Privacy policy generator for Chrome extensions

What the store reviewer checks

These checks come from the store's published rules. Open each source before you submit. The scan above checks your website, not your app or extension.

1. The policy link is in the Developer Dashboard

   If the extension handles any user data, it needs an accurate and current privacy policy, linked in the designated field of the Chrome Web Store Developer Dashboard.

2. Privacy fields match the policy and the extension

   The privacy fields in the dashboard must be accurate. If they contradict your policy or how the extension behaves, Google can remove the extension from the store.

3. Data use stays within one purpose

   The extension may only collect, use or send user data needed for its disclosed single purpose. Describe that purpose in detail in the single purpose field.

What to account for

1. Publish an accurate privacy policy

   Extensions handling user data need a current policy disclosing collection, use and sharing, linked in the designated Developer Dashboard field.

2. Keep data use within the declared purpose

   The Limited Use rules restrict data use to the extension’s disclosed single purpose and permitted related uses. Include the required Limited Use statement on your extension’s website.

3. Review every permission surface

   Inspect API permissions, host permissions and content-script match patterns. Optional permissions can be requested at runtime when the feature allows it.

Common mistakes to check

1. Saying “no data” while handling it locally

   The user-data policy concerns handling data, not only selling it or uploading it. Review the FAQ against actual extension behavior before choosing your disclosures.

2. Leaving broad access unexplained

   Host permissions and content-script patterns can grant access across sites and trigger warnings. Check that requested access matches the feature you describe to users.

Your review checklist

Our suggested review process. The linked requirements above explain the platform or legal basis.

1. Inventory the extension itself

   Scan your public support site, then inspect the extension manifest, SDKs, storage and network calls. Record what stays on-device and what reaches your servers or other providers.

2. Reconcile policy and store declarations

   List data categories, purposes, recipients, retention and deletion controls. Compare that inventory with the privacy draft, store listing and developer-dashboard disclosures.

3. Review the submitted build

   Test the exact package submitted for review, including optional features and sign-in. Open the policy URL without authentication and record who will update it when behavior changes.

Example

1. A bookmark extension with optional sync

   A fictional extension stores bookmarks locally and offers account sync. Its owner separates local storage from synced URLs, account identifiers and the hosting provider in the inventory.

2. One review package

   The owner checks permission scope, reviews the draft and compares the store’s disclosures with both sync states. The policy link is tested from a signed-out browser before submission.

Questions before publishing

1. What if the extension handles no user data?

   Google’s FAQ says extensions that do not handle user data have no additional obligation under its User Data Policy. Verify the actual behavior, including dependencies.

2. Can a policy justify unrelated data use?

   No. Disclosing a practice does not override the Limited Use restrictions.

3. Are optional permissions available?

   Yes. Chrome supports optional API and host permissions granted at runtime instead of installation, where appropriate for the feature.