser to your own Salesforce instance (*.salesforce.com / *.force.com).
• The active tab’s URL. Used only to detect that you are on a Salesforce Lightning record page and to extract the object type and record ID from the URL.
• Salesforce record and user data returned by the API, such as sharing rows, access levels, and user names for the record/user you choose to inspect. This data is used only to render the results in the extension’s popup.

What the extension does NOT do

• It does not send any data to servers operated by the developer or any third party. All API calls go directly from your browser to your own Salesforce org’s instance host.
• It does not use analytics, tracking, or advertising services.
• It does not persist any data outside of Chrome’s normal in-memory extension state. The storage permission is reserved for future use and is not currently used to store any data.
• It does not collect or transmit personally identifiable information to the developer.

Data retention

The extension does not retain data after the popup is closed. No data is stored on disk, in the cloud, or transmitted anywhere other than your own Salesforce instance.

Permissions justification

Permission	Why it’s needed
cookies	To read the Salesforce session cookie (sid) so API calls can be authenticated as the logged-in user.
activeTab	To read the current tab’s URL and detect the Salesforce record being viewed.
storage	Reserved for future use (e.g. saving user preferences). No data is currently stored.
Host permissions (*.salesforce.com, *.force.com)	To call the Salesforce REST API on your org’s instance host.

Changes to this policy

If this policy changes, the “Last updated” date above will be revised.

Contact

Questions about this policy can be directed to: cersosimobrian@gmail.com