Repository navigation
docs: privacy policy and Chrome Web Store submission draft - #12
Merged
Merged
Conversation
Publishing to the Web Store is what makes updates stop being manual work on the Chromebook, and self-hosted updates are not an option — Chrome only allows those on centrally managed devices. PRIVACY.md is a prerequisite rather than paperwork: the store requires a policy URL once an item handles authentication information, which this one now does. It states where credentials are held, that the storage is cleartext, and that nothing is sent anywhere except the servers the user configured. It is written against what the code does — no analytics, no remote code, and requests only to granted origins. docs/webstore-submission.md holds the listing copy, the single purpose statement, and a justification for each permission, in English because that is what gets reviewed. It also names the two things likely to draw questions: the breadth of the host permission pattern, and cookies plus tabs — for the first, the argument is that the permissions are optional and granted per origin when a share is added. What is still missing is a screenshot, which needs a Chromebook. Everything else on the checklist is done. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ウェブストアに出すのは「更新のたびに Chromebook で手作業」を終わらせるためで、自己ホストでの自動更新は選べない（Chrome は集中管理された端末でしかそれを許さない）。
PRIVACY.md事務手続きではなく前提条件。ストアは、認証情報を扱う拡張にプライバシーポリシーの URL を要求する。Basic 認証を入れた時点でこちらが該当した。
コードの実際の挙動に対して書いた。資格情報がどこに置かれるか、それが平文であること、設定済みのオリジン以外にはどこにも送らないこと。解析もリモートコードも無く、許可されたオリジン以外に通信しないことは、コードを確認したうえで書いている（
fetchの呼び出し先、chrome.*の使用箇所、eval/外部スクリプトの有無を洗った）。英日併記。ストアに出す URL としてそのまま使える。
docs/webstore-submission.md掲載文、単一目的の説明、権限ごとの正当化。貼り付ける文面は英語にしてある（審査が英語で行われるため）。
審査で突かれそうな箇所も書いた:
https://*/*は最も説明を求められるパターン。反論の軸は「optional であり、共有を追加した時点でオリジン単位に要求される」こと。1 共有なら 1 オリジンしか許可されないcookiesとtabs— どちらも用途が Cloudflare Access のログイン処理に限定されることを明記データ申告は Authentication information のみ。他のカテゴリは扱っていないので申告しない。
残っているもの
スクリーンショット（1280x800 または 640x400）だけ。これは Chromebook が要る。 チェックリストの他の項目は済んでいる（128 アイコン、プライバシーポリシー URL、zip、manifest の整合性チェック）。
🤖 Generated with Claude Code