Privacy Policy

FluxMule is a browser-native MuleSoft development workbench. It runs entirely in your browser. We do not operate a backend that receives your code, and we do not collect analytics or telemetry.

What FluxMule stores, and where

FluxMule uses three storage areas. The distinction matters: chrome.storage.local and localStorage stay on this device, while chrome.storage.sync is replicated across your own Chrome profiles by Google sign-in sync (never to us).

Data	Storage area	Leaves this device?
Secrets — GitHub token, GitHub OAuth client secret, Anypoint client secret, Anypoint password, Azure DevOps PAT	chrome.storage.local	No — never synced, never sent to us
Non-secret config — default commit message, GitHub OAuth client ID, Anypoint client ID, Anypoint plane (us/eu/gov), Anypoint org ID, Anypoint username (apUser), private Exchange asset coordinates you browse (exchangeModules: name + groupId + assetId + version), active git provider	chrome.storage.sync	Yes — to your own Google account only. Replicated across your Chrome profiles by Google sync. Never sent to us.
Local device cache — diagrams, REST Client request history, REST Client environment variables, recent repos, saved palette shapes, theme, panel sizes, preferences	localStorage	No — stays in this browser profile, not synced

Secrets never leave this browser device. All Git / Anypoint / Azure calls are made directly from your browser to those providers using the credential you supplied; FluxMule has no server in the middle.

Note on Google sync: the non-secret config row above is replicated by Chrome's built-in Sync to your other signed-in Chrome profiles. This includes your Anypoint username and the coordinates (not the contents) of any private Exchange assets you browse. If you do not want this replicated, sign out of Chrome Sync or disable extension sync in Chrome settings. No secret is ever placed in this area.

REST Client environment variables

The REST Client lets you define environment variables (e.g. baseUrl, token) that are substituted into requests via {{name}}. These are stored unencrypted in this browser's localStorage and never leave the device. Do not store production secrets there — prefer short-lived tokens, and clear them when done. The in-product editor shows this caveat.

Network access

FluxMule only contacts:

• github.com / api.github.com / *.githubusercontent.com and dev.azure.com — to read repositories and run the CI you trigger. FluxMule reads your existing github.com browser session (a request to github.com with your cookies) only to detect which GitHub user you are signed in as, so you don't have to paste a token; it does not transmit that session anywhere.
• *.blob.core.windows.net — to stream the raw GitHub Actions job log of a build you started (GitHub serves those logs from signed Azure Blob URLs).
• anypoint.mulesoft.com (and eu1/gov) — only if you sign in to Anypoint.
• The exact host you type into the REST Client — only when you press Send. FluxMule requests permission for that host on demand the first time.

No other network requests are made. There is no usage tracking, no analytics, and no advertising.

DataWeave / debugging

The DataWeave Playground and flow Debugger run a clean-room subset interpreter in your browser and are labeled "preview". They are not the official MuleSoft DataWeave runtime — outputs are previews. They do not upload your data. The only real outbound calls during debugging are http:request operations in your own flow, which go directly to the host you configured.

What we do NOT do

• We do not sell or transfer your data to third parties.
• We do not use your data for advertising, creditworthiness, or any purpose unrelated to running the extension.
• We do not run a server that receives your code, credentials, or activity.

Your control

Remove all stored data at any time via Settings → Data → Clear, or by removing the extension. Uninstalling deletes all local data. Synced config can also be cleared from any signed-in Chrome profile.

Affiliation

FluxMule is an independent tool. It is not affiliated with, endorsed by, or sponsored by Salesforce/MuleSoft, GitHub, or Microsoft. MuleSoft, Anypoint and DataWeave are trademarks of Salesforce; GitHub is a trademark of GitHub, Inc.; Azure is a trademark of Microsoft.

Contact

alexander.deroui@ingenierobinario.com