diff --git a/docs/superpowers/specs/2026-10-21-privacy-policy-design.md b/docs/superpowers/specs/2026-10-21-privacy-policy-design.md new file mode 100644 index 0000000..03c0dda --- /dev/null +++ b/docs/superpowers/specs/2026-10-21-privacy-policy-design.md @@ -0,0 +1,110 @@ +# Add a privacy policy + +Status: design approved on 2026-10-21. The policy isn't written yet, and it +will be published after the release that fixes #16. Researched, but not legal +advice. + +## Problem + +- The AMO listing has no privacy policy. On 2026-10-21 the API reported + `has_privacy_policy: false`. +- The README has a short "Privacy Policy" section. The website's page for the + extension says only "Extension collects zero user information." +- The owner wants a policy that says the extension collects nothing and that + data will never be sold: "basically the most privacy respecting as possible". + +## Goals + +1. Say in plain English what happens to data, with every claim checkable + against the code. +2. Make clear that Zavage Software receives nothing and will never sell data. +3. Make clear that ChatGPT is a separate service under OpenAI's own privacy + policy. + +## Decisions + +- **Plain English, organised by where data goes.** A one-line "we collect + nothing" would hide the hand-off to ChatGPT. A formal GDPR-style template is + the legalese Mozilla advises against (Extension Workshop, "Create an appealing + listing"). +- **The extension only.** One line says the policy doesn't cover the website or + email, although the options page links to the website and its contact form. + The policy ends with mat@zavage.net for questions. The owner chose this over + also covering messages or the whole website. +- **The current version only.** The policy says it describes the current + version and, at the owner's request, leaves out how earlier versions differed. + Versions 1.0 to 1.2 had Firefox fetch the search icon from zavage-software.com, + which 82fdf88 removed. +- **#16 is fixed first.** Up to 1.3, a chat started in a private window can open + in a normal window. The owner chose to fix that before publishing rather than + disclose it, so the policy doesn't mention it. +- **Promises.** Nothing is ever sold. Any future collection would be opt-in, and + the policy is updated before any version that changes how data is handled. +- **No "can't".** Nothing in the code sends data to Zavage Software, but that is + a fact about the current code. The policy says so and points to the public + source instead of claiming the extension is unable to send data. +- **No claim that Mozilla agreed.** #17 asks whether the manifest's "no data + collection" declaration covers the hand-off to ChatGPT, and it is still open. + The policy describes what happens and doesn't say Mozilla confirmed anything. +- **`PRIVACY.md` is the only copy.** It is pasted into AMO unchanged. The README + section shrinks to a summary and a link. AGENTS.md names `PRIVACY.md` as the + file every data-handling change must update. +- **Not packaged.** `web-ext-config.mjs` ignores `PRIVACY.md`, so AMO and the + repository hold it. +- **Its own pull request,** separate from the license change in #33. +- **Review.** Three readers: one checks each claim against the code, one checks + Mozilla's policies and privacy law, and one reads it cold for plain English. + +## What each claim rests on + +| Claim | Evidence | +| --- | --- | +| Zavage Software receives nothing | The code has no `fetch`, `XMLHttpRequest`, `sendBeacon`, `WebSocket` or `EventSource`, and the manifest has had no `favicon_url` since 82fdf88. | +| Settings stay in Firefox and sync only through Firefox Sync | `lib/settings.js:37-60` uses `storage.sync`, the only storage API in the code. | +| Three permissions, and no host access | `manifest.json:25`: `storage`, `menus` and `activeTab`. | +| The manifest declares no data collection | `manifest.json:18` | +| The selection is read only when the toolbar button or shortcut is used | `background/background.js:41-50`: `activeTab` and `tabs.executeScript`. | +| The right-click menu gets the selection, link or page address from Firefox at the click | `lib/actions.js:16-21` | +| ChatGPT receives the text in the address of the page the extension opens | `lib/build-url.js:11` and `:45-47`; `background/open-chat.js:1-9` | +| Temporary chat and web search are only hints in that address | `lib/build-url.js:32-37` | +| Dialogs hold pending text in memory only | `background/dialogs.js:1` and `:20` | +| The `gpt` search sends nothing until Enter | `manifest.json:58-61` has no `suggest_url`. | +| No remote code | Manifest V2's default content security policy runs only the extension's own scripts. | +| Links to other sites open only when clicked | `options/options.html` | + +## AMO's privacy policy field + +- Unlike the license field, it renders a restricted Markdown. The field is + `privacy_policy = PurifiedMarkdownField(...)` in addons-server's + `addons/models.py`, as Mozilla's blog post of 3 March 2025 describes. +- The allowed tags are `a`, `abbr`, `acronym`, `b`, `blockquote`, `code`, `em`, + `i`, `li`, `ol`, `strong` and `ul`. Headings are dropped, so section labels + are bold lines. +- Tags are stripped before the Markdown is rendered, so anything in angle + brackets disappears. +- Bare URLs become links through Mozilla's redirector. The email address may + link to AMO's home page, as it does in the license. + +## Publishing on AMO (untested, 2026-10-21) + +Publish after the release that fixes #16. + +1. In the Developer Hub, open the add-on's **Manage Authors & License** page, + where the license is set too. +2. Tick "This add-on has a Privacy Policy" and paste `PRIVACY.md` unchanged. +3. Save, then check: + + ```sh + curl -s https://addons.mozilla.org/api/v5/addons/addon/search-with-chatgpt/ | jq .has_privacy_policy + curl -s https://addons.mozilla.org/api/v5/addons/addon/search-with-chatgpt/eula_policy/ | jq .privacy_policy + ``` + + The policy then appears at + https://addons.mozilla.org/firefox/addon/search-with-chatgpt/privacy/. + +## Outside the policy + +- Point the website's "Extension collects zero user information" at the new + policy. +- #17 is still open. +- The Chrome repository has no privacy policy.