Cloud Manager AEM Cloud Manager Companion Privacy Policy
Effective October 22, 2026. This policy describes version 0.6.1 of the extension.
Purpose and information handled
The extension lets you view and manage Adobe Cloud Manager environments, pipelines, and runtime variables. It handles the Adobe Client ID, Organization ID, Program ID, OAuth scopes, Client Secret or manually supplied access token that you provide. It retrieves environment and pipeline information, execution details, and runtime variables from Adobe when you use these features. Commands and variable values you submit are sent to Adobe to carry out your requested actions.
Local storage and retention
Environment and pipeline display metadata, execution summaries, and approval/cancellation link paths are temporarily cached in memory-backed Chrome session storage to avoid repeated API reads. This snapshot is scoped to the connection profile, integration, organization, program, and scopes. It is cleared when the browser session ends. The display cache excludes credentials and runtime variable values.
Connection identifiers, scopes, environment aliases, environment ordering and visibility, appearance preferences, and pipeline display preferences are stored locally in your Chrome profile. They are not encrypted by the extension. They remain until changed, removed, or the extension is uninstalled.
Each program connection profile stores its own identifiers and optional saved credential. Tokens and display caches are isolated by profile. Selecting a profile changes the active program across open extension pages. Deleting a profile removes its credential, token, cached metadata and local environment preferences. Variable drafts, including replacement secrets, remain in trusted-context, memory-backed Chrome session storage, separated by connection and environment. They survive popup closure until Save, explicit Discard, or profile deletion. Chrome restart or extension reload, update, or disable also clears drafts. They are not written to local or sync storage.
Saving your Client Secret is optional and requires explicit consent. The saved value is encrypted with AES-256-GCM using a fixed key bundled with every copy of this extension and a fresh random nonce. This is obfuscation, not a secure vault: anyone with the extension code and saved data can decrypt it, including copies across Chrome profiles. No vault password or passkey is requested. This protection must not be relied on to keep a secret confidential from someone with access to your browser profile.
A saved secret is retained until replaced, forgotten, or the extension is uninstalled. It is decrypted internally when an access token must be generated, including on first use after browser restart. The extension does not display or export the saved secret. No Adobe credential is bundled with the extension and no credential is synced through Chrome Sync.
Access tokens and their expiry information remain in trusted-context Chrome session storage. This memory-backed storage clears when Chrome restarts or the extension is reloaded, updated, or disabled. The next API request generates a replacement token from the saved secret without an unlock prompt. There is no idle background polling. A secret entered for one-time generation is not saved, and its form field clears after credential operations.
Runtime variable values are not persisted by the extension. Retrieved Cloud Manager data is held in the open page while it is used.
Migration from earlier versions
An existing single-program connection is automatically moved into the first connection profile, preserving saved-credential format and consent. Other program profiles start empty.
Earlier password-protected records remain unchanged until you explicitly replace or delete them. Re-enter your Adobe secret and save it with consent to enable passwordless renewal. If a previous unlocked secret remains in session memory, it can be converted after consent without re-entry. The extension does not silently remove password protection.
An earlier plaintext saved secret is moved into temporary session storage and its active local record is removed. Settings offers conversion before restarting Chrome or reloading the extension. Forget also discards this temporary copy. Removing the active record does not securely erase historical disk remnants or backups.
Transmission and sharing
The Client ID, Client Secret, and requested scopes are sent over HTTPS to Adobe IMS at ims-na1.adobelogin.com to generate an access token. The access token, Client ID, Organization ID, program and resource identifiers, and requested actions or variable values are sent over HTTPS to cloudmanager.adobe.io. Adobe processes these requests under your Adobe agreement and its own privacy practices.
The extension has no developer-operated backend, analytics, advertising, telemetry, or data sales. It does not send your credentials or Cloud Manager data to its developer or other recipients. Clicking an external documentation or support link opens that destination, which has its own privacy practices.
Your controls
- Clear token removes the access token and metadata but keeps the saved credential. The next API request can generate a new token automatically.
- Forget saved secret deletes the saved credential and clears temporary migration data and the access token. Automatic renewal then stops until credentials are saved again.
- Edit connection settings and aliases in the extension. Uninstall it to remove its local settings and saved credential.
These controls do not revoke credentials or tokens at Adobe and cannot cancel an API action already sent. To revoke or rotate credentials, use Adobe Developer Console or contact your Adobe administrator. The fixed bundled key does not protect credentials from someone who can read the saved data and extension code.
Permissions and Limited Use
The storage permission supports settings, optional saved credentials, and session credentials. Access to the two Adobe hosts supports authentication and Cloud Manager actions. The extension requests no browsing-history, all-sites, native-messaging, or content-script access.
All user data is used only to provide the extension's stated Cloud Manager functionality. It is not used for advertising, sold, or made available for developer human review.
Questions
For privacy questions, use the project support channel on GitHub. Issues are public; include only a general description and never post credentials, tokens, variable values, or private account information.
Website hosting
This presentation site uses no analytics, cookies, remote fonts, or Adobe API requests. It is hosted on GitHub Pages; GitHub processes connection information under its privacy statement. This website cannot access your extension settings or credentials.