Privacy Policy — Salesforce Nexus

Last updated: 18 July 2026

Salesforce Nexus is a browser extension for Salesforce administrators and developers. It helps you navigate your own Salesforce org faster and understand exactly why a user does or doesn't have access to a record or field. This policy explains what the extension can see, what it does with that, and what it never does.

The short version

Salesforce Nexus runs entirely inside your browser. It connects directly from your browser to your own Salesforce org's API, using the session you're already logged into. There is no server operated by us in between. Nothing is sold, shared, or transmitted to any third party. There is no analytics, no tracking, and no advertising in this extension.

What the extension accesses, and why

Every permission this extension requests is used for exactly one thing:

Permission	What it's for
`cookies`	Reads the Salesforce session cookie ("sid") from a Salesforce tab you already have open and logged into. This lets the extension call the Salesforce REST API as you, without a separate sign-in step. This value is used only to talk to your own Salesforce org's API — it is never sent anywhere else, never logged, and never leaves your browser except in that direct API call.
`tabs`	Used to detect which of your open browser tabs are logged into a Salesforce org (so you can pick which one to connect to), to open Setup pages, Profiles, Permission Sets, or Flows in a new tab when you click a search result, and to read the active tab's URL so the extension can auto-detect the record you currently have open.
`storage`	Two separate, local-only stores: `chrome.storage.local` holds your own preferences on your device — favorites, recently visited Setup pages, toolbar appearance, collapsed/expanded state. `chrome.storage.session` holds the temporary API session token created after you click "Connect," and is cleared automatically when your browser session ends. Neither is synced to any external service or account of ours — there isn't one.
`sidePanel`	Displays the Access X-Ray panel — the interface where you look up why a user does or doesn't have access.
Host permissions: `.salesforce.com`, `.force.com`, `.salesforce-setup.com`, `.visualforce.com`, `*.cloudforce.com`	These are Salesforce's own domains, including the newer Enhanced Domains Setup page domain. They're required so the toolbar only appears on Salesforce pages, and so the extension can call your org's REST API directly from your browser.

Categories of data the extension touches

In Chrome Web Store terms, this extension's use falls under three categories:

Personally identifiable information — the User Search feature shows Salesforce users' Name, Username, and Email so you can pick who you're checking access for. This data already lives inside your own Salesforce org; the extension displays it back to you, the same logged-in admin, and does not send it anywhere else.
Authentication information — the Salesforce session cookie/token is read so the extension can make API calls as you. It is used only for that purpose and is never transmitted anywhere except to your own Salesforce org.
Website content — the extension reads record, permission, and org metadata from the Salesforce API to display the access results and Setup search you asked for.

What this extension does not touch:

Health information
Financial or payment information
Personal communications (email content, chat, etc.)
Location data
Your general web browsing history
Keystroke logging or activity tracking of any kind

Where your data goes

Nowhere but between your browser and your own Salesforce org. There is no backend server operated by us, no database we control, and no third-party service the extension talks to. Specifically:

We do not sell or transfer your data to third parties, under any circumstances.
We do not use or transfer your data for any purpose unrelated to the extension's stated function — helping you navigate and diagnose access in your own Salesforce org.
We do not use or transfer your data to determine creditworthiness or for any lending purpose.
We do not run analytics, advertising, or third-party tracking scripts of any kind.

How long data is kept, and how to clear it

Session token (from chrome.storage.session) — cleared automatically when your browser session ends, or immediately if you click "Disconnect" in the extension.
Favorites, recents, and preferences (from chrome.storage.local) — stay on your device until you remove the extension, clear its storage via chrome://extensions, or clear it from within the extension's own settings.
Nothing described above is ever stored on a server we operate, because no such server exists — everything above lives only in your local browser storage.

Children's privacy

Salesforce Nexus is a professional tool for Salesforce administrators and developers, and is not directed at, marketed to, or knowingly used by children.

Changes to this policy

If what this extension collects or how it's used ever changes, this page will be updated and the "Last updated" date at the top will change accordingly.

Contact

Questions about this policy or how the extension handles data can be sent to:
jeevag17836@gmail.com