SAS Studio Helper

Privacy Policy

Last updated: August 25, 2026

Overview

SAS Studio Helper is a Chrome extension that bridges a SAS Studio web session and the companion StatDataViewer desktop application running on the same computer. This page describes everything the extension reads, sends, or stores.

What we do not do

  • No data is sent to any remote server.
  • No analytics. No tracking. No third-party services.
  • We do not read the content of unrelated tabs or browse your history.

What we read from the SAS Studio page

When you add a SAS Studio host in the extension's settings, Chrome asks you to grant the extension access to that host. After that, on pages served by that host the extension:

  • Inspects outgoing XHR / fetch requests to extract the SAS Studio session id (a UUID embedded in URLs of the form /sasexec/sessions/{uuid}/...).
  • Inspects responses to extract the CSRF token the SAS Studio server sends in the X-CSRF-Token header.

These two values let the extension call the same SAS Studio HTTP API the page itself uses, on behalf of the StatDataViewer desktop app.

What we send out of the browser

The extension only talks to two destinations:

  • The SAS Studio host you added, using your existing logged-in session, exactly the same way the SAS Studio web UI does.
  • 127.0.0.1 on your own computer, for talking to StatDataViewer. The default port is 53210; you may change it in settings.

Nothing is sent anywhere else.

Cookies

The extension declares the cookies permission. It is used only to forward session cookies of a SAS Studio host to StatDataViewer on the same computer, and only when the "cookie forwarding for large datasets" toggle is enabled and you explicitly trigger a dataset transfer in URL mode. Cookies are never written to disk by the extension and never leave your machine.

This feature can be disabled in the extension's settings, and is opt-in on a per-dataset basis (the desktop app decides whether to ask for the cookie hint).

What we store

  • chrome.storage.sync — user settings: the list of SAS Studio hosts, the StatDataViewer port and download URL, behaviour preferences. These sync across your Chrome profile.
  • chrome.storage.session — short-lived runtime state cleared when the browser closes: detected SAS Studio session ids, the current CSRF token, viewer connection status, and the most recent user-facing error message for the on-page toast.

We do not store any dataset content, log content, or SAS code.

Permissions and why

  • storage — save settings and short-lived runtime state.
  • scripting — inject content scripts into the SAS Studio hosts you have added.
  • cookies — forward session cookies to StatDataViewer on the local machine when you request a URL-mode download.
  • contextMenus — (reserved) show right-click menu items on SAS Studio pages.
  • alarms — drive the service worker's reconnect backoff.
  • webRequest — observe (not block) the SAS Studio page's network calls to detect when you open a dataset.
  • http://127.0.0.1/* — talk to the StatDataViewer desktop app over localhost.
  • https://*/* (optional) — requested on a per-host basis when you add a SAS Studio host in settings. Not granted at install time.

Changes

Material changes will be reflected on this page and timestamped at the top. Continued use of the extension after a change constitutes acceptance.

Contact

Questions, requests for data removal (note: nothing is collected remotely, so this should be N/A), or security reports: support@helper.software.