Privacy Policy for Salesforce Quick Login

Last updated: July 10, 2026

Overview

Salesforce Quick Login ("the extension") is a browser extension that allows users to store and manage their Salesforce login credentials for one-click login to Salesforce orgs. This privacy policy explains how the extension handles user data.

Data Collection

All data entered by the user (Salesforce usernames, passwords, security tokens, TOTP secrets, and environment configurations) is stored locally in the browser using chrome.storage.sync and chrome.storage.local APIs.

Data Storage

• chrome.storage.sync: Data is synchronized through the user's own Google account via Chrome's built-in sync feature. The extension developer has no access to this data.
• chrome.storage.local: A local backup copy is stored in the browser's local storage.
• No external servers: The extension does not connect to any external servers, databases, or APIs operated by the developer. All operations happen entirely within the user's browser.

Data Usage

The stored credentials are used solely for:

1. Auto-login: Automatically filling in Salesforce login forms when the user initiates a login
2. MFA/TOTP: Generating time-based one-time passwords for Salesforce MFA authentication
3. Session management: Opening Salesforce orgs via frontdoor.jsp with the stored session ID

Data Security

• Credentials are stored in Chrome's encrypted storage
• The extension does not transmit credentials to any server other than Salesforce's own login endpoints
• SOAP API login requests are sent directly to Salesforce servers (login.salesforce.com, test.salesforce.com, or custom Salesforce domains)
• Form submission login sends credentials directly to Salesforce's login endpoints

Permissions Explanation

Permission	Purpose
storage	Store environment configurations and credentials
sidePanel	Display the extension UI in Chrome's side panel
tabs	Open new tabs for Salesforce login
activeTab	Capture screenshots for QR code scanning
clipboardWrite	Copy TOTP codes to clipboard
scripting	Inject login forms and TOTP codes into Salesforce pages
host_permissions (Salesforce domains)	Access Salesforce login pages and APIs

Third-Party Services

The extension interacts only with Salesforce's official login endpoints. No other third-party services are used.

Data Deletion

Users can delete all stored data at any time by:

1. Removing individual environments through the extension UI
2. Uninstalling the extension (this removes all stored data)
3. Clearing browser data in Chrome settings

User Consent

By installing and using this extension, the user consents to the storage of their Salesforce credentials in Chrome's local and sync storage as described above.

Changes to This Policy

Any changes to this privacy policy will be updated in this document and reflected in future extension updates.

Contact

For privacy concerns or questions, please open an issue on the extension's GitHub repository.