Privacy Policy

Effective date: August 22, 2026 Applies to: the Orgbench plugin for IntelliJ IDEA, the Orgbench extension for Visual Studio Code, and the website orgbench.io.

In short

The software collects nothing. It has no telemetry, no analytics, no crash reporting, no update check and no license server, because it makes no network connection of its own at all. Everything it writes stays on your machine, and the only thing the software causes to leave it is your own Salesforce metadata, sent to your own org, by the Salesforce CLI you installed and authenticated yourself.

That is a statement about the code, not a promise about our intentions. The rest of this page says exactly what the software writes, where, and what it contains, so you can verify it rather than trust it.

1. Who we are

CleverVerve Consulting LTD, 42 Tsentralna St., Maidanivka, 07824, Ukraine ("we", "us"). Contact: support@orgbench.io.

2. What the software collects about you

Nothing. We receive no data from the software — not usage statistics, not error reports, not a heartbeat.

This is structural rather than a policy we could quietly change in a background update: the core of the product is a native binary with no networking library compiled into it, and neither editor client contains any HTTP call. The only two places either client touches the network are the two controls — a toolbar action and a link on the error screen — that ask your operating system to open https://orgbench.io/ in your browser, and those act only when you click them.

One honest exception, which is not the software's doing: the marketplaces publish download and installation counts to every vendor, so we can see how many times Orgbench was downloaded from the JetBrains Marketplace and the Visual Studio Marketplace. That is their data about their own distribution, not something the software reports, and it says nothing about who you are or how you use the product.

Two related consequences worth stating plainly:

• We cannot tell whether you use the product, or how. There is no anonymous or aggregated usage data either — "anonymized analytics" is still analytics, and there is none.
• License validation does not contact us. A license key is verified by a signature check performed entirely on your machine. There is no activation call, no periodic re-check and no revocation list, which also means a key keeps working with no network at all.

3. What the software stores on your machine

Four things. All of them are local, none of them is transmitted anywhere, and each can be deleted by you. (A fifth is not ours: IntelliJ IDEA records the startup and shutdown lines that the core process prints into the IDE's own idea.log, the same way it records those of any component. Those lines are fixed status messages — no Salesforce output goes there.)

3.1 Session log

A newline-delimited JSON file recording what the product did, so that a slow operation or a failure can be diagnosed. Its detail level is a setting with three values:

• Off — nothing is written; neither the file nor its folder is created.
• Standard (the default) — one record per Salesforce CLI invocation: the subcommand name, the target org alias, the duration, the exit code, and the byte lengths of the command's output. Plus per-operation timing records.
• Detailed — the same, plus the full argument list of each call, which is where the SOQL query text and local file paths such as the retrieve manifest appear.

What is never written, at any level: the actual output text of the Salesforce CLI. Only its length is recorded. The one deliberate exception is a failed call, where the same sanitized diagnostic that the user interface already displays is kept, capped in length — for a failed CLI call that diagnostic quotes an excerpt of the CLI's reply, with secrets already removed as described below.

Secrets are removed before anything is written. Values of accessToken, refreshToken, authorization, clientSecret and sfdxAuthUrl are replaced with [REDACTED] in both the recorded arguments and the recorded diagnostic.

The file lives in orgbench/logs under the IDE's own system directory in IntelliJ IDEA, and under the extension's global storage in Visual Studio Code, named session-<timestamp>-<pid>.jsonl. The five most recent session logs are kept and older ones are deleted; a single file stops growing at 8 MiB.

To find it: in IntelliJ IDEA the settings page shows the current path with buttons to open the folder and copy it; in Visual Studio Code the same two actions are commands in the view's overflow menu, Orgbench: Reveal Session Log and Orgbench: Copy Session Log Path.

3.2 License file

A single file, license.json, in your user data directory:

It holds the license key you entered and the timestamp of your first run. The key itself encodes the email address of the person the license was issued to — your own, or your organization's. On Unix the directory is created with owner-only permissions; on Windows with owner-only access control.

Delete this file and the product returns to the free tier; it is recreated empty on the next start, with a fresh first-run timestamp. Nothing else is affected.

3.3 Temporary comparison workspace

While a comparison is open, the metadata of both sides is retrieved into a private temporary directory under the editor's own storage, along with any edits you made to an Apex body in the diff view. This is a copy of your Salesforce metadata, on your disk.

It is deleted when you press Back or New Comparison, and when the session ends. If a cleanup fails while the product is open, it tells you rather than leaving it silently behind, and retries on the next reload.

3.4 Settings

Your preferences — FLS mode, log level, layout comparison mode, source-editing toggle, enabled metadata categories — stored by the editor in its own configuration, plus the column widths of the comparison table in IntelliJ IDEA. No org alias, username, org ID or repository path is stored in settings.

4. What leaves your machine

Your Salesforce metadata, through the Salesforce CLI, to your own orgs. When you compare or deploy, the product runs the sf command-line tool that you installed and authenticated. That tool talks to Salesforce; the product itself opens no connection. We are not a party to that exchange and never see it.

A browser sign-in, when you ask for one. The + button next to an org dropdown starts the Salesforce CLI's own browser login. The CLI opens your browser and handles the OAuth flow; the product passes it only an alias name and an instance URL, and reads back only the resulting username and org ID.

A visit to our website, when you click. The support button opens https://orgbench.io/ in your browser. Nothing is sent automatically — no diagnostics ride along with the click, and no identifier is appended to the URL. Once you are on the site, section 6 applies.

5. Credentials

The product never handles your Salesforce credentials. Authentication lives entirely in the Salesforce CLI, which stores and refreshes its own authorizations; the product neither reads those files nor asks you for a password.

To be precise rather than flattering: access and refresh tokens can appear in the raw output of a CLI command, because that is the CLI's output, not ours. What the product guarantees is that such values are stripped before that output is displayed, copied to your clipboard, or written to the session log — and that the browser-login path additionally instructs the CLI not to emit secrets in the first place, and refuses an instance URL that carries credentials in it before any process is started.

6. The website orgbench.io

The website is the one place where Orgbench can actually receive personal data, so this section is longer than the rest of the policy put together. It covers three situations: visiting the site, talking to the support assistant, and filing a bug or change request through it.

6.1 Visiting the site

The site is static pages served from Amazon Web Services (S3 and CloudFront), with the infrastructure in the EU and the CDN worldwide. We have not enabled access logging anywhere in that chain — not on the CDN, not on the storage, not on the chat API — so we receive no record of your visit: no IP address, no browser details, no page history. AWS, as our infrastructure provider, necessarily handles connection data such as your IP address in transit in order to deliver the pages; it does not pass it to us.

The site sets no cookies and contains no analytics, no trackers and no third-party scripts — the security policy the server sends with every page forbids external scripts outright, so you can verify this claim in your browser's developer tools rather than take our word for it.

One resource does load from a third party: the site's fonts come from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser fetches them directly from Google, which — as with any file fetched from the web — sees your IP address and user agent when it serves them. That is the only external request a page makes. Legal basis: our legitimate interest in serving the site reliably and consistently.

6.2 Talking to the support assistant

Using the chat is optional; the rest of the site works without it.

• Session identifier. When you first open the chat, your browser generates a random identifier and keeps it in the browser's own storage (localStorage), together with a local copy of the transcript so the conversation survives a page reload. Neither contains anything about you, and both are yours to delete — clearing the site's data in your browser removes them. The local transcript copy also clears itself after an hour of inactivity.
• What we store. The messages you send and the answers you receive are stored, as written, in a database in AWS region eu-central-1, keyed by that random identifier. The record is deleted 30 days after the last activity; the conversation history inside it is additionally cleared after an hour of inactivity and trimmed to the most recent 20 messages. We ask for no name and no account.
• The AI provider. To produce an answer, the text of the conversation — together with our own product documentation — is sent to Anthropic, whose language model generates the reply. We send the conversation text and nothing else: not your IP address, not your browser details. Anthropic processes it under its commercial API terms.
• Do not paste secrets or customer data into the chat. Whatever you type becomes part of the conversation record described above.
• Unanswered questions reach us. When the assistant cannot answer from the documentation, it reports the gap to us so the documentation can be fixed. That notification contains your question — including your last message verbatim — and a truncated session identifier. It contains no contact details unless you typed them into the chat.
• Abuse limits. To enforce daily usage quotas we count requests against a salted SHA-256 hash of your IP address (for IPv6, of its /64 prefix). The salt is secret, the raw address is never stored or logged, and the counters expire after 48 hours.
• Diagnostics. The backend's technical logs are kept for 30 days and contain no IP addresses; email addresses are masked before they can appear in an error message.

Legal basis: performing the service you request by using the chat, and our legitimate interest in protecting it from abuse.

6.3 Filing a bug or a change request

If you ask the assistant to file a bug or a change request, more is collected — at your request, and visibly:

• Your email address. You provide it, and we verify it by sending a confirmation code to it (from support@orgbench.io, via Amazon SES). We use this address to record who reported the issue and to send you exactly two kinds of transactional email: the verification code, and a confirmation carrying the ticket number. No newsletter, no marketing. An address that bounces or files a spam complaint is placed on a suppression list so we do not email it again.
• The report itself. The ticket contains the kind of report, a summary, your email address, and up to the last 20 messages of the conversation (verification codes are redacted from it). It is created in our issue tracker, Jira, hosted by Atlassian, and kept there for as long as we work on the issue and keep support records.
• Attachments. A screenshot or session log you attach is uploaded to a private, encrypted bucket, validated, transferred into the ticket, and then deleted from the bucket; an upload that never becomes part of a ticket is deleted automatically within 7 days.

Legal basis: steps taken at your request — the report cannot be filed, worked on or answered without this data. To exercise your rights over a filed report, including having it corrected or erased, write to the address in section 11.

6.4 What the site does not do

There is no payment processing (nothing is sold on the site today), no advertising, no profiling, and no selling or sharing of personal data for anyone's marketing. If a paid tier launches, payment will be handled by a payment provider under its own policy — we do not intend to see card numbers — and this policy will be updated before that happens.

7. Metadata may contain other people's names

Salesforce metadata is configuration, not business records: the product queries object, field, permission-set and dependency definitions, and never customer records such as Contacts or Leads.

Even so, configuration can name people. A sharing rule, a profile or an approval step may reference Salesforce usernames. When such metadata is compared or deployed, those names pass through your machine inside the metadata documents — copied, not interpreted. The product does not extract, index or store them separately, and none of it reaches us. If you are subject to data-protection law, note that you remain the controller of that metadata; we process none of it.

8. Your rights

Because the software sends us nothing, we hold no personal data from it, and there is nothing for us to give you access to, correct, or erase. Data you can control yourself is listed in section 3 — deleting those files is entirely in your hands and needs no request to us.

For data collected by the website, see section 6, and write to support@orgbench.io to exercise any right you have under the law of Ukraine, including access, rectification, erasure, restriction, portability and objection.

9. Children

The product is a professional developer tool. It is not directed at children and we do not knowingly collect data from anyone — of any age.

10. Changes to this policy

If the product ever starts collecting anything, this page will say so before that version ships, and the change will be announced in the release notes rather than buried here. A material change is not applied retroactively to a version you already installed: an existing installation continues to behave as described by the policy in force when it was released.

11. Contact

support@orgbench.io