Privacy Policy

The short version

• Your Salesforce credentials never reach us. They are stored in your own browser and, if you turn encryption on, encrypted there with a key derived from a password only you know.
• The extension talks to your Salesforce ORGs directly. Queries, describes, Apex, Health Monitor and Access Lens data all go from your browser to your ORG and back. None of it passes through our servers.
• We do not sell, rent or share personal data with third parties for their own purposes.
• The routine calls to our servers are the licence checks — of a licence key, or of the licence a device uses through your ORGanizer account — and the public feeds of the popup's messages and sponsor banners. None of them carries Salesforce data or credentials.
• The extension does not send usage analytics. This website does — see This website.
• Sponsor banner clicks pass through this website. Clicking a banner opens a link on organizer.solutions, which counts the click and forwards you to the sponsor — see Sponsor banners. Showing a banner only loads its image from our CDN: no identifier, no page address, no count.
• A community account is a username, an email address and a password, needed to propose ideas and vote, and to use your licences in the extension by signing it in with the account. Your password is stored only as a salted hash, your email is never published, and only your username is ever shown — see Community accounts.

Who we are

ORGanizer for Salesforce and this website are operated by Enrico Murru (“we”, “us”).

For the data the extension keeps in your browser and the data it reads from your Salesforce ORGs, we are not a controller or a processor: that data never reaches us. Where you use the extension against an employer's Salesforce ORG, your employer remains the controller of the ORG data you access through it.

The browser extension

Everything the extension stores lives in your browser, in the extension's own storage (chrome.storage.local and the extension's IndexedDB databases, and chrome.storage.sync for the items you explicitly mark as synced). Nothing of it is uploaded to us beyond the licence checks described in What leaves your browser.

Salesforce sessions

The extension reads the Salesforce session cookies of the ORGs you are logged into, on the domains you have granted it (see Browser permissions). This is how it knows which ORGs are open, colours their tabs, and calls the Salesforce API on your behalf. Session identifiers are used in the browser and are never transmitted to us.

Data read from your Salesforce ORGs

Tools such as the Quick Console, Health Monitor and Access Lens query your ORGs through the Salesforce APIs, using your own session and therefore your own permissions. The results are rendered in your browser and held in memory for as long as the page is open. The Health Monitor keeps no cache: an analysis is stored only if you save it, in your browser (see the table above). Anything you export — CSV, JSON, a ZIP report — is written by your browser to your own device. None of this data is sent to us.

Encryption

Encryption is optional and off until you turn it on. When it is on, each stored password and security token is encrypted individually with AES-GCM (256-bit) using a key derived from your master password with PBKDF2-SHA256 over 600,000 iterations and a random per-installation salt, through the browser's Web Crypto API.

The derived key is held in the memory of the extension's background and is never transmitted. Your master password itself is never stored: what is stored is a one-way verifier that can confirm a password is correct without revealing it.

Keep unlocked (from version 1.0.22, on by default, in Options → Encryption) decides how long the key stays usable. While it is on, the key is also kept wrapped — encrypted with AES-GCM by a second, random key that cannot be exported — so that it survives the browser putting the extension's background to sleep: the wrapped key in browser session storage, which lives in memory and is cleared when the browser closes, and the random key in the extension's IndexedDB database. Neither can decrypt anything without the other, and both are deleted when the session locks, when it has not been used for the minutes you chose (5 by default), or when you turn the setting off. With Keep unlocked off, the key lives in the background's memory only, and is gone whenever the browser closes, the extension reloads or the background goes idle.

Unlock with a passkey (from version 1.0.22, in Options → Encryption) lets a passkey — your fingerprint, face, device PIN or a security key — open the key instead of your master password, on the browser where you add it. The passkey answers with a secret that never leaves your browser; the extension uses it to wrap the encryption key (AES-GCM) and stores only the wrapped key, locally. Your fingerprint or face is checked by your device and never reaches the extension or us. The passkey itself is kept by your device, your security key or your password manager (Google, Apple, Microsoft or another), under that provider's policy, and is used by the extension only: it is not linked to your ORGanizer account and this website never sees it. Your master password stays required to add or remove a passkey and is asked once a day.

With encryption off, passwords and tokens are stored obfuscated but not cryptographically protected. Anyone with access to your browser profile can read them. We strongly recommend turning encryption on.

Browser sync

If you mark a login as synced, it is placed in your browser's sync storage. From there, your browser vendor — Google for Chrome, Microsoft for Edge, Mozilla for Firefox — replicates it to your other signed-in browser profiles, under their privacy policy and their infrastructure, not ours. We never see it.

Data placed in sync storage is encrypted by ORGanizer beforehand if you enabled encryption. If you would rather nothing left your device, leave logins unsynced; ORG configurations are always synced and contain no secrets.

What leaves your browser

That is the complete list. The extension contacts no advertising network, no analytics endpoint and no third-party service beyond the above.

Sponsor banners

ORGanizer is free because sponsors pay for it, and the extension shows their banners on the free licence. Clicking one is the single moment where the extension and this website meet, so it is worth being exact about what happens.

A banner click opens a link on organizer.solutions, which records the click and forwards you to the sponsor. Showing a banner only loads its image from our CDN (cdn.organizer.solutions), a plain request that carries no identifier and not the address of the page the banner is on, and that we do not count — there is no beacon and no impression counter. No click, no record.

What that link carries:

• which banner you clicked, and where in the interface you clicked it;
• your anonymous installation identifier — the same one described in What leaves your browser, not a new one created for this;
• the extension id and version, your browser family, and your licence tier.

What it does not carry: your email address, your licence code, anything about your Salesforce ORGs, and nothing about the page you were on when you clicked. Banners shown inside a Salesforce page are built so that the address of that page is not sent to us either.

We keep that as a click record — without your IP address and without your user agent — and count it. The purpose is to know which sponsors and which placements are worth keeping, and to be able to tell a sponsor honestly how many clicks they received. If you allowed statistics in this site's cookie banner, the same click also produces a banner_click event in Google Analytics; the installation identifier is deliberately not part of what goes to Google.

Banners on this website. Some pages of this website may show sponsor banners of our own instead of Google AdSense, never both. The page asks this website which banners to show, a request that is the same for everyone and carries nothing about you, and loads each banner's image, which is not counted either. A click goes through the same link as in the extension, saying which banner and which place on the page; there is no installation identifier, extension id or licence tier to carry, and the record keeps no IP address and no user agent. An account with a PRO licence sees none, as it sees no AdSense.

Legal basis (GDPR). Our legitimate interest in measuring the sponsorships that pay for the extension. If you would rather not be counted, do not click the banners — and a PRO licence removes them altogether.

Browser permissions

From version 1.0, the extension is installed with no access to any Salesforce domain. It asks for the domains of an ORG the first time you open that ORG, one ORG at a time, and you can review and revoke every grant in Options → Permissions.

The permissions granted at install time are limited to what the extension needs to function — tabs, activeTab, cookies, storage, scripting, downloads and alarms — and are documented individually in the documentation. The extension does not request access to your browsing history, your Google identity or your email address anymore.

One optional permission is asked only if you add a passkey (from version 1.0.22): access to orgnz-extension.organizer.solutions, a domain of ours that the passkeys belong to, since an extension may only name a domain it has permission for. Your browser may describe it as reading and changing data on that site; the extension never contacts it, and nothing is read from it or sent to it.

This website

The website (organizer.solutions) is separate from the extension and does use third-party services:

Cookies and similar technologies

The first time you visit, a banner asks whether you allow statistics (Google Analytics) and advertising (Google AdSense). Neither is loaded before you answer; Reject all and the banner's close button refuse both, Customize chooses one by one. Your answer is kept for 6 months, after which you are asked again, and Cookie settings, at the foot of every page, changes it at any time: withdrawing a consent deletes Google Analytics' cookies from this site and reloads the page.

The pages also keep a few preferences in your browser's own storage, never sent to us: the theme (org-theme), the last page of the extension's panel, the extension messages you read, the news filters, and a survey's answers while you write them.

Legal basis (GDPR). Analytics and advertising cookies rely on your consent (Art. 6(1)(a) GDPR and the ePrivacy rules), given in the banner and withdrawable at any time from Cookie settings. Server logs and the session cookie rely on our legitimate interest in operating the site securely, and sponsor banner click records on our legitimate interest in measuring the sponsorships that fund the extension.

Do Not Track. There is no agreed standard for honouring DNT signals across the third-party services above; we do not make a claim we cannot keep. Refusing statistics and advertising in the banner, or blocking cookies in your browser, is the effective control.

Payments and licensing

Licences are sold through Gumroad, which acts as merchant of record. Your payment details are collected and processed by Gumroad under their privacy policy; we never see your card details. From Gumroad we receive the information needed to issue and validate a licence: the purchaser's email address, the product bought and the licence status.

When you apply a licence code in the extension, our licensing API receives the data listed in What leaves your browser and returns whether the licence is valid. We keep the licence record, the associated email address and, for bulk licences, the child codes issued and the email addresses they were assigned to, for as long as the licence is active. For each device using a licence — a browser validated with the key, or a device signed in with an account — the licensing API keeps the client name you set, the installation's identifier, the extension id and version, your browser's user agent and when the device was first and last seen; removing a device deletes it.

Support requests

When you use the support form, we receive what you put in it: the type of request, your name, your email address, your company (for the sponsorship program), whether you want the mailing list and the occasional surveys, the description of the problem and the screenshot you attach, if any. Logged in to a community account, the form starts from your account's email and choices, and tells us your username too; it also says which browser and system you use, in a few words (such as "Chrome on Windows"), and your IP address, which is kept with the request so that no address sends more than 10 requests a day. The request goes straight to our customer relationship tool, Salesforce, where it becomes a ticket: the site keeps none of it. We use it to answer you and to fix the problem, and the two subscriptions only as you chose them. The form is protected by reCAPTCHA, which Google's Privacy Policy covers.

Subscribing to release announcements passes your email address to Gumroad, which sends them. Every message carries an unsubscribe link.

Community accounts

A community account lets you take part in the ORGanizer community on this website — proposing ideas and voting on the Ideas board — and, from version 1.0.22 of the extension, use your licences through it: you link them to the account in My licenses and sign the extension in with it (below). The extension never sees your password: you type it on this site only.

When you register, we store:

• your username, which is public: it is how the community sees you;
• your email address, which is never shown on the site, and which you cannot change from your account (to have it corrected, see Your rights). We use it to contact you about your account and your ideas, and for marketing only if you agree to it (below). We email it the link that activates your account, and a link to choose a new password when you ask for one;
• a hash of your password (scrypt, with a random salt of its own and a secret key kept apart from the database). The password itself is never stored and never logged, and we cannot read it back;
• the icon and colour you pick for your account on My profile, shown with your username;
• if you write them on My profile, a short bio and your names on LinkedIn, X, GitHub and Trailblazer. They are shown only on your public profile, a page at /members/your username: it shows them, your icon, when you joined and how many ideas, comments and votes you have (and how many articles you suggested were put in the news), and your username links to it on the site. It is on unless you turn off “Show my public profile” in My profile's Preferences; turned off, the page is gone at once. Your email address is never on it;
• whether you asked to be a beta tester (a switch in the same Preferences), and since when: support may then email you, at your account's address, about a beta. Turn it off and we no longer will;
• your two optional consents, asked when you register (never ticked beforehand) and changed at any time in My profile's Preferences, and when you last gave or withdrew each: profiling, letting us use what you do in the community (your votes, answers, comments and licences) to tailor what we show and send you; and marketing, letting us email you news, offers and promotions about ORGanizer at your account's address. Without them we do neither; accounts created before they were asked have given neither;
• when the account was created and when you last logged in;
• if you registered from a member's invitation link (Bring a colleague), who invited you, and when: once your account is activated, signed in to the extension and has taken part in the community (an idea or an article approved, a comment standing a week, a poll or a survey answered), that member gets days of PRO and their Ambassador badge counts one more colleague. They see how many colleagues their link brought, never who; the administrators see both.

Logging in sets the sid session cookie, which holds your account's internal identifier, username and the identifier of that log-in (never your email or password) and lasts 30 days, and a second cookie, org_account, holding only the value 1, which tells the pages to show your account in the header. Both are deleted when you log out. Registration and log in are checked by Google reCAPTCHA, and so is asking for a password link; see This website.

Each log-in is also kept on our side as a session: when it started, when it was last used, until when it lasts, and the kind of device it was opened on, as the names of the browser and of the system only (“Chrome on Windows”) — never your IP address or your browser's full identifier. It is what lets a device be logged out from our side: when you log out, when your password changes, or when you ask support to log your account out everywhere. A session ends after 30 days at the latest, and is deleted 30 days after it ended.

Licences linked to your account. When you link a licence in My licenses, we send its key and email address once to our licensing API to check them, and keep only the licence's reference, its last four characters and what it was the last time we read it (its kind, product and provider, and when we read it) — never the key or the email address, and neither is logged. Every page that shows the licence asks the API for its state again. While a licence linked to your account works, a PRO badge is shown next to your username wherever it appears on the site. A licence we give you ourselves (a reward of Bring a colleague, or PRO our team gives for a while) is made for your account and linked to it at once, with your account's email address as its licensed email: nobody, you included, ever sees its key, and it stays linked until it ends. The owner of a bulk licence assigns its seats to email addresses from the same page; the licensing API keeps them as described in Payments and licensing. Unlinking a licence deletes its link.

Buying from your account. When you buy a licence from the PRO page while signed in, we send you to Gumroad's checkout with your account's email address filled in (you may change it there) and a random identifier of that purchase, which says nothing of your account. Gumroad hands the identifier back to our licensing API with the sale; the API checks the sale's licence with Gumroad, and we link the licence to your account as if you had typed its key. We keep the record of each Buy now (the identifier, the product, when, and the licence it linked) for 7 days.

Signing the extension in with your account. When you sign the ORGanizer extension in with your account (its Options → PRO page) and pick one of your licenses for that device (or none, to use the community only: then no licence is involved and our license server is not told), we keep a device record: the license you picked, the kind of device as the names of the browser and of the system only (“Chrome on Windows”), a one-way hash the extension makes of its installation (so that signing in again on the same device replaces its record), when it was signed in and last used, and a one-way hash of its sign-in codes and tokens — never the tokens themselves, your password or the license's key. Our license server keeps the device as one of the license's devices, where it takes a place, with this installation's Client ID, the client name you set, the extension version and your browser's user agent, as it does for a browser using the key, and notes when it last checked the license. The extension keeps its tokens on that device only, never in your browser's sync. A device record ends when you sign the device out, remove it in My licenses, unlink its license, or do not use it for 90 days; it is deleted 30 days after it ended. Changing your password does not sign your devices out.

Logging in with Google. You may log in with a Google account, connected to yours on My profile's Security tab, or register with one: Google then tells us who you are, and you still choose your username and a password, which stays the account's. We ask Google only for its identifier of you and your email address (the scopes openid and email: never your name, picture, contacts or anything else of your Google account), and only once Google has verified that address. We keep that identifier, the Google account's email address at the time you connected it (to show you which one it is), when you connected it and when you last logged in with it: never a Google password or token, which we neither see nor keep. Registering with Google takes its email address as the account's, already verified, so no activation email is sent. Google's own processing of that sign-in is under its Privacy Policy. An account whose email address belongs to a Google account is never connected to it by that alone: you connect it yourself, with your password. You can disconnect Google from the same tab at any time, which deletes what we kept of it; each connection and disconnection is emailed to you.

Activating the account. When you register, we email you a link that activates the account: until it is opened, the account cannot log in. The link works once and for 7 days. If you lose it, you can have a new one emailed from the Activate your account page, at most one every 30 minutes, or write to [email protected] from the address you registered with, with the subject “User activation: your username”, and we send you a new one. When we cannot send emails for a while, we tell you so as you register, and support sends you the link. An account not activated within 7 days after its latest link expired (14 days after registering, unless you had a new link) is closed: it is disabled and its username, email address and password are erased, as when you ask for erasure.

A forgotten password. On the Forgot your password? page, you can have a link to choose a new password emailed to your account's address: it works once and for 60 minutes, and you can ask for one every 15 minutes. You can also write to [email protected] from the email address of the account, and we send you a link that works once and for 7 days. Changing the password logs the account out everywhere.

Of every activation or password link we keep only a one-way hash, with when it was made and used, and when an activation or a password link was last emailed. The emails are sent through Resend, which receives your email address and username to deliver them, with click and open tracking turned off; see This website.

To close your account, write to the same address: we disable it, so that it can no longer log in and is logged out everywhere, and it is no longer shown anywhere on the site; the devices signed in with it stop working. If you ask for your data to be erased, we delete your email address and username from it as well, and its devices are signed out and taken off their licences; the licences linked to it stay recorded only by their reference.

Legal basis (GDPR). The account is stored to perform the service you ask for when you register (Art. 6(1)(b)), and so is the Google account you connect to it; the log-in cookies are strictly necessary for it. reCAPTCHA relies on our legitimate interest in keeping automated sign-ups and spam off the community.

Ideas board, news and comments

Anyone can read the Ideas board; proposing an idea and voting need a community account. When you propose an idea we store what you put in the form — the title, the description and the plugins you picked — together with your account and its email address, so that we can contact you about it. An idea is reviewed before it appears on the board, where it shows your username as its proposer. Your email address is never shown on the site. On My ideas you see the ideas you proposed and where each stands; only you see it.

A vote is stored as your account's identifier, the idea it is for and when it was cast: no IP address and no user agent. Each account counts once per idea. Votes cast before accounts existed, identified by a random ideas_voter cookie, still count; that cookie is no longer set, and is deleted when you open the board.

On approved ideas and on the articles of the Salesforce news you can write comments and vote for an article. A comment is stored with your account, the idea or article it belongs to, its text and when it was written or edited, and shows your username. Comments are published at once and moderated afterwards: any member can report one (we keep which account reported it), and we can hide or delete it. When we hide one we may say why: the reason is kept with the comment and only you read it, in your notifications, until the comment shows again. You can delete your own comments at any time; a deleted comment's text is erased. A vote for an article is stored as for an idea: your account, the article and when. A comment can mention a member by their username (@username): the name links to their public profile when they show one, and as you type, members who show theirs are offered; nothing beyond the comment's text is stored.

Signed in, you can also suggest an article for the Salesforce news: we store what you put in the form — the link, the title, what it is about, and the source and the day if you give them — together with your account. A moderator reviews it, may edit it, and approves or rejects it; once approved it is in the news like any other article, and shows your username as who suggested it, linked to your public profile if you show one; your public profile counts how many of your suggestions were approved. A suggestion waiting for review or not accepted is seen only by you and our moderators. On My suggestions (/salesforce-news/mine) you see what you suggested and where each stands; only you see it. If your account is deleted, the articles stay, without it.

In the community's polls you can answer a question, like it and comment on it, signed in. An answer is stored with your account, the poll, the answer you chose and when; you can change it while the poll is open. Nobody else sees which answer you chose, on the site or in our administration: only how many members chose each one. A like is stored as a vote for an article is. Both count among the votes shown on your public profile.

Surveys. We ask the community, or some members, to answer surveys, signed in. A response to a survey is stored with your account and when you sent it, and our administration reads it with your name, unless the survey says it is anonymous. An anonymous survey records that your account answered it, so you answer once, and stores your answers apart, without your account and with the day but not the time; our administration sees them without your name, and only once enough members answered for nobody to be told from them. Do not write in an open answer anything that says who you are if you want to stay anonymous. While you fill a survey in, your answers are kept in your browser, and, unless it is anonymous, on our server too so you can carry on from another device: that draft is deleted when you send your response, when the survey closes, or after 30 days without changes. Responses are kept as long as their survey; deleting a survey deletes them. If we anonymize your account, your responses stay without it. A private survey is for the members it lists, picked by us by name, role or registration date, or, only among the members who agreed to profiling, from what their accounts hold (such as a PRO license or ideas proposed); no data leaves the site for that.

Signed in, a bell tells you what happened to your own ideas (reviewed, moved along, commented on, voted for) and to the articles you suggested (approved or not), when someone mentions you in a comment, and how many ideas and news are new since you last looked. These notifications are worked out, when you open a page, from the ideas, comments and votes described above: no copy of them is kept. We store only two dates on your account, how far you have read them and when you last looked at what is new, and when an idea's status or progress last changed.

To keep spam away we count how often an account proposes, votes and comments, and refuse past a limit: no third party is involved and nothing beyond what is listed above is stored.

The ORGanizer extension can show the ideas, the news and the polls in a panel of its own. Signed in to the extension with your account, the panel opens a session of its own on this website, with its own cookie (epsid), listed with your sessions and ended when you sign the extension out; it is reused each time the panel opens and lasts 30 days from its last use. The panel shows no advertising and sends nothing to Google Analytics. Its View online and My account open this website already logged in as you: the extension hands it a one-time code, and the session it opens is listed with your sessions, as a log-in would be. With the extension signed in for the community only, no licence is involved and our licence server is not told about the device.

Legal basis (GDPR). Ideas, comments and votes are part of the service your account provides (Art. 6(1)(b)); reports, moderation and the limits rely on our legitimate interest in a community free of spam and abuse.

Retention and deletion

• In your browser: data stays until you delete it. Removing a login, deleting an ORG or a Health Monitor saved scan, or running Hard reset in Options → Advanced erases it. Uninstalling the extension removes its local storage; sync storage is cleared by your browser vendor according to their rules.
• Licence records: kept for as long as the licence is active.
• Licences linked to an account: their reference, last four characters and last-read details, kept while the licence stays linked; unlinking deletes them.
• Purchases started from your account: the record of each Buy now (a random identifier, the product, when, and the licence it linked), deleted 7 days after it was made, and with the account.
• Support correspondence: kept while the issue is open and for a reasonable period afterwards to handle follow-ups.
• Website server logs: kept for a short operational period, then rotated out.
• Sponsor banner click records: kept for 24 months, then deleted.
• Community accounts: kept while the account exists; one never activated is closed, its username, email address and password erased, 7 days after its latest activation link expired. A closed account is disabled, not deleted, and its public profile is no longer shown; if you ask for erasure we delete its email address and username too, and its bio, social names and preferences. Ideas you proposed stay on the board without your account, unless you ask us to delete them too.
• A Google account connected to yours: its identifier and email address, kept while it stays connected; disconnecting it, or the erasure of your account, deletes them.
• Activation and password links: a one-way hash of each link, with when it was made and used, kept with the account.
• Log-in sessions: deleted 30 days after they end (a session lasts 30 days at most), and with the account.
• Devices signed in to the extension with an account: deleted 30 days after they end (a device unused for 90 days ends), and taken off their license on our license server.
• Ideas and their votes: kept until the idea is deleted, when it is done with or when you ask us; the email address that came with an idea goes with it.
• Comments, their reports and the votes for articles: kept until the comment, the idea or the article is deleted, or you delete the comment; a closed account's comments stay without its username.

Your rights

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, and to withdraw consent at any time. Write to [email protected] and we will respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

If you are a California resident, you may request the categories and specific pieces of personal information we have collected, request deletion, and not be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising beyond the advertising cookies described in This website, which the consent banner controls.

Note that we cannot act on a request concerning data held only in your own browser or in your Salesforce ORG: we have no access to it. Those are yours to delete directly.

Children

ORGanizer for Salesforce is a professional tool for Salesforce administrators and developers. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, write to [email protected] and we will delete it.

Changes to this policy

We update this policy when the product changes. The date at the top always reflects the current version, and material changes are announced through the extension's message panel and the change log. Continuing to use ORGanizer after a change means you accept the updated policy.

Contact

Questions about this policy, or about your data: the support form, or [email protected].

See also the End User License Agreement and the Security Statement.