Last updated: 31 August 2026
There is no server. Every request goes straight from your browser to your own Salesforce org. Nothing is collected, nothing is sent to the author or to anyone else, and no records from your org are written to disk — only your settings and a small note of what the last org looked like.
The extension does nothing until you open the popup.
Your Salesforce session. To query your org as you, it reads the sid session cookie for the org shown in your current tab and uses it as the Authorization header on calls to that same org. The cookie is held in memory for as long as the popup is open and then discarded. It is never written to storage, never logged, and never sent anywhere other than the Salesforce org it came from.
The URL of your current tab. Used only to work out which org you are looking at, so results and designer links point at the right place. If the tab is not a Salesforce domain, the extension stops there.
OmniStudio metadata. Names, types, subtypes, languages, authors, version numbers, active flags, last-modified dates and record ids, read from OmniProcess, OmniDataTransform and OmniUiCard, or their managed-package equivalents. It also reads the object descriptions to find out which fields exist in your org before it queries them.
Lightning app names. On each load the extension also queries AppDefinition and keeps the apps whose developer name or label contains "OmniStudio" (id, developer name and label), so it can offer them as a navigation context in Settings. Any other apps in the result are discarded and never stored. If your profile cannot query AppDefinition the step is skipped.
This is metadata about your OmniStudio configuration. The extension does not read the data your OmniScripts process, does not run them, and does not touch customer records.
Two things, both local to your browser. Neither contains any records from your org or your credentials.
chrome.storage.sync, so if you have Chrome Sync switched on they follow your Google account to your other devices, exactly as any extension setting does.chrome.storage.local.Asset lists are not cached. Each time you open the popup it queries your org afresh, so a version you just activated shows as active immediately. (Older builds did cache them; the current one deletes any such leftover entries on first run.)
Only the API calls to your own Salesforce org, over HTTPS.
The extension has no analytics, no telemetry, no crash reporting, no advertising, no accounts, and contacts no third-party service of any kind. No data is sold or shared, because none is collected.
cookies — to read the Salesforce session cookie described above. This is the only reason the permission is requested.storage — to keep your settings and the detection note.*.salesforce.com, *.force.com, *.salesforce-setup.com and *.cloudforce.com — the domains Salesforce orgs are served from. A single org uses several of them: Lightning lives on lightning.force.com, the API on my.salesforce.com, and some managed-package designers on vf.force.com. No other site is accessed.There is no remote code. Everything the extension runs ships inside the package.
The extension acts as your Salesforce user and inherits your permissions exactly. If your profile cannot see an OmniScript, neither can this. It performs no writes: it reads metadata and opens designer URLs in a tab, nothing more.
That said, the popup lists the names of assets in whatever org you are signed in to, and those names can be commercially sensitive or identify the organisation. Bear that in mind before screen-sharing or screenshotting against a production org — the same care you would take with any Salesforce window. Your organisation's policies, any confidentiality agreements it is under, and data protection law such as the GDPR apply to what you see through this tool exactly as they do anywhere else.
The author provides this tool as-is and accepts no responsibility for how information viewed through it is handled or disclosed. This is a plain description of how the tool works, not legal advice.
Uninstalling deletes the settings and the detection note along with the extension. There is nothing held anywhere else to delete.
If any of this ever changes, the policy will be updated and the change disclosed on the Chrome Web Store listing before the update ships.
Mikołaj Skrzypczyński — mskrz@proton.me
This is an independent, unofficial developer tool. It is not affiliated with, endorsed by, or sponsored by Salesforce, Inc.