Repository navigation
Conversation
… review - Remove remote analytics events (workers.dev) and its host permission - Rewrite privacy policy to disclose AI proxy / Anthropic / GitHub API data flows - Fix store listing claims of zero data collection - Rename 'Share NFT' to 'Share emoji card' - Harden native host allowlist against chained shell commands - Add store/SUBMISSION.md with permission justifications Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XvfJUu8QAomjNGxkdVZB7K
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Mark · project thread
Why
v3.0.0 was rejected on the Chrome Web Store. The most likely cause is that the privacy policy and listing say the extension "does not send any data to external servers" and has "zero analytics", while the code sends README/chat text to the Vercel AI proxy (and Anthropic) and posted usage events to
smile-ai-proxy…workers.dev/event. That mismatch is a classic User Data Policy rejection.Changes
trackEventanalytics calls and theworkers.devhost permission (local counters stay inchrome.storage).privacy-policy.htmlto accurately disclose what is sent to the AI proxy, Anthropic and the GitHub API, and what is stored locally.store/listing.mdclaims ("No data collection"), drop "25+ presets" wording.`,$(,|, newlines and anything after the closing quote ofclaude "…"/codex "…".store/SUBMISSION.mdwith single-purpose text and permission justifications for the dashboard.Checked
node --checkon all extension JS,py_compileon the native host.claude "x"; rm -rf ~,$(…), backticks and pipes are rejected.Generated by Claude Code