search-with-chatgpt-powered-by-openai-extension/docs/superpowers/specs/2026-10-21-privacy-policy-design.md

Add a privacy policy

Status: design approved on 2026-10-21. The policy isn't written yet, and it will be published after the release that fixes #16. Researched, but not legal advice.

Problem

• The AMO listing has no privacy policy. On 2026-10-21 the API reported has_privacy_policy: false.
• The README has a short "Privacy Policy" section. The website's page for the extension says only "Extension collects zero user information."
• The owner wants a policy that says the extension collects nothing and that data will never be sold: "basically the most privacy respecting as possible".

Goals

1. Say in plain English what happens to data, with every claim checkable against the code.
2. Make clear that Zavage Software receives nothing and will never sell data.
3. Make clear that ChatGPT is a separate service under OpenAI's own privacy policy.

Decisions

• Plain English, organised by where data goes. A one-line "we collect nothing" would hide the hand-off to ChatGPT. A formal GDPR-style template is the legalese Mozilla advises against (Extension Workshop, "Create an appealing listing").
• The extension only. One line says the policy doesn't cover the website or email, although the options page links to the website and its contact form. The policy ends with mat@zavage.net for questions. The owner chose this over also covering messages or the whole website.
• The current version only. The policy says it describes the current version and, at the owner's request, leaves out how earlier versions differed. Versions 1.0 to 1.2 had Firefox fetch the search icon from zavage-software.com, which 82fdf88 removed.
• #16 is fixed first. Up to 1.3, a chat started in a private window can open in a normal window. The owner chose to fix that before publishing rather than disclose it, so the policy doesn't mention it.
• Promises. Nothing is ever sold. Any future collection would be opt-in, and the policy is updated before any version that changes how data is handled.
• No "can't". Nothing in the code sends data to Zavage Software, but that is a fact about the current code. The policy says so and points to the public source instead of claiming the extension is unable to send data.
• No claim that Mozilla agreed. #17 asks whether the manifest's "no data collection" declaration covers the hand-off to ChatGPT, and it is still open. The policy describes what happens and doesn't say Mozilla confirmed anything.
• PRIVACY.md is the only copy. It is pasted into AMO unchanged. The README section shrinks to a summary and a link. AGENTS.md names PRIVACY.md as the file every data-handling change must update.
• Not packaged. web-ext-config.mjs ignores PRIVACY.md, so AMO and the repository hold it.
• Its own pull request, separate from the license change in #33.
• Review. Three readers: one checks each claim against the code, one checks Mozilla's policies and privacy law, and one reads it cold for plain English.

What each claim rests on

Claim	Evidence
Zavage Software receives nothing	The code has no fetch, XMLHttpRequest, sendBeacon, WebSocket or EventSource, and the manifest has had no favicon_url since 82fdf88.
Settings stay in Firefox and sync only through Firefox Sync	lib/settings.js:37-60 uses storage.sync, the only storage API in the code.
Three permissions, and no host access	manifest.json:25: storage, menus and activeTab.
The manifest declares no data collection	manifest.json:18
The selection is read only when the toolbar button or shortcut is used	background/background.js:41-50: activeTab and tabs.executeScript.
The right-click menu gets the selection, link or page address from Firefox at the click	lib/actions.js:16-21
ChatGPT receives the text in the address of the page the extension opens	lib/build-url.js:11 and :45-47; background/open-chat.js:1-9
Temporary chat and web search are only hints in that address	lib/build-url.js:32-37
Dialogs hold pending text in memory only	background/dialogs.js:1 and :20
The gpt search sends nothing until Enter	manifest.json:58-61 has no suggest_url.
No remote code	Manifest V2's default content security policy runs only the extension's own scripts.
Links to other sites open only when clicked	options/options.html

AMO's privacy policy field

• Unlike the license field, it renders a restricted Markdown. The field is privacy_policy = PurifiedMarkdownField(...) in addons-server's addons/models.py, as Mozilla's blog post of 3 March 2025 describes.
• The allowed tags are a, abbr, acronym, b, blockquote, code, em, i, li, ol, strong and ul. Headings are dropped, so section labels are bold lines.
• Tags are stripped before the Markdown is rendered, so anything in angle brackets disappears.
• Bare URLs become links through Mozilla's redirector. The email address may link to AMO's home page, as it does in the license.

Publishing on AMO (untested, 2026-10-21)

Publish after the release that fixes #16.

1. In the Developer Hub, open the add-on's Manage Authors & License page, where the license is set too.

2. Tick "This add-on has a Privacy Policy" and paste PRIVACY.md unchanged.

3. Save, then check:

   curl -s https://addons.mozilla.org/api/v5/addons/addon/search-with-chatgpt/ | jq .has_privacy_policy
   curl -s https://addons.mozilla.org/api/v5/addons/addon/search-with-chatgpt/eula_policy/ | jq .privacy_policy
   

   The policy then appears at https://addons.mozilla.org/firefox/addon/search-with-chatgpt/privacy/.

Outside the policy

• Point the website's "Extension collects zero user information" at the new policy.
• #17 is still open.
• The Chrome repository has no privacy policy.