Security Overview
Overview
OctoFlow is a Chrome side panel productivity extension for individual salespeople. It helps a user track their own professional relationships, log their own outreach activity, and manage a personal to do list. It is a personal productivity tool. It does not integrate with, modify, or extract data from company systems. This page exists so IT and security teams can review OctoFlow quickly when an employee requests it on a managed browser.
Quick Facts
Everything on this page can be verified against the Chrome Web Store listing and our privacy policy.
Permissions Requested and Why
OctoFlow requests six narrow Chrome permissions:
Site Access
OctoFlow's network access is limited to its own backend and, only after the user connects them, the official Google and Microsoft mail APIs. It runs exactly one content script, described in the last row:
Optional Email Integration
Off by default. OctoFlow touches no email of any kind until the user connects their own Gmail or Outlook account through the standard Google or Microsoft sign in window. After connecting, OctoFlow reads message headers (sender, recipient, subject, date, thread id) of recent sent and received mail to log outreach with contacts the user already tracks and to detect replies. It never reads the body of any received email; for Gmail this is enforced by Google's servers, because the gmail.metadata scope refuses to return message bodies at the API level. Sending happens only when the user writes an email inside OctoFlow and clicks Send, from the user's own address through the provider's own API, with no relay or third party mail service in between. Sign in tokens are stored only in the browser's local extension storage on the user's machine, never on OctoFlow servers. OctoFlow adds no tracking pixels or read receipts to any email. The user can disconnect in Settings at any time, which deletes the tokens, and can additionally revoke access from their Google or Microsoft account security page. OctoFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The exact scopes requested:
Data Handling
The user's data (their contacts, notes, activity history, tasks) is stored locally in Chrome and optionally synced to Google Firebase under the user's own account. Sign in uses an email and PIN flow through Google Identity Platform. Data is encrypted in transit (TLS 1.2+) and at rest on Google Cloud. No data is sold or shared with third parties. Users can delete their account and all associated data from the extension's Settings at any time. Full details, including every data category we process and our sub processor list, live in our privacy policy.
What OctoFlow Does Not Do
No collection of browsing history. No keystroke logging. No reading or scraping of corporate systems or CRM data. No reading of received email bodies, ever: mailbox access is off by default, opt in, and header metadata only, as detailed in the email integration section above. Exactly one content script exists, on mail.google.com only, and it is a display only connection badge that reads nothing and sends nothing. No remote code execution: all code ships inside the Chrome Web Store reviewed package. No advertising or tracking SDKs. No tracking pixels or read receipts in email.
For IT Administrators
To allow OctoFlow on a managed browser: Google Admin console, then Chrome browser, then Apps and extensions, then add the extension ID aaobogaacakidgajkkfkkafjoeelakdc and set it to Allow install (or approve the employee's pending request). This follows standard Chrome Enterprise extension management. If your organization also restricts which apps may access Google Workspace data, the optional email integration additionally needs its OAuth client allowed under Security, then API controls, then App access control; an employee's connection attempt generates the request, or write to us and we will send the client ID and the exact scope list from the email integration section above. If your review process needs anything else, write to support@octoflowus.com and we will respond within one business day.