Legal

Privacy policy

Last updated: 7 September 2026

Draft. Not publishable as it stands. Three values are missing, and each is marked TO SUPPLY in the text below. A policy shipped with a placeholder will be rejected by the Chrome Web Store, and a reader doing due diligence stops at the first one.

1. The controller's legal name and postal address. "KojiDevs" is a product name, not a legal person: until a company exists the controller is a natural person, and Article 13(1)(a) wants that person's real name and an address.
2. A monitored contact email. It receives every access, erasure and portability request, so it has to work.
3. The AI model provider and the country it processes in. The gateway currently configured resolves to an unidentified host outside the EEA, with no published operator and no data processing agreement. It cannot be named here honestly, and describing it does not make it lawful. Replace it first.

Delete this notice once those are filled in.

HolySN is a browser extension for people who build on ServiceNow. This policy explains what it stores, what leaves your browser, who else sees it, and what it never touches.

Controller: TO SUPPLY: full legal name, of TO SUPPLY: postal address

Contact: TO SUPPLY: monitored email address

There is no Data Protection Officer. The service does not meet the Article 37 thresholds that would require one.

In one screen

What HolySN is, in privacy terms

Most of HolySN runs inside your browser, against the ServiceNow instance you are already signed in to. Three things leave it: your account and workspace, which sync between your machines; what you ask the AI assistant, which goes to a model provider; and what you choose to share, with a colleague or on the public shelf. Everything else stays local.

Data we collect

Account and identity

Your email is used for sign-in, account email and support. It is not used for marketing.

A profile picture is redrawn onto a 256x256 canvas in your browser before upload, so EXIF metadata — including the GPS coordinates a phone photo carries — is discarded and never reaches us.

Your workspace

Profiles, saved scripts, snippets, script packages, themes and preferences are stored so they follow you between machines. This is content you write yourself. Every row is bound to your account and readable only by it, enforced by database policies rather than by the interface.

Saved scripts are stored as you wrote them. If you paste a record's data or a hardcoded value into a script, that is what gets stored.

Messages between connections

If you add a colleague and use the built-in chat, those messages are stored so they can be delivered, along with who sent what and when it was read. They are readable by you and by the person you sent them to.

Instance credentials (optional)

If you use the credential vault, the instance password and TOTP secret are encrypted inside your browser with a passphrase that never leaves your device. What we store is ciphertext. We cannot decrypt it, and neither can anyone who obtains the stored data. Forgetting the passphrase means the entry is unrecoverable.

Stored readable. Alongside the ciphertext we store, in the clear: the customer or company label you typed, the environment name, the instance hostname, and the instance username. None of those is a secret and the interface lists them — but together they say which customer you work for. If that matters, use a label that does not name them.

Shared sessions (optional)

If you share a ServiceNow session with another HolySN user, the session cookies are encrypted end to end with the recipient's public key before they reach our servers. We store the ciphertext, we cannot read it, and it is deleted when the grant expires, is revoked or is consumed.

Stored readable. Two parts of a share are not encrypted: the instance hostname, and the CSRF token (g_ck) the two browsers relay to each other so their requests do not knock the shared session over. The token is short-lived and useless without the session cookies, but it is stored readable and we would rather say so than imply otherwise.

An audit record of every offer, acceptance, revocation and expiry is kept. It never contains a cookie or a key.

The AI assistant

If you use the assistant, we store your conversations in full so a chat survives closing the tab; short technical facts it learned about your instance — table structures, naming conventions, decisions, gotchas — each tied to the instance hostname, with a numeric embedding used to find them again; and the trace of an agentic run: the steps the model took, the tools it called, and any update-set XML it produced.

What may enter that memory is restricted three times over. The browser strips personal data before anything is sent, the server strips it again, and the database rejects a row outright if anything got past both. Only seven categories of technical fact can be stored at all; anything that is not one of them is dropped before its content is even inspected.

Voice input (optional)

If you dictate instead of typing, your browser records audio and sends it once to be transcribed. The audio is not stored — not by us, and not by the transcription provider we forward it to under our contract with them. It is forwarded, transcribed and discarded with the request. What survives is the text, placed in the input box for you to correct before you send it.

Recording only happens while you hold the dictation control. Your browser will ask for microphone permission the first time.

Recorded UI tests (optional)

If you record a test to replay later, the recording is stored so it follows your profile between machines.

Real instance data, unfiltered. A recording contains table and field names, the values typed into forms, and the sys_ids of the records that were open. This is not filtered the way the assistant's memory is.

Fields the platform marks as secret are excluded by the recorder and replaced with a placeholder that is asked for at replay time. Everything else is stored as recorded. Do not record a flow over production data you would not want stored.

Activity

We count which commands you run and on which day — the command name and the date, tied to your account, so the activity view is the same on every machine you use.

The argument is never counted. /sysid 9c57… is stored as one run of sysid and nothing else, because the argument is the part that would say which customer you were working for. The instance is not stored either. The table is shaped so that it cannot hold those facts, which is stronger than promising not to write them.

The public shelf

If you publish a snippet or script to the marketplace, it becomes readable by every signed-in HolySN account, together with the author name you chose. That is the point of publishing, and it is not reversible for anyone who already copied it. Withdrawing a published item removes it from the shelf, not from the machines of people who took it.

Data we do not collect

• No browsing history, page contents, clicks or keystrokes from anywhere outside the ServiceNow instances you use the extension on.
• No third-party analytics, advertising or tracking SDKs. There are none in the code.
• No crash reporting.
• No location, health, financial or payment data.
• No data used for advertising, for profiling, or for credit or lending decisions.
• No sale of data to anyone, under any definition of sale.

Why we are allowed to hold it

Where the basis is consent, you give it by performing the action and you can withdraw it by stopping. Withdrawal does not undo what was already sent.

Your ServiceNow instance

HolySN reads your ServiceNow session cookie so that the requests it makes on your behalf — reading the active update set, running a background script you asked for, fetching a record you are looking at — are authenticated as you. That cookie is used only against the instance it came from. It is never sent to our servers or to any third party, except in the optional shared-session feature above, and then only encrypted for the recipient.

Data about other people

A ServiceNow instance is full of records about people who are not you: callers, assignees, requesters, approvers. Three features carry that data off your machine: the assistant, when it needs to read records to answer; recorded UI tests; and attachments.

For that data you or your employer are the controller and we act as a processor on your instructions. Using those features means you consider yourself entitled to send that data through this service. If you need a data processing agreement under Article 28 before you can, write to the contact address and ask for one.

Record data that HolySN merely displays — the records you inspect, the update sets you browse — stays in your browser and is not uploaded.

Attachments the model cannot read safely

You can attach files to a message to the assistant. Text files are scrubbed like everything else before they are sent.

Sent unfiltered, on purpose. Images and PDFs cannot be scrubbed, and are sent as they are. A screenshot of an incident carries every name, address and number that the scrubber strips out of the message beside it.

The interface says so next to the button. It is repeated here because it is the one place in HolySN where personal data leaves your machine unfiltered and by design.

Who else sees your data

The ServiceNow instance you use is not a recipient in this sense: it is yours, and HolySN talks to it as you.

We do not sell your data, transfer it for advertising, or use it to assess creditworthiness.

Transfers outside the EEA

Your account data and everything in the database is stored in Sweden and does not leave the EEA at rest.

Transfers do happen for the AI features and for support access, to the recipients marked US above. They rely on the European Commission's Standard Contractual Clauses, in the data processing agreements we hold with those providers.

If you do not want your data leaving the EEA at all, do not use the AI assistant, dictation or agentic runs. Everything else works without them.

How long we keep it

Deleting an item in the extension deletes it here.

How it is protected

• Everything travels over TLS.
• Every row in the database is bound to an account and readable only by it, enforced by database policies rather than by the interface. A bug in the interface cannot serve you someone else's row.
• Vault secrets are encrypted in your browser with a key derived from a passphrase we never receive.
• Shared sessions are encrypted end to end for the recipient's device.
• What the assistant may remember passes three independent filters, the last of which is in the database itself and cannot be bypassed by a faulty client or a manipulated model.
• The keys that talk to the model providers exist only on the server and are never present in the extension.

No system is perfect. If we discover a breach affecting your personal data, we will notify the competent supervisory authority within 72 hours as required by Article 33, and notify you directly where Article 34 requires it.

Your rights

Under the GDPR you have the right to access the data we hold about you and receive a copy; rectify anything inaccurate; erase your data; restrict processing while a dispute is resolved; port your data in a structured, machine-readable format; object to processing based on our legitimate interests, including the usage counts; and withdraw consent at any time where consent is the basis.

Write to the contact address at the top. We will answer within 30 days.

You also have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali.

Deleting your account

There is not yet a delete button in the extension. Write to the contact address and the account and everything attached to it will be removed within 30 days: profiles, scripts, snippets, chats, assistant memory, vault entries, themes, recorded tests, usage history, your profile picture, the messages you sent, and anything you published to the public shelf.

Messages you sent to another user are deleted with your account, which means they also disappear from that person's copy of the conversation.

Automated decision-making

The assistant proposes changes to your instance. It does not make them. Every change is applied by you, deliberately, after seeing what it would do.

There is no automated decision-making producing legal or similarly significant effects, within the meaning of Article 22.

Children

HolySN is a tool for professional ServiceNow developers. It is not directed at children and we do not knowingly create accounts for anyone under 16.

Changes

If this policy changes materially, the date at the top changes and the new version is published at this same address before the change takes effect.