HaloYOUR TOOLS. YOUR DATA. THE DETAILS.
Useful by design.
Clear about your data.
What HaloUtils reads, where data is stored or sent, and how you can delete it.
THE SHORT VERSION
No built-in advertising, analytics, or developer telemetry. Local features do not require a HaloUtils account. The extension communicates with the Halo instances you configure.
Unsaved-change protection stays in your browser. To warn you before you discard work, HaloUtils compares what is in an open Halo editor with its last saved values in page memory. It stores none of that content and sends it nowhere.
Update Sets are disabled by default. If enabled, recorded configuration data may include personal information and confidential values.
Server sync is not publicly available yet. A separately operated compatible server can receive full update-set bundles if you configure and enable sync.
01. Data the extension uses
Navigation, inspection, and appearance
HaloUtils reads the current Halo page URL, route, title, form labels, field metadata, and relevant page state. Page tools can fetch ticket, user, agent, and related record data from your configured Halo instance using your signed-in session. A number typed in the command window is sent to your Halo instance as an exact-ID lookup. A name typed after /agents or /users, or as a bare /name that fits no command, is sent as a search term to Halo’s agent and user search (with Search accounts by Username only turned on, as a filter on the Username field instead; agent searches also ask Halo to include accounts shown in its agent configuration table), and /switch looks up the matching agent or user profile by linked ID or e-mail address. These responses may contain personal information, ticket details, custom fields, and other data your Halo account can access. Inspection snapshots and lookup results stay in page memory unless you copy data to the clipboard.
Agent and user lookups need the agent app’s token. On portal pages, where only a portal token is present, HaloUtils reuses an agent app token it has already seen for that instance. Otherwise it briefly loads that instance’s own agent app in a hidden frame on the page so Halo issues a token from your existing agent session. No password is entered, and the frame loads only your configured Halo origin. If you are not signed in to the agent app, the command window asks you to sign in and retry.
Impersonation helpers search for agents or users and make requests to Halo’s impersonation API when you use them. They use your existing Halo permissions and keep state to identify the active impersonation and return to the original interface. The extension may read Halo’s existing access token and cached custom-table metadata from the Halo site’s local storage for these helpers. Some appearance preferences are kept in the Halo site’s storage. The language command reads available languages and updates the signed-in agent’s or portal user’s language preference in Halo. Login and reauthentication helpers navigate through Halo’s own authentication flow and may include the current page path in a return URL.
Unsaved-change protection
Confirm before discarding unsaved changes is enabled by default and can be turned off in Settings → Page Behavior → Unsaved changes. On configured Halo hosts, HaloUtils runs a script in the Halo page’s own context, which it needs to read the state of Halo’s editors. For workflows, runbooks and their steps, ticket types, custom fields, custom integrations and methods, and the dialogs that open from them, it reads the editor’s saved and edited values, including the diagram layout and the text typed into form fields, and compares them to see whether closing or leaving would lose changes. It also listens for clicks, key presses, form changes, and page unloads, wraps the browser’s history functions to intercept navigation, and watches the page for editors appearing or disappearing.
These comparisons exist only in page memory while the editor is open. HaloUtils does not save the content, send it to a server, or add network requests for this feature, and read-only views are never treated as changed. When something would be lost it shows a Keep editing or Discard changes dialog with the HaloUtils logo, or, for a reload or tab close, triggers your browser’s own confirmation. Because the script shares the page context with Halo’s own code, Halo’s scripts could in principle observe it, including the document attributes and logo address described under storage and permissions.
Optional navigation color sync
Sync color from Halo is disabled by default for each instance. When enabled, HaloUtils reads the navigation color already cached by Halo’s agent app in the Halo site’s local storage (navcolour, from Halo’s nav_colour setting). It checks for changes while the agent tab is visible and saves the color in that instance’s extension settings. This feature makes no additional API requests, sends no color data to a server, requires no additional browser permissions, and does not change Halo’s own color setting. The saved color and opt-in are included if you export your command and instance configuration.
First-run setup and release notes
After a fresh install, HaloUtils opens a setup page packaged with the extension. It saves your choices (instances, theme, command window behavior) in extension storage, and contacts a server only if you enter a shared configuration URL or grant access to Halo hosts. Release notes are packaged with the extension, and the optional one-time notice after an update is shown on a configured Halo page without any network request.
Your Halo session
On configured Halo hosts, HaloUtils observes authorization headers on Halo API requests and temporarily caches the bearer token. It reuses that token to authenticate its own requests, including record inspection, agent lookups, language changes, and enabled update-set workflows. This observation can happen while the extension is active on a configured host, including when Update Sets are disabled. Page tools can request the authorization header observed for their own tab and origin; that tab-specific cache is cleared on navigation or tab closure. The separate per-origin cache remains in extension session storage and memory for worker requests. You do not enter your Halo password into HaloUtils.
Configuration changes and update sets
Panel resizing, field styling, and the other page adjustments read and write only local preferences; they send nothing. When you save settings, open Halo tabs re-read them from extension storage, and also when a tab becomes visible again or is restored, so a background tab never keeps stale settings. This stays within your browser. Update-set data is collected only when the feature is enabled. Turning it off keeps existing local update-set data.
During recording, the extension reads Halo’s native /api/ConfigCommit change log and selects commits matching the recording agent and recording time windows. It stores update-set names and descriptions, agent identifiers and names, timestamps, tenant origins, record identifiers, endpoint paths, captured operations, configuration payloads, and available rollback data. Pinned page metadata, notes, execution logs, and target snapshots may also be stored.
Captured payloads are not guaranteed to be free of personal information or secrets. Halo may mask or encrypt some values in its change log, but raw commits and API snapshots can still contain sensitive content. HaloUtils does not promise comprehensive redaction or additional encryption of those records.
02. Where data is stored
| Location | What it contains |
|---|---|
| Extension local storage | Commands and aliases, feature preferences (including the setup choices you make on the first-run page, the unsaved-change confirmation, and the Username-only account search), the Update Sets opt-in, instance hosts and appearance (including the color-sync opt-in and last synced color), the extension theme preference, palette position, active update-set ID, deletion markers, script registration metadata, shared configuration state (the URL, check times and status, the last version of each shared entry that the server sent, entries you deleted or customized, and unresolved conflicts), sync status, and sync settings. The configured sync username and personal access token (PAT) are stored here; the PAT is not encrypted separately by HaloUtils. |
| Extension session storage & memory | Observed Halo API bearer tokens, page context, capture diagnostics, sidebar workspace preferences such as the selected update set, filters, search terms, and scroll positions, and JSON inspector snapshots held in page memory. These are transient rather than part of the persistent update-set database. Browser session storage is normally cleared when the browser session ends or the extension is reloaded. |
| Browser IndexedDB | The halo-update-sets database contains update sets, operations, snapshots, mappings, replay and rollback plans, logs, and notes. |
| Halo site storage | HaloUtils stores the Escape-key, left-navigation, and unsaved-change confirmation preferences, the widths of resizable panels (per Halo instance), return-navigation state, pending impersonation commands, and impersonation state in the Halo origin’s local or session storage. When color sync is enabled, it also reads Halo’s existing cached navigation color without changing that cache. Local state may survive a browser restart. HaloUtils also sets attributes on the Halo page’s root element (the Escape-key and unsaved-change preferences, and the address of its logo) so its page-context scripts can read them. They live in page memory and are readable by Halo’s own scripts. |
| Files & clipboard | Exports you save contain update-set data or the parts of your configuration you select: instances, slash commands, and other settings. Sync server credentials and the shared configuration URL are never included in a configuration export. Copy actions place the selected field value, identifier, or record JSON on your system clipboard. Files and clipboard contents are then subject to your device’s controls. |
The extension does not use browser account sync (chrome.storage.sync) for its settings. Browser profiles, device backups, and your operating system may retain copies independently of HaloUtils.
04. Why browser permissions are needed
Halo host access is optional. Saving instances requests access to the configured HTTPS hosts, including custom Halo domains. An instance can be entered as a domain suffix, in which case HaloUtils requests wildcard access to that domain’s subdomains (for example https://*.haloitsm.com/*) instead of one exact host. The manifest permits requesting HTTP/HTTPS hosts so different installations, the future server-sync component, and remote command configuration sources can be configured; it does not grant access to every website on installation. The server-sync component is not publicly available yet and will follow at a later point. Removing or replacing instance settings releases host permissions that are no longer needed by the configuration.
Optionally, you can point HaloUtils at a configuration JSON file hosted on a server you choose, in Settings → Import/Export → Server or during the first-run setup. When a URL is connected, the extension fetches that file at browser startup and about once per hour, and keeps your commands and instances in sync with it field by field, preserving the changes you made yourself. It requests host access to the configuration server itself and, after a background check adds Halo instances, it asks through a notification and popup before you grant the additional page access. Stopping the sync removes HaloUtils’ access to the configuration server. If no configuration URL is set, none of this happens.
The HaloUtils logo is declared as a web-accessible resource for HTTPS pages, so release notices and unsaved-change dialogs shown inside Halo can display it. It is a static image and gives no access to your data, but in Chromium browsers any web page can request it and so detect that HaloUtils is installed.
| Permission | Purpose |
|---|---|
storage | Store extension settings and working state. |
scripting & host access | Register and run the page tools on the Halo hosts or domain suffixes you configure, and load the current page tools into already-open Halo tabs after an install, update, or reload so they need no refresh. Some of these tools (Escape-key handling, left navigation, and unsaved-change protection) run in the Halo page’s own context. Optional server access allows sync requests and remote command configuration fetches. |
alarms | Repeat the hourly shared configuration check while a configuration URL is set. |
webRequest | Observe authorization headers on configured Halo API requests to reuse your signed-in session. Captured configuration changes themselves come from Halo’s change log. |
activeTab & tabs | Identify the current page, open or duplicate tabs (commands open in a new tab by default), navigate between instances, and provide the panel or popup workflow. |
sidePanel (Chromium) | Show the Chromium side panel. Firefox declares a sidebar for the same workspace, opened from its toolbar button. Both builds also declare keyboard shortcuts in the manifest. |
notifications | Display extension status and error notifications, including the reminder to allow access to newly shared instances. |
The Firefox build also declares Mozilla’s required data categories: authentication information, browsing activity, and website content. These cover the session credentials, page context, and Halo data described above; they do not identify an additional recipient.
05. Retention, deletion, and your controls
Persistent extension data has no scheduled automatic expiry. It remains until you delete it or clear the relevant browser storage. You can change settings, remove configured hosts, delete local update sets, clear extension storage, or uninstall the extension. Disabling Update Sets preserves existing data and saved sync credentials; re-enable the feature to use its review, export, or deletion controls. It does not revoke Halo host access or stop session observation used by other page tools.
Turning off Confirm before discarding unsaved changes stops the warnings; the preference is kept in extension storage and Halo site storage until you change it, clear that storage, or remove the extension. No editor content is ever persisted, so there is nothing to delete.
Turning off Sync color from Halo stops future color updates for that instance and keeps its last saved color for manual editing. Removing the instance or clearing extension storage removes that local setting; Halo’s own cached color and previously exported files are unaffected.
The server-sync component is not publicly available yet and will follow at a later point. The server-specific controls below apply if you later use a separately operated compatible server.
- Local deletion is not server deletion. Deleting an update set locally leaves a local deletion marker to prevent that browser from downloading it again. It does not remove the server’s copy or other users’ copies.
- Disabling update-set sync stops future bundle syncing. It does not erase data already sent or automatically remove saved credentials. Clear the sync fields separately, and have the server administrator revoke the PAT when it is no longer needed.
- Server deletion is administered separately. Ask your sync administrator to remove shared update sets and address audit records, user records, backups, and applicable retention requirements. Server-wide update-set deletion uses deletion markers to propagate the change to clients.
- Removing the extension normally removes its own storage. It does not delete exported files, clipboard copies, Halo tenant records, Halo site storage, or copies on a sync server. Halo site data can be cleared separately through the browser’s site-data controls; doing so may also sign you out of Halo.
- Changes already applied to Halo remain in Halo. Deleting an update set does not reverse a replay. Rollback is a separate operation and depends on the available rollback data.
06. This website
This website uses no analytics, advertising scripts, tracking pixels, or cookies. The theme switch stores your color-theme choice (light, dark, or system) in your browser’s local storage; no other browser storage is used on the public site. Styles, scripts, and images are served with the website; text uses locally available system fonts, with no third-party font requests or embedded widgets. The interactive preview uses fictional sample data held in page memory and does not connect to Halo or the extension. Install buttons read your browser’s user agent locally to choose the Chromium or Firefox store listing; this detection does not store or send any data.
If you access the password-protected preview, it stores a derived decryption key in the tab’s session storage so you can navigate between preview pages. The password is processed locally and is not sent to a server. The preview’s Log out button removes that key; closing the tab normally ends the storage session.
Loading the site necessarily sends connection information, including your IP address, requested URL, and browser request headers, to the hosting infrastructure. A hosting provider or reverse proxy may keep access and security logs; their configuration and retention are separate from the static website code. Contact the privacy address below for questions about the deployed site’s hosting.
Following a Chrome Web Store, Mozilla Add-ons, or source-repository link takes you to that provider, which processes the visit under its own privacy terms. If you email us, we receive your email address, message, and any attachments and use them to handle your enquiry. Please avoid including Halo credentials or customer records.
07. Contact and your rights
For questions about HaloUtils or this website, contact privacy@ruehmann.net.
The server-sync component is not publicly available yet and will follow at a later point. If you use a separately operated compatible server in the future, your organization and that server’s operator determine the purposes, access rules, legal basis, and retention for their processing. The extension developer does not automatically receive your locally stored extension data or data on a separately operated server. Requests about those records should go to the relevant operator.
Where applicable under data protection law, you may request access, correction, deletion, restriction, or portability of personal data, object to processing, withdraw consent for processing based on consent, and complain to your competent supervisory authority. Contact us about data we hold, such as privacy correspondence, or your organization about its Halo and sync records.
This notice describes the implementation reviewed above. It will be updated when HaloUtils’ data handling changes.