Flow Companion for Salesforce Add to Chrome
Last updated 11 September 2026

Privacy policy

Flow Companion is a Chrome extension with no backend. We run no server and receive no data from the extension. Nothing you do in it reaches us, because there is nowhere for it to go. This is the whole story.

  1. What it reads

    When you open a Flow in Flow Builder, the extension reads your Salesforce session cookie for that org, locally, and uses it to ask your org's Tooling API for the flow's last saved metadata. The cookie is sent only to your own org's *.my.salesforce.com (or *.my.salesforce-setup.com) host, which is where Salesforce itself sends it. It is never stored, logged, or sent anywhere else.

  2. What it sends, and to whom

    When you ask a question, the flow's saved metadata and your conversation go from your browser directly to the AI provider you chose, Anthropic, OpenAI, or Google, under your own API key. The metadata is the flow's definition: element names, formulas, labels, and any text whoever built the flow typed into it. No Salesforce records are read or sent.

    The provider's privacy policy applies to that data: Anthropic, OpenAI, Google. On Google's free tier, prompts may be used to improve Google's models; use a paid project if that matters for your org.

    Open in Excalidraw, under a drawn diagram, puts the diagram on your clipboard and opens excalidraw.com in a new tab. Nothing goes to excalidraw.com until you paste it there yourself, and the extension never talks to that site.

  3. What it stores, on your computer only

    Your API key (in Chrome's extension storage; when "Remember this key on this computer" is off, it is forgotten when Chrome closes), your settings, and your chat history per flow. Nothing is synced or backed up by us. "Forget everything on this computer" in Settings removes all of it, including any answer still arriving.

  4. What it never does

    No telemetry, analytics, crash reports, advertising identifiers, or accounts. There is no sign-up, so we never learn your name or your email unless you write to us. The extension makes no network request except the two in points 1 and 2. Nothing is sold, and nothing is shared with anyone beyond the provider you picked.

  5. Permissions

    cookies and the Salesforce host permissions exist to read your session and call your org's Tooling API. sidePanel shows the panel. storage keeps the items in point 3. The three provider host permissions allow the chat request under your key. The extension does not request the tabs permission and cannot see the addresses of pages outside Salesforce.

  6. How to check any of this yourself

    You do not have to take our word for it. Chrome shows the extension's full permission list at chrome://extensions, and you can open DevTools on the panel to watch every request it makes. The extension also ships a content security policy that Chrome enforces whatever this page says: it allows connections only to the hosts named above, and allows the panel to load nothing else from anywhere, no remote images, fonts, or frames.

    A policy is a promise. The manifest is a rule the browser applies.

  7. Changes

    Material changes update the date at the top of this page and the Web Store listing.

Questions, or anything that looks wrong

Write to support@getflowcompanion.com.