YOUR DATA

Privacy policy

Effective October 15, 2026. This policy describes AEM CDN Toolkit 2.6.0, maintained by the owner of the lollegp/aem-cdn-toolkit-extension repository.

Purpose

The extension helps you manage Adobe AEM CDN cache and authenticated publish access for environments you configure. No account with the extension developer is required.

Data used and stored

• Configuration: environment names, public and publish URLs, country mappings, preferences, edge keys and purge keys are stored locally in Chrome extension storage. Keys are plaintext in your browser profile, not an encrypted vault.
• Page URLs: the extension reads the active tab after you invoke it and receives updates for hosts you permit, to match environments and perform page actions. It does not request access to Chrome browsing history or read page content.
• Activity: up to 100 purge records are stored locally, including time, environment, country, publish origin and path, mode, result and request IDs. New records omit URL query strings and fragments. Records created by older versions may contain query strings; use Clear activity to remove them.
• Session state: publish-tab context and scoped request-header rules temporarily associate your configured edge key and public hostname with a publish tab.

Where data is sent

When you open publish, the configured edge key and forwarded public hostname are attached to requests to that exact publish origin in the created tab. Purge sends the edge key, purge key, forwarded public hostname, purge mode and target URL directly to your configured HTTPS publish service. Page query parameters can be included in the actual publish or purge request. Adding a cache parameter navigates your existing page.

The extension has no developer backend, analytics, advertising, remote code, or telemetry. The developer does not receive your configuration, keys, page activity or purge records. Your configured services process requests under their own policies. Normal publish navigation may use that service's existing browser cookies; purge requests omit cookies.

Permissions and control

Host access is requested for the explicit HTTPS hosts in your configuration. The extension uses active-tab access, local and session storage, and tab-scoped request-header rules to provide its features. Incognito is available only after you enable “Allow in Incognito” in Chrome's extension settings. Saved configuration and keys are shared between regular and incognito browsing. Configuration is not synced by this extension.

Exports exclude keys by default. If you choose to include keys, protect the downloaded JSON as a credential file. Imported files are processed locally.

Incognito activity

Purge requests made from incognito tabs are not written to persistent activity history, including failed and interrupted attempts. Their results are shown in the popup. Publish tabs and windows retain the source page's browsing mode. Temporary publish context and header rules are kept for the tab and removed when it closes. Settings and saved activity open in a regular window; configuration changes persist for both browsing modes. Requests still send the credentials and URLs needed to your configured services, whose logging and privacy policies apply.

Retention and deletion

Configuration remains until you edit, reset it, or uninstall the extension. Reset configuration clears environments, keys and publish session state but keeps activity. Clear saved keys removes keys and active header rules while retaining mappings. Clear activity deletes local purge history. Closing a publish tab removes its associated header rule and context. Uninstalling removes extension storage; files you exported remain wherever you saved them.

Use limitations and third parties

Data is used only to provide these user-facing features. It is not sold, used for advertising, or transferred to data brokers. Use and transfer of information received through Chrome APIs follow the Chrome Web Store User Data Policy, including Limited Use requirements.

The public help site is hosted on GitHub Pages. Visiting it or opening a GitHub support link is subject to GitHub's privacy practices and hosting logs. These pages contain no analytics or tracking scripts.

Contact and changes

For support or privacy questions, open an issue in the project repository. Issues are public: do not post keys, private URLs or other sensitive information. Policy updates will be published on this page when handling practices change.