OrgFlow privacy policy

Last updated: 21 August 2026

OrgFlow is a Chrome extension for Salesforce metadata retrieve and deploy. This policy describes data the extension handles on your computer.

The use of information received from Chrome APIs and from Salesforce or Git hosts you connect will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. OrgFlow uses that information only to retrieve, version, and deploy Salesforce metadata you select.

What OrgFlow stores on this device

• Salesforce session identifiers already present as the sid cookie in Chrome, used only to call the Salesforce APIs for orgs you are logged into.
• Org labels, usernames, and instance URLs returned by those APIs, so you can pick From and To.
• Optional GitHub, GitLab, or Azure DevOps personal access tokens, plus the repository you choose.
• Jira-keyed version snapshots, package selections, pipelines, and commit messages you enter.

This data stays in Chrome’s local extension storage on this profile. OrgFlow does not operate an OrgFlow server, does not create an OrgFlow account, and does not sell data.

What OrgFlow sends over the network

• Salesforce — retrieve, deploy, describe, and list metadata on the org you select, using your existing session.
• GitHub, GitLab, or Azure DevOps — only if you turn on a team repo. OrgFlow then reads and writes .orgflow/ files in the repository you connected, using the token you pasted.
• Company GitLab — if you enter a self-hosted GitLab URL, Chrome asks you to grant access to that host. OrgFlow does not request that permission until you do.

Tokens and session ids are not written into the Git repository. Pipelines stored in Git contain org labels and test settings only.

What OrgFlow does not do

• No advertising, analytics SDKs, or tracking pixels.
• No remote extension code. All logic ships in the packaged files.
• No transfer of your Salesforce or Git data to the OrgFlow developer except what you choose to put in a Git host you control.

Retention and deletion

Data remains until you remove it (clear the package, disconnect the repo, log out of Salesforce, or uninstall OrgFlow). Uninstalling the extension deletes its local storage. Revoke Git tokens in GitHub, GitLab, or Azure DevOps if the browser is shared.

Contact

Questions about this policy: open an issue on the OrgFlow GitHub repository you installed from.