This policy covers QueryStream only - the free SOQL query editor at satrangtech.com/salesforce-querystream/
QueryStream is designed with a zero-data-collection principle. We do not collect:
When you log in with Salesforce, the following happens:
Clicking "Login with Salesforce" redirects you to Salesforce's own login page (login.salesforce.com or test.salesforce.com). We never see your username or password.
After you approve access, Salesforce sends a one-time authorisation code to our server (callback.php). This is standard OAuth 2.0 and is how every Salesforce-connected app works.
Our server exchanges the code for an access token. The token is immediately passed to your browser via browser session storage - it is never written to a database, never written to a server log, and the server discards it the moment the handoff is complete. It then lives only in your browser tab's JavaScript memory.
Because browsers cannot call the Salesforce API directly (due to CORS restrictions), each query is sent through our proxy.php server. The token is passed in the request body (never the URL), used immediately to call Salesforce, and the server holds it only for the milliseconds the request takes. After the response is returned to your browser, the token is discarded from server memory.
QueryStream requests an OAuth refresh token alongside the access token so it can automatically renew your session when it expires (typically after two hours). The refresh token is handled identically to the access token - delivered to your browser via session storage and held only in JavaScript memory. It is never written to a database or server log. When you close your browser tab, the refresh token is destroyed permanently along with the access token.
The refresh token is never included in any URL even in fallback scenarios where browser session storage is unavailable.
QueryStream allows you to save named queries using your browser's local storage. Saved queries are stored entirely on your own device - they are never transmitted to our servers. Only the query name and the SOQL text are stored. No tokens, no org details, and no query results are ever saved.
You can delete saved queries at any time from within the app. Clearing your browser's local storage also removes them.
Our web hosting provider (HostPapa) maintains standard web server access logs that record the IP address, timestamp, and URL of each request. These logs do not contain Salesforce tokens (tokens are sent in the request body, not the URL), query text, or Salesforce data. These logs are maintained by the hosting provider for security and infrastructure purposes and are subject to their own privacy policy.
QueryStream does not set any cookies. Your theme preference (light or dark mode) is stored in your browser's local storage, not a cookie, and contains no personal information.
QueryStream loads fonts from Google Fonts (fonts.googleapis.com). This is a standard web font service. When your browser loads the page, it makes a request to Google's servers to download the fonts. This is subject to Google's privacy policy. No other third-party services, analytics platforms, or tracking scripts are loaded by QueryStream.
QueryStream is a professional Salesforce developer tool not intended for use by children under 13. We do not knowingly collect any information from children.
If we make material changes to this privacy policy, we will update the "Last updated" date at the top of this page. Given that QueryStream collects no personal data, material changes are unlikely.
If you have questions about this privacy policy or QueryStream's data practices, contact us at:
Satrang Technologies, Goregaon East, Mumbai, India