Profile ManagerPrivacy Policy
What Profile Manager does with your data — in plain terms.
Profile Manager is a Chrome extension for Salesforce admins who need to view, compare, and edit Profile permissions. It has no server of its own: everything happens inside your browser, either on local files you pick or against the Salesforce org you're already logged into.
Summary
No server, no account, no tracking. Profile Manager doesn't collect, store, or transmit your data to us or anyone else. The only network traffic it generates goes directly from your browser to your own Salesforce org, using an org session you already have.
Local files (local mode)
When you open a folder of .profile-meta.xml files, Profile Manager uses the browser's File System Access API. It only reads and writes the files inside the folder you explicitly chose, entirely on your device — no network request is involved in this mode.
Salesforce connection (Salesforce mode)
To fetch and apply Profile permissions from an org, Profile Manager needs a Session ID. You can either paste one in manually, or let the extension detect orgs you're already logged into by reading the sid session cookie on Salesforce domains.
That session ID is used only to call Salesforce's own Metadata and REST APIs, directly from your browser to your org's servers. It is never sent to any third-party server, never stored by the extension (each connection re-scans cookies fresh), and disappears as soon as you close the tab or remove the connected source.
What is stored locally
Profile Manager saves a few preferences on your device via the browser's localStorage: your light/dark theme, your chosen language, and which permission categories are shown. That's it — no credentials, no session IDs, and no profile data are ever persisted.
What we don't do
- No analytics, telemetry, or usage tracking of any kind.
- No ads, and no data ever sold or shared with anyone.
- No third-party servers in the loop — there is no backend at all.
- No access to your Salesforce data beyond the actions you explicitly trigger (viewing, comparing, or applying permissions).
Permissions, explained
| Permission | What it's for |
|---|---|
| cookies | Read the Salesforce session cookie (sid) of orgs you're already logged into, so you can pick one instead of pasting a Session ID by hand. Restricted to the Salesforce domains listed below. |
| host_permissions *.salesforce.com, *.force.com, *.cloudforce.com, *.visualforce.com | Call the Salesforce Metadata/REST APIs and read the session cookie only on salesforce.com, force.com, cloudforce.com, and visualforce.com and their subdomains. |
Deleting your data
Uninstalling Profile Manager removes the few preferences stored locally. There is nothing else to delete: no credentials or session data are ever kept beyond the current browser tab.
Changes to this policy
If what Profile Manager collects or does changes, this page will be updated and the date above will reflect it.
Contact
Questions about this policy? Contact us.