Privacy
What GlideLens does with your data
Last updated 23 August 2026 · applies to GlideLens v0.11.1 and later
There is no GlideLens server. No account, no telemetry, no analytics, no error reporting, no third parties. Nothing GlideLens reads is sent anywhere we control, because there is nowhere for it to go.
It reads your ServiceNow instance the same way you do — through that
instance's own API, on your own logged-in session, with your own
permissions. It cannot see anything you could not already see, and it works
only on *.service-now.com pages.
What it reads, and why
All of this is processed on your device, in your browser, while you are using the feature that needs it. None of it is transmitted anywhere except back to the ServiceNow instance it came from.
| What | Why |
|---|---|
| Page content on ServiceNow tabs — form labels, fields, catalog variables and their values | To place variable icons, to list the fields a form shows for Translation Lens, and to read and set values on catalog forms |
| Records from your instance's Table API — dictionary entries, the summary fields you choose to search, catalog variables, client scripts, UI policies, script source, attachment filenames | Record search, code search, catalog debugging, translation lookups and variable prefill. These are ordinary API reads on your session |
| The current tab's URL, table name and record sys_id | To work out which record you are on, for Record Search preselection, "Copy sys_id", and the record-scoped commands |
| Your username and display name, and the instance's node and version | Shown in the toolbar popup so you can tell which instance and which identity you are working against |
While Debug Timeline is recording: g_form calls, field
events, GlideAjax requests and responses, and JavaScript errors |
To produce the timeline. See the caveat below |
Authentication
Reading your instance's API requires ServiceNow's CSRF token
(g_ck). GlideLens reads it inside the instance's own page, attaches
it as a header on requests to that same instance, and does
nothing else with it. It is never stored, never copied into extension storage,
and never sent to any other destination. Your session cookie is handled by the
browser exactly as it is for any other request to that instance.
Debug Timeline traces
A Debug Timeline recording captures what your form actually did, which means a trace can contain real data from the record you were working on — field values, GlideAjax parameters and responses. Values whose field or parameter names look like secrets are redacted, and the trace is capped and discarded when you close the page. But it is your data, and it only leaves your device if you copy it out and paste it somewhere. Read a trace before you share it in a ticket or a chat.
What is stored on your device
GlideLens uses your browser's local extension storage for exactly three things. All of it stays on your machine, and all of it disappears when you uninstall the extension.
- Which command you pinned in the palette.
- A per-instance map of what code search can reach — table and field names from your instance's search configuration, cached for seven days so a search does not re-check it every time.
- A per-instance record of which fields exist on the tables code search reads, cached the same way.
The last two hold configuration metadata — names of tables and columns — not the contents of any record. Nothing else is persisted: everything else GlideLens reads lives in memory while a panel is open and is gone when you close it.
What leaves your device
Nothing, other than requests to the ServiceNow instance you are
already signed in to. The extension makes network requests to exactly
one place: the origin of the ServiceNow tab you are on. It has permission to
reach https://*.service-now.com/* and nothing else, so it could
not contact a third party even if it tried to.
There is no analytics, no crash reporting, no usage counter, no A/B testing and no remote configuration. The extension contains no remotely-loaded code: every line that runs ships inside it and is readable in the public repository.
What GlideLens writes
It is a read-only tool with one deliberate exception, and it is worth being precise about the difference.
It never writes to your ServiceNow records and never submits a form. Record search, code search, catalog insight, variable values, translations and Debug Timeline only read.
Prefill changes unsaved fields on the catalog form in front of you, which is the entire point of it — it copies values from a ticket you name into the form you are filling in, so you can review them and submit yourself. It fills the form; you decide what happens to it. Nothing is saved to the instance unless you submit it.
Permissions, and what each is for
| Permission | Used for |
|---|---|
https://*.service-now.com/* |
The only sites the extension runs on at all |
scripting |
Reading page globals like g_form, and injecting the code
search panels only when you first use them |
storage |
The three local items listed above |
clipboardWrite |
"Copy sys_id", "Copy list" and copying a Debug Timeline trace — only when you click them |
What we never do
- We do not sell or transfer your data to third parties.
- We do not use or transfer your data for anything unrelated to the extension's single purpose.
- We do not use or transfer your data to determine creditworthiness or for lending purposes.
- We do not use your data for advertising, personalisation, profiling or re-targeting.
These are not aspirations. There is no server to send data to and no permission to reach one.
Children
GlideLens is a developer tool for people working in a ServiceNow instance at work. It is not directed at children and is not intended for use by anyone under 13.
Changes to this policy
If how GlideLens handles data ever changes, this page is updated and the change is described in the changelog for the release that makes it, before or with the release that makes it — not quietly afterwards. The date at the top of this page always reflects the last substantive change.
Contact
Questions, or something here that does not match what you observe: open an issue. The source is public, so you are welcome to check any claim on this page against it — that is rather the point of it being public.