From d93af53ec6fc14aa26744daab85c7708e54911a6 Mon Sep 17 00:00:00 2001 From: callumalpass Date: Mon, 28 Sep 2026 07:36:55 +1000 Subject: [PATCH 1/5] Draft Reader extension privacy page for publisher review --- docs/reader-extension-privacy-review.md | 19 +++ .../apps/reader/extension/privacy/index.astro | 143 ++++++++++++++++++ src/pages/privacy/index.astro | 3 +- 3 files changed, 164 insertions(+), 1 deletion(-) create mode 100644 docs/reader-extension-privacy-review.md create mode 100644 src/pages/apps/reader/extension/privacy/index.astro diff --git a/docs/reader-extension-privacy-review.md b/docs/reader-extension-privacy-review.md new file mode 100644 index 0000000..8beec96 --- /dev/null +++ b/docs/reader-extension-privacy-review.md @@ -0,0 +1,19 @@ +# Reader extension privacy page — publication gate + +Proposed URL: `https://mdbase.dev/apps/reader/extension/privacy/`. + +This page is a **draft**, not an approved policy. Do not merge/deploy or enter the URL in the Chrome Web Store until the publisher and service operator approve the facts below. It describes the 0.2.0 candidate uploaded from `mdbase-reader` commit `adc9d27f86d0040320f5f26f2d96c176c33aa92b`; if the submitted ZIP changes, re-audit it. The source audit, data-category mapping and candidate hash are in `mdbase-reader/docs/chrome-web-store/` on `fix/extension-store-hardening`. + +## Confirm before publication + +- Name the legal/person operator, effective date and a tested public contact channel for privacy/deletion requests. The Reader repository's public GitHub issue URL currently returns 404; do not use it as support contact. +- Verify production Connect, hosted-collection and relay providers/subprocessors; network metadata, logs, backups, retention and deletion. The general Connect policy covers part of this but does not establish extension-specific practices. Link to it without implying all traffic is local or end-to-end encrypted. +- Verify Connect grant revocation, collection record/file deletion and account deletion instructions. Local extension cleanup does **not** revoke a server grant or remove saved collection data. +- Confirm purposes and sharing with the operator, including no sale, unrelated use, creditworthiness/lending use and Chrome Limited Use compliance. Do not check the Web Store's three certifications merely because source code has no ad SDK. +- Reconcile Web Store data categories with the actual submitted build and backend: website content, visited URLs, authorization credentials, account identifiers, IP/location and activity/usage reporting. Recheck optional HTTPS permission and DOI traffic before claiming they stop or omit data. +- Check the published page against the production ZIP and the other Reader/Connect pages. The site's in-progress Reader documentation currently exists as untracked work in the canonical `mdbase.dev` checkout, not on this branch; coordinate separately rather than copying or overwriting it. +- After approval and deployment, fetch the public URL without authentication and verify its content, canonical URL and links before entering it in the Chrome Web Store. Save the draft, re-open “Why can't I submit?”, and submit only with explicit publisher approval. + +## Validation + +`pnpm check` and `pnpm build` pass. `pnpm check:links` currently reports an unrelated existing `/sdk/` → `/spec/#section-14` fragment problem on `origin/main`; the new policy's local link and inline-code checks pass after the spacing fix. diff --git a/src/pages/apps/reader/extension/privacy/index.astro b/src/pages/apps/reader/extension/privacy/index.astro new file mode 100644 index 0000000..e4a71c1 --- /dev/null +++ b/src/pages/apps/reader/extension/privacy/index.astro @@ -0,0 +1,143 @@ +--- +import BaseLayout from "../../../../../layouts/BaseLayout.astro"; +--- + + +
+
+

mdbase Reader browser extension privacy

+

+ This page covers the mdbase Reader browser extension. The + mdbase website and Connect privacy page covers the + related website and Connect service. +

+
+ +

What the extension does

+

+ Reader lets you save supported web articles and PDFs, add highlights and + notes, and revisit them in a collection you authorize through mdbase + Connect. The extension is not a standalone storage service. +

+ +

Pages and information you choose to save

+

+ When you open Reader on a supported page, it reads the page address, + title, content, available citation metadata and selected text to prepare + a capture. Saving is a separate action. When you save, Reader transfers + the source content and any tags, notes, comments or highlights you enter + through Connect to your selected collection. +

+

+ For articles, new captures include a readable copy and a minimized + text-and-structure HTML archive. The archive leaves out scripts, forms, + embedded application state, arbitrary attributes and resource or link + addresses from the document markup. Explicitly hidden elements are + removed. This is not anonymization: visible text, titles, citation + metadata and the separately saved source address, including any query + parameters, may still contain private information. Existing captures are + not rewritten. Only save pages you intend to keep in that collection. +

+

+ For supported PDFs, Reader downloads the document for saving. Where + Chrome permits, the download uses your existing access to the original + website. The extension does not copy the website's login cookies into + the saved PDF as part of that operation. +

+ +

Citation lookups

+

+ If a DOI is available, citation preparation may send that DOI to{" "} + doi.org and the registry it redirects to, such as Crossref + or DataCite. This can happen before you save. The lookup does not + intentionally send your notes, highlights or full article content. + Those services also receive ordinary network information such as your IP + address. Extension DOI requests omit cookies. +

+ +

Optional saved-page recognition

+

+ “Mark pages I've saved and show my highlights on them” is optional. If + enabled, Chrome requests access to HTTPS websites. Reader then sends the + addresses of HTTPS pages you visit, including pages you have not saved, + through your configured Connect route to query your selected collection. + It retrieves matching saved highlights and may read page text to display + them. This is not merely an on-device browser comparison. Turning the + feature off stops these background lookups and requests removal of the + optional website permission. +

+ +

Connection and local browser data

+

+ The extension keeps Connect authorization state, the selected collection, + preferences and interrupted-write recovery information in Chrome's + extension-local storage. Signing keys and application identity are held + in the extension's IndexedDB databases. Recovery data can include + identifiers, addresses and pending changes. Draft text and selected + passages are kept in extension session storage and cleaned up when their + tab closes. This implementation does not use Chrome's synchronized + storage for those drafts. +

+

+ Connect grants are sensitive credentials used to access only collections + you authorize. Extension API requests do not use ambient Connect portal + cookies. The separate Connect approval website handles its own sign-in. +

+ +

Where data goes

+

+ The production extension contacts connect.mdbase.dev for + authorization and collection operations. Depending on your collection, + records and files are handled by a hosted collection service or your own + connector, with a cloud relay where applicable. Not all traffic remains + on your computer. The Connect privacy page + describes account, routing and hosted-collection handling. +

+

+ For a collection served from your computer, you may separately allow + direct access to the connector on your own device. This is optional; + Chrome controls the localhost and local-network permissions. Websites + you capture and DOI registries have their own privacy practices. +

+ +

Retention and controls

+
    +
  • + Saved sources, files and annotations remain in the selected collection + until removed using the collection's controls. Removing the extension + does not delete them. +
    • +
  • + Session drafts are temporary. Local preferences, authorization and + recovery state can persist across browser restarts. +
    • +
  • + Turn off saved-page recognition in extension Settings to stop + background address lookups and request removal of website access. +
    • +
  • + Settings → Disconnect this browser → Disconnect and clear local data + removes extension-local state, session drafts and IndexedDB credentials + after confirmation. It also requests removal of optional website and + local-connector permissions. Finish pending saves first: a write already + sent may still complete, and recovery information is discarded. +
    • +
  • + Clearing this browser does not revoke server-side grants or delete + collection content, and does not affect other browsers. Highlights + already drawn on an open page may remain until it is reloaded. Manage + grants in Connect and remove records/files in your collection. +
    • +
+ +

Contact and changes

+

+ + Privacy contact and effective date are pending publisher confirmation. + Changes to this policy will be posted at this address. +

+
+ diff --git a/src/pages/privacy/index.astro b/src/pages/privacy/index.astro index d5ad6f4..92d701c 100644 --- a/src/pages/privacy/index.astro +++ b/src/pages/privacy/index.astro @@ -57,7 +57,8 @@ import BaseLayout from "../../layouts/BaseLayout.astro";

Applications connected through mdbase receive data under the grants users approve. Each application provider is independently responsible for its - own handling of authorized data. + own handling of authorized data. For the mdbase Reader browser extension, + see its extension privacy page.

Contact

From abc2fe33bb90affd89d730b80fcf9cab3c07a1a3 Mon Sep 17 00:00:00 2001 From: callumalpass Date: Mon, 28 Sep 2026 07:56:18 +1000 Subject: [PATCH 2/5] Ground Reader policy in Connect service and retention evidence --- docs/reader-extension-privacy-review.md | 20 ++++--- .../apps/reader/extension/privacy/index.astro | 53 ++++++++++++++++--- 2 files changed, 59 insertions(+), 14 deletions(-) diff --git a/docs/reader-extension-privacy-review.md b/docs/reader-extension-privacy-review.md index 8beec96..8939024 100644 --- a/docs/reader-extension-privacy-review.md +++ b/docs/reader-extension-privacy-review.md @@ -2,18 +2,26 @@ Proposed URL: `https://mdbase.dev/apps/reader/extension/privacy/`. -This page is a **draft**, not an approved policy. Do not merge/deploy or enter the URL in the Chrome Web Store until the publisher and service operator approve the facts below. It describes the 0.2.0 candidate uploaded from `mdbase-reader` commit `adc9d27f86d0040320f5f26f2d96c176c33aa92b`; if the submitted ZIP changes, re-audit it. The source audit, data-category mapping and candidate hash are in `mdbase-reader/docs/chrome-web-store/` on `fix/extension-store-hardening`. +This page is a **draft**, not an approved policy. Do not merge/deploy or enter the URL in the Chrome Web Store until the publisher approves the final wording. It describes the 0.2.0 candidate uploaded from `mdbase-reader` commit `adc9d27f86d0040320f5f26f2d96c176c33aa92b`; if the submitted ZIP changes, re-audit it. The source audit, data-category mapping and candidate hash are in `mdbase-reader/docs/chrome-web-store/` on `fix/extension-store-hardening`. + +## Repository findings used in the draft + +- **Operator/contact:** The owner confirmed both are Callum Alpass. `mdbase-cloud-ops/docs/account-and-service-inventory.md` lists `callum@mdbase.dev` as the Google OAuth support and product email; this draft proposes that publicly reachable address for privacy requests. Confirm the actual mailbox receives requests before publication. +- **Topology:** `mdbase-cloud-ops/docs/render-production.md` describes Render Connect, hosted provider, relay broker and separate PostgreSQL databases. The hosted provider handles records/files; the control plane does not persist record payloads. `docs/r2-storage.md` describes Cloudflare R2 file objects and deferred deletion after retained references are gone. The existing `/privacy/` page already distinguishes local connector data, encrypted relay payloads and provider-readable hosted data. +- **Backups/logs:** `mdbase-cloud-ops/docs/disaster-recovery.md` and `.github/workflows/backups.yml` document Render PITR and encrypted logical exports retained for 90 days as GitHub artifacts on the database-only path. A complete AWS S3 archive is designed but gated by `RECOVERY_ARCHIVE_ENABLED`; do not claim it is live without checking that setting. `docs/render-production.md` and `docs/observability.md` describe privacy-bounded Render application logs, but do not establish a public, exact log-retention interval. Do not promise instant erasure from backups. +- **Usage/retention:** `mdbase-connect/docs/usage-report.md` describes aggregate operator reports from existing account/grant/token/usage rows and daily deletion of expired authorization/protocol-usage rows no longer needed after 395 days. This does not set a 395-day retention period for all account, audit, provider or backup data. +- **Revocation/deletion:** `mdbase-connect/apps/editor/src/ConnectApp.tsx` has application-grant revocation controls; local/hosted authority confirmation may be pending. `apps/editor/src/AccountManagement.tsx` conditionally disables account deletion when the service reports it unavailable. The ops desired `render.yaml` enables it, but a live check is required before claiming it is currently available. Browser-local extension reset is not server-side revocation. Hosted record/file deletion can leave retained versions or backups. +- **Email:** `mdbase-cloud-ops/docs/account-and-service-inventory.md` identifies Resend for account-related delivery. DOI lookups and original-site PDF requests are documented in the extension-store-hardening audit, not Connect. ## Confirm before publication -- Name the legal/person operator, effective date and a tested public contact channel for privacy/deletion requests. The Reader repository's public GitHub issue URL currently returns 404; do not use it as support contact. -- Verify production Connect, hosted-collection and relay providers/subprocessors; network metadata, logs, backups, retention and deletion. The general Connect policy covers part of this but does not establish extension-specific practices. Link to it without implying all traffic is local or end-to-end encrypted. -- Verify Connect grant revocation, collection record/file deletion and account deletion instructions. Local extension cleanup does **not** revoke a server grant or remove saved collection data. -- Confirm purposes and sharing with the operator, including no sale, unrelated use, creditworthiness/lending use and Chrome Limited Use compliance. Do not check the Web Store's three certifications merely because source code has no ad SDK. +- Test `callum@mdbase.dev` as a privacy contact, and set the effective date to the actual publication date. Confirm operator wording and the public handling process for privacy/deletion requests. +- Check live production settings for backup archive activation, log retention and account deletion. The repositories provide desired state and implementation but cannot prove all live provider settings or data already retained there. +- Confirm no sale/impermissible transfer, unrelated use, lending/creditworthiness use and Chrome Limited Use compliance as operator practices. Do not check the Web Store's three certifications merely because source code has no ad SDK. - Reconcile Web Store data categories with the actual submitted build and backend: website content, visited URLs, authorization credentials, account identifiers, IP/location and activity/usage reporting. Recheck optional HTTPS permission and DOI traffic before claiming they stop or omit data. - Check the published page against the production ZIP and the other Reader/Connect pages. The site's in-progress Reader documentation currently exists as untracked work in the canonical `mdbase.dev` checkout, not on this branch; coordinate separately rather than copying or overwriting it. - After approval and deployment, fetch the public URL without authentication and verify its content, canonical URL and links before entering it in the Chrome Web Store. Save the draft, re-open “Why can't I submit?”, and submit only with explicit publisher approval. ## Validation -`pnpm check` and `pnpm build` pass. `pnpm check:links` currently reports an unrelated existing `/sdk/` → `/spec/#section-14` fragment problem on `origin/main`; the new policy's local link and inline-code checks pass after the spacing fix. +`pnpm check` and `pnpm build` pass. `pnpm check:links` reports an unrelated existing `/sdk/` → `/spec/#section-14` fragment problem on `origin/main`; new policy links and inline-code checks pass. diff --git a/src/pages/apps/reader/extension/privacy/index.astro b/src/pages/apps/reader/extension/privacy/index.astro index e4a71c1..f145fa7 100644 --- a/src/pages/apps/reader/extension/privacy/index.astro +++ b/src/pages/apps/reader/extension/privacy/index.astro @@ -10,9 +10,9 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";

mdbase Reader browser extension privacy

- This page covers the mdbase Reader browser extension. The - mdbase website and Connect privacy page covers the - related website and Connect service. + This page covers the mdbase Reader browser extension, operated by + Callum Alpass. The mdbase website and Connect privacy page + covers the related website and Connect service.

@@ -103,6 +103,28 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro"; you capture and DOI registries have their own privacy practices.

+

Purposes, service providers and sharing

+

+ Reader uses this information to prepare and save sources, look up citation + metadata, store annotations, access an authorized collection, recover + interrupted writes and, if enabled, recognize saved pages. Connect + processes account and grant details, routing metadata and bounded usage + counts needed to operate the service; its operator report uses aggregate + counts rather than returning individual records or page contents. +

+

+ Production Connect and its hosted provider run on Render with managed + PostgreSQL. Hosted files are stored as opaque objects in Cloudflare R2; + the hosted provider handles authorized record and file operations. + Render provides database recovery, and encrypted logical database + backup artifacts are retained through GitHub Actions. Account email may + be delivered through Resend. DOI registries receive a DOI when + a lookup is made, and the original website serves content or a PDF when + you choose to capture it. These providers may process the network and + operational information necessary to provide those services. The + extension does not contain an advertising or third-party analytics SDK. +

+

Retention and controls

+

+ Connect deletes expired authorization and usage rows that are no longer + needed, generally after about 13 months. Other account, grant and audit + information can be retained while needed for service, security or legal + purposes. Hosted file deletion may first leave retained versions and + backups that are removed through maintenance or backup expiry; deletion + from all recovery copies is not immediate. The provider and Render may + retain operational logs. The Connect account-deletion page + explains account-level controls and exceptions; local collection files + on your own computers are not removed by deleting an account. +

Contact and changes

- - Privacy contact and effective date are pending publisher confirmation. - Changes to this policy will be posted at this address. + For privacy questions or requests, contact + Callum Alpass at callum@mdbase.dev. + Changes to this policy will be posted at this address with an updated + effective date.

+

Effective date: pending publication approval.

From 45a0780f2a578343f2fa8461a25f50e4fe32c748 Mon Sep 17 00:00:00 2001 From: callumalpass Date: Mon, 28 Sep 2026 09:19:39 +1000 Subject: [PATCH 3/5] Record publisher contact confirmation and backup gate status --- docs/reader-extension-privacy-review.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/reader-extension-privacy-review.md b/docs/reader-extension-privacy-review.md index 8939024..f579095 100644 --- a/docs/reader-extension-privacy-review.md +++ b/docs/reader-extension-privacy-review.md @@ -6,17 +6,17 @@ This page is a **draft**, not an approved policy. Do not merge/deploy or enter t ## Repository findings used in the draft -- **Operator/contact:** The owner confirmed both are Callum Alpass. `mdbase-cloud-ops/docs/account-and-service-inventory.md` lists `callum@mdbase.dev` as the Google OAuth support and product email; this draft proposes that publicly reachable address for privacy requests. Confirm the actual mailbox receives requests before publication. +- **Operator/contact:** The owner confirmed Callum Alpass as operator and `callum@mdbase.dev` as the public privacy-request address. `mdbase-cloud-ops/docs/account-and-service-inventory.md` also lists it as the Google OAuth support and product email. Test delivery before publication. - **Topology:** `mdbase-cloud-ops/docs/render-production.md` describes Render Connect, hosted provider, relay broker and separate PostgreSQL databases. The hosted provider handles records/files; the control plane does not persist record payloads. `docs/r2-storage.md` describes Cloudflare R2 file objects and deferred deletion after retained references are gone. The existing `/privacy/` page already distinguishes local connector data, encrypted relay payloads and provider-readable hosted data. -- **Backups/logs:** `mdbase-cloud-ops/docs/disaster-recovery.md` and `.github/workflows/backups.yml` document Render PITR and encrypted logical exports retained for 90 days as GitHub artifacts on the database-only path. A complete AWS S3 archive is designed but gated by `RECOVERY_ARCHIVE_ENABLED`; do not claim it is live without checking that setting. `docs/render-production.md` and `docs/observability.md` describe privacy-bounded Render application logs, but do not establish a public, exact log-retention interval. Do not promise instant erasure from backups. +- **Backups/logs:** `mdbase-cloud-ops/docs/disaster-recovery.md` and `.github/workflows/backups.yml` document Render PITR and encrypted logical exports retained for 90 days as GitHub artifacts on the database-only path. A complete AWS S3 archive is designed but gated by `RECOVERY_ARCHIVE_ENABLED`; `gh variable get RECOVERY_ARCHIVE_ENABLED --repo mdbase-dev/mdbase-cloud-ops` reported the variable absent on 2026-09-27, so the scheduled workflow chooses database-only unless changed. This does not prove every historical backup is gone. `docs/render-production.md` and `docs/observability.md` describe privacy-bounded Render application logs, but do not establish a public, exact log-retention interval. Do not promise instant erasure from backups. - **Usage/retention:** `mdbase-connect/docs/usage-report.md` describes aggregate operator reports from existing account/grant/token/usage rows and daily deletion of expired authorization/protocol-usage rows no longer needed after 395 days. This does not set a 395-day retention period for all account, audit, provider or backup data. - **Revocation/deletion:** `mdbase-connect/apps/editor/src/ConnectApp.tsx` has application-grant revocation controls; local/hosted authority confirmation may be pending. `apps/editor/src/AccountManagement.tsx` conditionally disables account deletion when the service reports it unavailable. The ops desired `render.yaml` enables it, but a live check is required before claiming it is currently available. Browser-local extension reset is not server-side revocation. Hosted record/file deletion can leave retained versions or backups. - **Email:** `mdbase-cloud-ops/docs/account-and-service-inventory.md` identifies Resend for account-related delivery. DOI lookups and original-site PDF requests are documented in the extension-store-hardening audit, not Connect. ## Confirm before publication -- Test `callum@mdbase.dev` as a privacy contact, and set the effective date to the actual publication date. Confirm operator wording and the public handling process for privacy/deletion requests. -- Check live production settings for backup archive activation, log retention and account deletion. The repositories provide desired state and implementation but cannot prove all live provider settings or data already retained there. +- Test delivery to `callum@mdbase.dev`, set the effective date to the actual publication date and confirm a handling process for privacy/deletion requests. +- Check live production settings for Render log/PITR retention and account deletion. The repositories provide desired state and implementation but cannot prove all live provider settings or data already retained there. Recheck the GitHub recovery variable at publication. - Confirm no sale/impermissible transfer, unrelated use, lending/creditworthiness use and Chrome Limited Use compliance as operator practices. Do not check the Web Store's three certifications merely because source code has no ad SDK. - Reconcile Web Store data categories with the actual submitted build and backend: website content, visited URLs, authorization credentials, account identifiers, IP/location and activity/usage reporting. Recheck optional HTTPS permission and DOI traffic before claiming they stop or omit data. - Check the published page against the production ZIP and the other Reader/Connect pages. The site's in-progress Reader documentation currently exists as untracked work in the canonical `mdbase.dev` checkout, not on this branch; coordinate separately rather than copying or overwriting it. From 245418f1582892f9c23921f52a2a18c4cdb65e02 Mon Sep 17 00:00:00 2001 From: callumalpass Date: Mon, 28 Sep 2026 09:29:20 +1000 Subject: [PATCH 4/5] State confirmed Reader data-use commitments --- docs/reader-extension-privacy-review.md | 4 ++-- src/pages/apps/reader/extension/privacy/index.astro | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/reader-extension-privacy-review.md b/docs/reader-extension-privacy-review.md index f579095..dd8ae1f 100644 --- a/docs/reader-extension-privacy-review.md +++ b/docs/reader-extension-privacy-review.md @@ -17,11 +17,11 @@ This page is a **draft**, not an approved policy. Do not merge/deploy or enter t - Test delivery to `callum@mdbase.dev`, set the effective date to the actual publication date and confirm a handling process for privacy/deletion requests. - Check live production settings for Render log/PITR retention and account deletion. The repositories provide desired state and implementation but cannot prove all live provider settings or data already retained there. Recheck the GitHub recovery variable at publication. -- Confirm no sale/impermissible transfer, unrelated use, lending/creditworthiness use and Chrome Limited Use compliance as operator practices. Do not check the Web Store's three certifications merely because source code has no ad SDK. +- On 2026-09-27 the publisher confirmed the three Web Store data-use commitments: no sale/impermissible transfer apart from approved uses, no unrelated use or transfer, and no creditworthiness/lending use or transfer. The policy now states those commitments. The exact dashboard category mapping still needs reconciliation with the final ZIP and service behaviour before certification. Chrome Limited Use is a separate policy review, not automatically proven by these three statements. - Reconcile Web Store data categories with the actual submitted build and backend: website content, visited URLs, authorization credentials, account identifiers, IP/location and activity/usage reporting. Recheck optional HTTPS permission and DOI traffic before claiming they stop or omit data. - Check the published page against the production ZIP and the other Reader/Connect pages. The site's in-progress Reader documentation currently exists as untracked work in the canonical `mdbase.dev` checkout, not on this branch; coordinate separately rather than copying or overwriting it. - After approval and deployment, fetch the public URL without authentication and verify its content, canonical URL and links before entering it in the Chrome Web Store. Save the draft, re-open “Why can't I submit?”, and submit only with explicit publisher approval. ## Validation -`pnpm check` and `pnpm build` pass. `pnpm check:links` reports an unrelated existing `/sdk/` → `/spec/#section-14` fragment problem on `origin/main`; new policy links and inline-code checks pass. +`pnpm check` and `pnpm build` pass. `pnpm check:links` reports an unrelated existing `/sdk/` → `/spec/#section-14` fragment problem on `origin/main`; new policy links and inline-code checks pass. The uploaded 0.2.0 ZIP still matches the recorded SHA-256 `79565e2b93c7b8b1d294cc9a83aa4dcb97f1ce2681d8281d428a282f2cf080e3`. On 2026-09-27, extension tests (84) and web-capture tests (27) passed. Source inspection confirms optional HTTPS access is requested from the setting and removed on disable, while navigation lookups are gated by the setting and permission; DOI fetch uses `credentials: "omit"` and sends the encoded DOI through `doi.org`. These checks do not replace a live network trace of the uploaded ZIP. diff --git a/src/pages/apps/reader/extension/privacy/index.astro b/src/pages/apps/reader/extension/privacy/index.astro index f145fa7..36cb5ac 100644 --- a/src/pages/apps/reader/extension/privacy/index.astro +++ b/src/pages/apps/reader/extension/privacy/index.astro @@ -123,6 +123,10 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro"; you choose to capture it. These providers may process the network and operational information necessary to provide those services. The extension does not contain an advertising or third-party analytics SDK. + We do not sell user data, use or transfer it for purposes unrelated to + Reader's stated function, or use or transfer it to determine + creditworthiness or for lending. Transfers to service providers and DOI + registries are limited to the functions described above.

Retention and controls

@@ -175,6 +179,6 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro"; Changes to this policy will be posted at this address with an updated effective date.

-

Effective date: pending publication approval.

+

Effective date: 27 September 2026.

From a1d6cb0e7fe897d104212f4acdc438355698a810 Mon Sep 17 00:00:00 2001 From: callumalpass Date: Mon, 28 Sep 2026 09:30:10 +1000 Subject: [PATCH 5/5] Prepare policy handoff after publisher confirmation --- docs/reader-extension-privacy-review.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/reader-extension-privacy-review.md b/docs/reader-extension-privacy-review.md index dd8ae1f..b1f4d49 100644 --- a/docs/reader-extension-privacy-review.md +++ b/docs/reader-extension-privacy-review.md @@ -1,8 +1,8 @@ -# Reader extension privacy page — publication gate +# Reader extension privacy page — evidence and Store handoff -Proposed URL: `https://mdbase.dev/apps/reader/extension/privacy/`. +URL: `https://mdbase.dev/apps/reader/extension/privacy/`. -This page is a **draft**, not an approved policy. Do not merge/deploy or enter the URL in the Chrome Web Store until the publisher approves the final wording. It describes the 0.2.0 candidate uploaded from `mdbase-reader` commit `adc9d27f86d0040320f5f26f2d96c176c33aa92b`; if the submitted ZIP changes, re-audit it. The source audit, data-category mapping and candidate hash are in `mdbase-reader/docs/chrome-web-store/` on `fix/extension-store-hardening`. +This page describes the 0.2.0 candidate uploaded from `mdbase-reader` commit `adc9d27f86d0040320f5f26f2d96c176c33aa92b`; if the submitted ZIP changes, re-audit it. The source audit, data-category mapping and candidate hash are in `mdbase-reader/docs/chrome-web-store/` on `fix/extension-store-hardening`. ## Repository findings used in the draft @@ -13,14 +13,14 @@ This page is a **draft**, not an approved policy. Do not merge/deploy or enter t - **Revocation/deletion:** `mdbase-connect/apps/editor/src/ConnectApp.tsx` has application-grant revocation controls; local/hosted authority confirmation may be pending. `apps/editor/src/AccountManagement.tsx` conditionally disables account deletion when the service reports it unavailable. The ops desired `render.yaml` enables it, but a live check is required before claiming it is currently available. Browser-local extension reset is not server-side revocation. Hosted record/file deletion can leave retained versions or backups. - **Email:** `mdbase-cloud-ops/docs/account-and-service-inventory.md` identifies Resend for account-related delivery. DOI lookups and original-site PDF requests are documented in the extension-store-hardening audit, not Connect. -## Confirm before publication +## Store handoff and follow-up -- Test delivery to `callum@mdbase.dev`, set the effective date to the actual publication date and confirm a handling process for privacy/deletion requests. -- Check live production settings for Render log/PITR retention and account deletion. The repositories provide desired state and implementation but cannot prove all live provider settings or data already retained there. Recheck the GitHub recovery variable at publication. +- The owner confirmed `callum@mdbase.dev` as the public contact and the page uses 27 September 2026 as its effective date. Test actual delivery and define the operational handling path for privacy/deletion requests. +- The page does not promise an exact Render log/PITR retention interval or instant erasure. The repositories provide desired state and implementation but cannot prove all live provider settings or data already retained there. Check live retention and account-deletion availability as an operational follow-up. Recheck the GitHub recovery variable before making a future archive claim. - On 2026-09-27 the publisher confirmed the three Web Store data-use commitments: no sale/impermissible transfer apart from approved uses, no unrelated use or transfer, and no creditworthiness/lending use or transfer. The policy now states those commitments. The exact dashboard category mapping still needs reconciliation with the final ZIP and service behaviour before certification. Chrome Limited Use is a separate policy review, not automatically proven by these three statements. - Reconcile Web Store data categories with the actual submitted build and backend: website content, visited URLs, authorization credentials, account identifiers, IP/location and activity/usage reporting. Recheck optional HTTPS permission and DOI traffic before claiming they stop or omit data. - Check the published page against the production ZIP and the other Reader/Connect pages. The site's in-progress Reader documentation currently exists as untracked work in the canonical `mdbase.dev` checkout, not on this branch; coordinate separately rather than copying or overwriting it. -- After approval and deployment, fetch the public URL without authentication and verify its content, canonical URL and links before entering it in the Chrome Web Store. Save the draft, re-open “Why can't I submit?”, and submit only with explicit publisher approval. +- After deployment, fetch the public URL without authentication and verify its content, canonical URL and links before entering it in the Chrome Web Store. Save the draft, re-open “Why can't I submit?”, and submit only with explicit publisher approval. ## Validation