Flow Doctor — Privacy

Chrome extension

The extension reads Salesforce Flow metadata when you ask it to. It lists Flows in the signed-in org, retrieves the Flows you select, and runs the same deterministic checks in the browser. It does not create, update, or delete Salesforce records or metadata, and it does not deploy metadata.

Salesforce exposes Flow metadata through read APIs. One of those reads is a SOAP readMetadata request, which Salesforce requires as an HTTP POST. That request reads metadata. It does not write it.

Salesforce session

To call the org you are already signed into, the extension reads the Salesforce session cookie named sid for that org. The service worker uses it as the Authorization header on requests to that org's host.

The session value stays in the service worker's memory. Flow Doctor does not write it to extension storage, localStorage, sessionStorage, a URL, a report, a log, or an AI request. It is not sent to the Flow Doctor website, to Vercel, or to xAI. Closing the browser ends that in-memory use. Flow Doctor does not set its own cookies.

What the extension holds temporarily

Navigation uses chrome.storage.session. That storage lasts for the browser session and Flow Doctor expires its own records after 30 minutes. A record can include the org name, the API host, the API version, a summary of each Flow (API name, label, active state, process type, trigger type, and namespace), the id of the Salesforce tab to return to, a Salesforce origin with the query string and fragment removed, and the normalized analysis needed to reopen a result.

Raw Flow XML is not stored. The session cookie, Authorization header, and SOAP response are not stored. Flow Doctor does not copy this data to chrome.storage.local, IndexedDB, disk, or a Flow Doctor server.

Optional AI

Deterministic analysis does not use AI. An xAI request happens only after you choose an Ask Flow Doctor action. The extension then sends derived structured analysis and your question to https://api.x.ai/v1/responses.

That derived analysis can include:

• Flow API name, label, description, process type, status, API version, and run mode
• Trigger object, trigger type, entry criteria, filters, and schedule
• Record operations, including object names and fields the analysis identified
• Formula expressions, constants, and text templates, clipped for size. Large rich text and email bodies are described by size and are not copied
• Element names, labels, connections, and execution steps
• Findings, including titles, descriptions, and recommendations
• For a project, counts, relationships between the selected Flows, and your question

The request does not include raw Flow XML, the Salesforce session, or the API key in the message body. The key is sent only in the Authorization header, stays in page memory, and is cleared when you leave the page. The request sets store: false, which asks xAI not to store the response. xAI still processes the request under its own terms. Inspect what will be sent shows the payload before you ask. If the request fails, the local analysis remains.

Analytics, sale, and advertising

The extension has no analytics and no telemetry. Flow Doctor does not sell personal information or Flow metadata. It does not use either for advertising or for a purpose unrelated to analyzing the Flows you select.

Website

On the Flow Doctor website, file analysis also runs in the browser. Flow XML is not uploaded to the site. Optional AI follows the same rule: derived analysis is sent to xAI only after you ask, and the API key stays in page memory.

The website uses Vercel Web Analytics. That record is the anonymous page path. It does not include Flow metadata, findings, or AI questions. The extension does not use Vercel Web Analytics.

Contact

Publisher: SparrowLaunch

Contact: support@sparrowlaunch.com