Privacy policy
Your data stays between your browser and your Databricks workspace.
Summary
- Lakeline has no servers. The developer receives none of your data: no analytics, no telemetry, no crash reports.
- The extension sends requests only to the Databricks workspaces you connect, and, if you use it, to the optional local helper on your own computer (127.0.0.1).
- Nothing is sold, shared with third parties, or used for advertising.
What the extension stores, and where
| Data | Where | How long |
|---|---|---|
| Settings (period, data source, display options), saved workspace connections (workspace URL and ID, chosen SQL warehouse, price table, currency), workspace colors | Browser local storage on this device | Until you change them or remove the extension |
| Sign-in tokens (Sign in with Databricks) | Browser session storage | Cleared when the browser closes |
| Personal access token | Browser session storage; local storage only if you tick "Remember on this computer" | Session, or until you remove it or the extension |
| Genie conversations (questions, answers, result tables) | Browser session storage, size-capped | Cleared when the browser closes, or with "Clear now" |
| Cost results | Memory and session storage, as a short cache (about 5 minutes) | Cleared when the browser closes |
| Recent error details (sanitized, secrets removed) | Browser local storage, last 20 entries | Until you clear Diagnostics or remove the extension |
Websites, including Databricks pages, can't read anything the extension stores. Browser extension storage is only available to the extension itself.
What the extension sends, and to whom
- Your Databricks workspace: read-only SQL queries against Databricks system tables (billing, query history, job and pipeline timelines), and read-only API calls for SQL warehouses, job runs, pipelines and clusters. If you ask Genie a question, the question text goes to the Genie Agent you selected in your own workspace. Requests carry your sign-in token, which goes only to that workspace.
- Databricks sign-in: "Sign in with Databricks" uses your workspace's own OAuth endpoints, through Databricks' built-in sign-in app (the one the Databricks CLI uses) or your organization's app connection. With the built-in app, the sign-in ends at
http://localhost:8020: the extension reads the one-time code from the address of the sign-in tab it opened, then closes that tab. Nothing is sent to, or served from, your computer. - The optional local helper (if you choose to run it): it runs on your computer at 127.0.0.1, and its Databricks credentials stay in the Databricks CLI on your computer.
The extension does not read the text of your SQL queries or the result rows of your queries in Query History. Cost estimates use only timestamps, durations, warehouse IDs and billing records.
Permissions
Site access is requested one workspace at a time, only when you connect it. The extension never asks for access to all websites. To finish "Sign in with Databricks", it also asks once for localhost:8020, used only to read the address of its own sign-in tab. Desktop notifications are optional and contain no query data. See the Chrome permissions documentation for what each permission means.
Your choices
- Disconnect a workspace or remove a token in Connection preferences.
- Clear Genie conversations with "Clear now" in the side panel.
- Remove the extension to delete everything it stored in your browser.
- If you used the local helper, you can remove its Databricks CLI profiles (names start with
dcc-) with the Databricks CLI.
Children
Lakeline is a tool for Databricks users at work and is not directed to children.
Changes
Changes to this policy are published on this page with a new effective date.
Contact
Vivek Kovvuru · questions and requests: GitHub Issues
Lakeline is an independent project and is not affiliated with, endorsed by or sponsored by Databricks, Inc. Databricks and Genie are trademarks of Databricks, Inc.