Draft Reader extension privacy page

docs/reader-extension-privacy-review.md

@@ -0,0 +1,27 @@
+# Reader extension privacy page — evidence and Store handoff
+
+URL: `https://mdbase.dev/apps/reader/extension/privacy/`.
+
+This page describes the 0.2.0 candidate uploaded from `mdbase-reader` commit `adc9d27f86d0040320f5f26f2d96c176c33aa92b`; if the submitted ZIP changes, re-audit it. The source audit, data-category mapping and candidate hash are in `mdbase-reader/docs/chrome-web-store/` on `fix/extension-store-hardening`.
+
+## Repository findings used in the draft
+
+- **Operator/contact:** The owner confirmed Callum Alpass as operator and `callum@mdbase.dev` as the public privacy-request address. `mdbase-cloud-ops/docs/account-and-service-inventory.md` also lists it as the Google OAuth support and product email. Test delivery before publication.
+- **Topology:** `mdbase-cloud-ops/docs/render-production.md` describes Render Connect, hosted provider, relay broker and separate PostgreSQL databases. The hosted provider handles records/files; the control plane does not persist record payloads. `docs/r2-storage.md` describes Cloudflare R2 file objects and deferred deletion after retained references are gone. The existing `/privacy/` page already distinguishes local connector data, encrypted relay payloads and provider-readable hosted data.
+- **Backups/logs:** `mdbase-cloud-ops/docs/disaster-recovery.md` and `.github/workflows/backups.yml` document Render PITR and encrypted logical exports retained for 90 days as GitHub artifacts on the database-only path. A complete AWS S3 archive is designed but gated by `RECOVERY_ARCHIVE_ENABLED`; `gh variable get RECOVERY_ARCHIVE_ENABLED --repo mdbase-dev/mdbase-cloud-ops` reported the variable absent on 2026-09-27, so the scheduled workflow chooses database-only unless changed. This does not prove every historical backup is gone. `docs/render-production.md` and `docs/observability.md` describe privacy-bounded Render application logs, but do not establish a public, exact log-retention interval. Do not promise instant erasure from backups.
+- **Usage/retention:** `mdbase-connect/docs/usage-report.md` describes aggregate operator reports from existing account/grant/token/usage rows and daily deletion of expired authorization/protocol-usage rows no longer needed after 395 days. This does not set a 395-day retention period for all account, audit, provider or backup data.
+- **Revocation/deletion:** `mdbase-connect/apps/editor/src/ConnectApp.tsx` has application-grant revocation controls; local/hosted authority confirmation may be pending. `apps/editor/src/AccountManagement.tsx` conditionally disables account deletion when the service reports it unavailable. The ops desired `render.yaml` enables it, but a live check is required before claiming it is currently available. Browser-local extension reset is not server-side revocation. Hosted record/file deletion can leave retained versions or backups.
+- **Email:** `mdbase-cloud-ops/docs/account-and-service-inventory.md` identifies Resend for account-related delivery. DOI lookups and original-site PDF requests are documented in the extension-store-hardening audit, not Connect.
+
+## Store handoff and follow-up
+
+- The owner confirmed `callum@mdbase.dev` as the public contact and the page uses 27 September 2026 as its effective date. Test actual delivery and define the operational handling path for privacy/deletion requests.
+- The page does not promise an exact Render log/PITR retention interval or instant erasure. The repositories provide desired state and implementation but cannot prove all live provider settings or data already retained there. Check live retention and account-deletion availability as an operational follow-up. Recheck the GitHub recovery variable before making a future archive claim.
+- On 2026-09-27 the publisher confirmed the three Web Store data-use commitments: no sale/impermissible transfer apart from approved uses, no unrelated use or transfer, and no creditworthiness/lending use or transfer. The policy now states those commitments. The exact dashboard category mapping still needs reconciliation with the final ZIP and service behaviour before certification. Chrome Limited Use is a separate policy review, not automatically proven by these three statements.
+- Reconcile Web Store data categories with the actual submitted build and backend: website content, visited URLs, authorization credentials, account identifiers, IP/location and activity/usage reporting. Recheck optional HTTPS permission and DOI traffic before claiming they stop or omit data.
+- Check the published page against the production ZIP and the other Reader/Connect pages. The site's in-progress Reader documentation currently exists as untracked work in the canonical `mdbase.dev` checkout, not on this branch; coordinate separately rather than copying or overwriting it.
+- After deployment, fetch the public URL without authentication and verify its content, canonical URL and links before entering it in the Chrome Web Store. Save the draft, re-open “Why can't I submit?”, and submit only with explicit publisher approval.
+
+## Validation
+
+`pnpm check` and `pnpm build` pass. `pnpm check:links` reports an unrelated existing `/sdk/` → `/spec/#section-14` fragment problem on `origin/main`; new policy links and inline-code checks pass. The uploaded 0.2.0 ZIP still matches the recorded SHA-256 `79565e2b93c7b8b1d294cc9a83aa4dcb97f1ce2681d8281d428a282f2cf080e3`. On 2026-09-27, extension tests (84) and web-capture tests (27) passed. Source inspection confirms optional HTTPS access is requested from the setting and removed on disable, while navigation lookups are gated by the setting and permission; DOI fetch uses `credentials: "omit"` and sends the encoded DOI through `doi.org`. These checks do not replace a live network trace of the uploaded ZIP.

src/pages/apps/reader/extension/privacy/index.astro

@@ -0,0 +1,184 @@
+---
+import BaseLayout from "../../../../../layouts/BaseLayout.astro";
+---
+
+<BaseLayout
+  title="mdbase Reader extension privacy"
+  description="How the mdbase Reader browser extension handles page content, annotations, browsing addresses, and Connect authorization."
+>
+  <article class="legal">
+    <header>
+      <h1>mdbase Reader browser extension privacy</h1>
+      <p>
+        This page covers the mdbase Reader browser extension, operated by
+        Callum Alpass. The <a href="/privacy/">mdbase website and Connect privacy page</a>
+        covers the related website and Connect service.
+      </p>
+    </header>
+
+    <h2>What the extension does</h2>
+    <p>
+      Reader lets you save supported web articles and PDFs, add highlights and
+      notes, and revisit them in a collection you authorize through mdbase
+      Connect. The extension is not a standalone storage service.
+    </p>
+
+    <h2>Pages and information you choose to save</h2>
+    <p>
+      When you open Reader on a supported page, it reads the page address,
+      title, content, available citation metadata and selected text to prepare
+      a capture. Saving is a separate action. When you save, Reader transfers
+      the source content and any tags, notes, comments or highlights you enter
+      through Connect to your selected collection.
+    </p>
+    <p>
+      For articles, new captures include a readable copy and a minimized
+      text-and-structure HTML archive. The archive leaves out scripts, forms,
+      embedded application state, arbitrary attributes and resource or link
+      addresses from the document markup. Explicitly hidden elements are
+      removed. This is not anonymization: visible text, titles, citation
+      metadata and the separately saved source address, including any query
+      parameters, may still contain private information. Existing captures are
+      not rewritten. Only save pages you intend to keep in that collection.
+    </p>
+    <p>
+      For supported PDFs, Reader downloads the document for saving. Where
+      Chrome permits, the download uses your existing access to the original
+      website. The extension does not copy the website's login cookies into
+      the saved PDF as part of that operation.
+    </p>
+
+    <h2>Citation lookups</h2>
+    <p>
+      If a DOI is available, citation preparation may send that DOI to{" "}
+      <code>doi.org</code> and the registry it redirects to, such as Crossref
+      or DataCite. This can happen before you save. The lookup does not
+      intentionally send your notes, highlights or full article content.
+      Those services also receive ordinary network information such as your IP
+      address. Extension DOI requests omit cookies.
+    </p>
+
+    <h2>Optional saved-page recognition</h2>
+    <p>
+      “Mark pages I've saved and show my highlights on them” is optional. If
+      enabled, Chrome requests access to HTTPS websites. Reader then sends the
+      addresses of HTTPS pages you visit, including pages you have not saved,
+      through your configured Connect route to query your selected collection.
+      It retrieves matching saved highlights and may read page text to display
+      them. This is not merely an on-device browser comparison. Turning the
+      feature off stops these background lookups and requests removal of the
+      optional website permission.
+    </p>
+
+    <h2>Connection and local browser data</h2>
+    <p>
+      The extension keeps Connect authorization state, the selected collection,
+      preferences and interrupted-write recovery information in Chrome's
+      extension-local storage. Signing keys and application identity are held
+      in the extension's IndexedDB databases. Recovery data can include
+      identifiers, addresses and pending changes. Draft text and selected
+      passages are kept in extension session storage and cleaned up when their
+      tab closes. This implementation does not use Chrome's synchronized
+      storage for those drafts.
+    </p>
+    <p>
+      Connect grants are sensitive credentials used to access only collections
+      you authorize. Extension API requests do not use ambient Connect portal
+      cookies. The separate Connect approval website handles its own sign-in.
+    </p>
+
+    <h2>Where data goes</h2>
+    <p>
+      The production extension contacts <code>connect.mdbase.dev</code> for
+      authorization and collection operations. Depending on your collection,
+      records and files are handled by a hosted collection service or your own
+      connector, with a cloud relay where applicable. Not all traffic remains
+      on your computer. The <a href="/privacy/">Connect privacy page</a>
+      describes account, routing and hosted-collection handling.
+    </p>
+    <p>
+      For a collection served from your computer, you may separately allow
+      direct access to the connector on your own device. This is optional;
+      Chrome controls the localhost and local-network permissions. Websites
+      you capture and DOI registries have their own privacy practices.
+    </p>
+
+    <h2>Purposes, service providers and sharing</h2>
+    <p>
+      Reader uses this information to prepare and save sources, look up citation
+      metadata, store annotations, access an authorized collection, recover
+      interrupted writes and, if enabled, recognize saved pages. Connect
+      processes account and grant details, routing metadata and bounded usage
+      counts needed to operate the service; its operator report uses aggregate
+      counts rather than returning individual records or page contents.
+    </p>
+    <p>
+      Production Connect and its hosted provider run on Render with managed
+      PostgreSQL. Hosted files are stored as opaque objects in Cloudflare R2;
+      the hosted provider handles authorized record and file operations.
+      Render provides database recovery, and encrypted logical database
+      backup artifacts are retained through GitHub Actions. Account email may
+      be delivered through Resend. DOI registries receive a DOI when
+      a lookup is made, and the original website serves content or a PDF when
+      you choose to capture it. These providers may process the network and
+      operational information necessary to provide those services. The
+      extension does not contain an advertising or third-party analytics SDK.
+      We do not sell user data, use or transfer it for purposes unrelated to
+      Reader's stated function, or use or transfer it to determine
+      creditworthiness or for lending. Transfers to service providers and DOI
+      registries are limited to the functions described above.
+    </p>
+
+    <h2>Retention and controls</h2>
+    <ul>
+      <li>
+        Saved sources, files and annotations remain in the selected collection
+        until removed using the collection's controls. Removing the extension
+        does not delete them.
+      </li>
+      <li>
+        Session drafts are temporary. Local preferences, authorization and
+        recovery state can persist across browser restarts.
+      </li>
+      <li>
+        Turn off saved-page recognition in extension Settings to stop
+        background address lookups and request removal of website access.
+      </li>
+      <li>
+        Settings → Disconnect this browser → Disconnect and clear local data
+        removes extension-local state, session drafts and IndexedDB credentials
+        after confirmation. It also requests removal of optional website and
+        local-connector permissions. Finish pending saves first: a write already
+        sent may still complete, and recovery information is discarded.
+      </li>
+      <li>
+        Clearing this browser does not revoke server-side grants or delete
+        collection content, and does not affect other browsers. Highlights
+        already drawn on an open page may remain until it is reloaded. Revoke
+        Reader's application access in Connect and remove records/files in
+        your collection using its controls. Revocation for a connector-backed
+        collection can remain pending until that connector confirms it.
+      </li>
+    </ul>
+    <p>
+      Connect deletes expired authorization and usage rows that are no longer
+      needed, generally after about 13 months. Other account, grant and audit
+      information can be retained while needed for service, security or legal
+      purposes. Hosted file deletion may first leave retained versions and
+      backups that are removed through maintenance or backup expiry; deletion
+      from all recovery copies is not immediate. The provider and Render may
+      retain operational logs. The <a href="/account-deletion/">Connect account-deletion page</a>
+      explains account-level controls and exceptions; local collection files
+      on your own computers are not removed by deleting an account.
+    </p>
+
+    <h2>Contact and changes</h2>
+    <p>
+      For privacy questions or requests, contact
+      <a href="mailto:callum@mdbase.dev">Callum Alpass at callum@mdbase.dev</a>.
+      Changes to this policy will be posted at this address with an updated
+      effective date.
+    </p>
+    <p>Effective date: 27 September 2026.</p>
+  </article>
+</BaseLayout>

src/pages/privacy/index.astro

@@ -57,7 +57,8 @@ import BaseLayout from "../../layouts/BaseLayout.astro";
     <p>
       Applications connected through mdbase receive data under the grants users
       approve. Each application provider is independently responsible for its
-      own handling of authorized data.
+      own handling of authorized data. For the mdbase Reader browser extension,
+      see its <a href="/apps/reader/extension/privacy/">extension privacy page</a>.
     </p>
     <h2>Contact</h2>
     <p>