Privacy disclosures
The Chrome Web Store privacy tab asks what user data your extension collects, category by category. This page maps the kit’s actual collection footprint to those categories, with answers you can paste.
What the kit collects
Section titled “What the kit collects”| data | where it goes | notes |
|---|---|---|
| Auth profile (email, name, avatar, uid) | Firebase Authentication (Supabase: Supabase Auth) | only when the user signs in; anonymous-first creates an account without personal info |
| Billing state (plan, status, provider customer ID) | your payment provider (Stripe, Polar, or Paddle) + Firestore customers/{uid} (Supabase: the customers table) | only on purchase; card data never touches your code (the provider’s checkout hosts it) |
| Usage counters (feature/action counts, keyed by uid) | Firestore usage/{uid} (Supabase: the usage table) | gate events; no page URLs or content |
What the kit does not collect, by construction: no analytics, no crash telemetry, no browsing history, no host-page content, no keystrokes, no location.
The questionnaire, category by category
Section titled “The questionnaire, category by category”| CWS category | collect? | why |
|---|---|---|
| Personally identifiable information | Yes | email and name via sign-in |
| Health information | No | n/a |
| Financial and payment information | No | purchases happen on the payment provider’s checkout; the extension never sees payment details |
| Authentication information | Yes | Firebase or Supabase credentials/tokens (background-only; never exposed to pages) |
| Personal communications | No | n/a |
| Location | No | no location APIs; no IP collection by the extension |
| Web history | No | no page URLs are collected |
| User activity | Yes, minimal | in-extension feature-usage counters only. No network monitoring, no clicks/keystrokes on pages |
| Website content | No | content scripts read the page only to render local features; nothing page-derived is transmitted |
Template free-text justification (adapt the product name, and name your backend and payment provider if they are not Firebase and Stripe):
We collect an account profile (email, name) through Firebase Authentication when the user signs in, subscription status through Stripe when the user purchases, and in-extension feature-usage counts tied to the account. We do not collect crash telemetry, browsing history, page content, or any data from the websites the user visits.
Data that stays on the device
Section titled “Data that stays on the device”A feature that keeps data only in chrome.storage (saved items, notes,
settings) and never sends it anywhere does not collect it in the
store’s sense: the questionnaire asks about data that leaves the device,
for you or anyone else. So:
- The questionnaire: answer the categories by what is transmitted. Quotes a user saves from pages and keeps on the device leave “Website content” at No; the same quotes synced to your backend make it Yes.
- The privacy policy still says what stays on the device and that uninstalling deletes it: the template’s section “Data that stays on your device” has a placeholder for your features.
- Firefox:
data_collection_permissionsfollows the same rule; data that stays on the device needs no data type.
Re-check whenever a feature starts sending its data somewhere: a sync, a backup, an AI call with the page text.
The certification checkboxes
Section titled “The certification checkboxes”You must certify all three; the unmodified kit satisfies them:
- “I do not sell or transfer user data to third parties, apart from the approved use cases”: data goes only to your own backend (Firebase or Supabase) and your payment provider (Stripe, Polar, or Paddle), which processes payments.
- “I do not use or transfer user data for purposes that are unrelated to my item’s single purpose”: auth, billing, and usage gating all serve the extension’s function.
- “I do not use or transfer user data to determine creditworthiness or for lending purposes”: trivially true.
Pre-submission checklist
Section titled “Pre-submission checklist”- Privacy policy is live at the URL in
site.config.ts → urls.privacyand describes the three data types above. - You haven’t added an analytics or error SDK without updating this mapping (a script-injecting SDK is also a remote-code rejection).
- If you dropped modules, drop the matching disclosures: no
billing→ no billing or usage rows. - Firefox/Edge: reuse this content in AMO’s data-collection section and Partner Center’s privacy fields; the facts are identical.