From c0db43dc9251d10e34fd6f2fd4878a2d3d8155f7 Mon Sep 17 00:00:00 2001
From: callumalpass <callumalpass@gmail.com>
Date: Mon, 2 Nov 2026 07:42:06 +1100
Subject: [PATCH] Correct the Reader extension privacy policy for install-time
 site access

The shipped extension requests https://*/* at install, queries the
user's collection to recognize saved pages, fetches PDFs in the page
with the user's site login, offers an opt-in Wikimedia Citoid lookup,
and talks to log.mdbase.dev for collection log and file transport.
Describe those flows, drop the optional saved-page permission and the
nonexistent Disconnect and clear local data and desktop direct-access
controls, and align the extension guide's permission notes.
---
 src/pages/apps/reader/extension/index.astro   |  26 +++--
 .../apps/reader/extension/privacy/index.astro | 108 +++++++++++-------
 2 files changed, 83 insertions(+), 51 deletions(-)

diff --git a/src/pages/apps/reader/extension/index.astro b/src/pages/apps/reader/extension/index.astro
index 93c3147..e5a0e6e 100644
--- a/src/pages/apps/reader/extension/index.astro
+++ b/src/pages/apps/reader/extension/index.astro
@@ -105,28 +105,34 @@ import DocVideo from "../../../../components/DocVideo.astro";
     When a page carries a DOI or scholarly metadata, the panel shows the
     citation it will store. With a DOI, the citation comes from the DOI
     registry, and only the DOI is sent. Otherwise it comes from the page's own
-    metadata tags.
+    metadata tags. If you turn on Wikimedia's Citoid lookup in Settings, which
+    is off by default, a page without a DOI citation can also be looked up by
+    sending its address to Wikimedia.
   </p>
 
   <h2 id="marks">Mark pages you have saved</h2>
   <p>
-    <strong>Settings → Mark pages I've saved</strong> is off by default. When
-    you turn it on, the extension asks for permission to read the pages you
-    visit. It then checks each HTTPS page against your collection, shows a
-    badge with a highlight count or a saved-page check mark, and displays saved
+    The extension asks for access to HTTPS websites when you install it. It
+    checks the pages you visit against your selected collection, shows a badge
+    with a highlight count or a saved-page check mark, and displays saved
     highlights. Opening the side panel can also show highlights for that page.
-    Turning saved-page marking off removes its optional HTTPS permission.
+    If you limit the extension's site access in Chrome, it stops marking saved
+    pages, and <strong>Settings → Pages you visit</strong> offers to allow it
+    on all sites again.
   </p>
 
   <h2 id="permissions">Permissions</h2>
   <ul>
     <li>
-      Without <strong>Mark pages I've saved</strong>, the extension can only
-      read a page when you open the panel on it.
+      It has access to HTTPS websites from installation, which it uses to
+      follow the tab you are on and mark saved pages. If you limit site access
+      in Chrome, it reads a page only where you allow it or when you open the
+      panel on it.
     </li>
     <li>
-      Its only permanent site access is the mdbase Connect API, which it uses
-      to reach your collection. That access cannot read the pages you browse.
+      It also has access to the mdbase Connect API and the mdbase collection
+      log service (<code>log.mdbase.dev</code>), which it uses to reach your
+      collection.
     </li>
     <li>Its access to your collection comes from the Connect approval, which you can revoke in Connect.</li>
     <li>See the <a href="/apps/reader/extension/privacy/">extension privacy policy</a> for capture data, permissions and third-party lookups.</li>
diff --git a/src/pages/apps/reader/extension/privacy/index.astro b/src/pages/apps/reader/extension/privacy/index.astro
index adc059b..9981851 100644
--- a/src/pages/apps/reader/extension/privacy/index.astro
+++ b/src/pages/apps/reader/extension/privacy/index.astro
@@ -42,10 +42,13 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
       not rewritten. Only save pages you intend to keep in that collection.
     </p>
     <p>
-      For supported PDFs, Reader downloads the document for saving. Where
-      Chrome permits, the download uses your existing access to the original
-      website. The extension does not copy the website's login cookies into
-      the saved PDF as part of that operation.
+      When you save a supported PDF, Reader downloads the document from
+      within the page, using your existing cookies and login for that
+      website. This lets Reader save PDFs that are available to you only
+      while signed in. If Reader cannot fetch it from the page, the
+      extension tries to download the PDF directly. The PDF goes only to your
+      selected collection. Reader does not export or save the website's cookies or
+      your login details.
     </p>
 
     <h2>Citation lookups</h2>
@@ -57,29 +60,51 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
       Those services also receive ordinary network information such as your IP
       address. Extension DOI requests omit cookies.
     </p>
+    <p>
+      Wikimedia Citoid lookup is off by default. If you turn on “Look up
+      citations with Wikimedia’s Citoid service” in extension Settings and no
+      DOI citation is found for a web page, Reader sends the captured page's
+      address to Wikimedia's Citoid service. Reader does not send addresses
+      of PDFs, local or private hostnames, IP addresses, or links whose query
+      parameters look like tokens, keys or session codes. Citoid requests omit
+      cookies and other credentials. Like DOI lookups, this can happen before
+      you save.
+    </p>
 
-    <h2>Optional saved-page recognition</h2>
+    <h2>Website access and saved-page recognition</h2>
+    <p>
+      Reader requests access to all HTTPS websites when you install it. With
+      that access, the side panel follows the tab you are on, and Reader marks
+      pages you have saved and shows your highlights on them. To do this,
+      Reader queries your selected collection through your configured Connect
+      route. It keeps short hashes of the addresses saved in that collection
+      in extension storage and refreshes them from the collection about once
+      an hour. When an HTTPS page you load matches one of them, Reader sends
+      the page's address to your collection to retrieve its saved highlights,
+      and may read page text to display them. While the side panel is open,
+      Reader also sends the address of the tab you are on to your collection
+      to check whether that page is saved.
+    </p>
     <p>
-      “Mark pages I've saved and show my highlights on them” is optional. If
-      enabled, Chrome requests access to HTTPS websites. Reader then sends the
-      addresses of HTTPS pages you visit, including pages you have not saved,
-      through your configured Connect route to query your selected collection.
-      It retrieves matching saved highlights and may read page text to display
-      them. This is not merely an on-device browser comparison. Turning the
-      feature off stops these background lookups and requests removal of the
-      optional website permission.
+      You can limit Reader's site access in Chrome's extension settings. Reader
+      then stops following your tabs and marking saved pages, and works on a
+      page only where you have allowed it or after you click its toolbar
+      button there. The “Pages you visit” section of extension Settings shows
+      when site access is limited and can ask Chrome to allow it on all sites
+      again.
     </p>
 
     <h2>Connection and local browser data</h2>
     <p>
-      The extension keeps Connect authorization state, the selected collection,
-      preferences and interrupted-write recovery information in Chrome's
-      extension-local storage. Signing keys and application identity are held
-      in the extension's IndexedDB databases. Recovery data can include
-      identifiers, addresses and pending changes. Draft text and selected
-      passages are kept in extension session storage and cleaned up when their
-      tab closes. This implementation does not use Chrome's synchronized
-      storage for those drafts.
+      The extension keeps Connect authorization state and grants, the Connect
+      account email it shows, the selected collection, preferences, the hashed
+      saved-page addresses described above and interrupted-write recovery
+      information in Chrome's extension-local storage and the extension's
+      IndexedDB databases. Signing keys and application identity are held in
+      IndexedDB. Recovery data can include identifiers, addresses and pending
+      changes. Draft text and selected passages are kept per tab in extension
+      session storage and cleaned up when their tab closes. The extension does
+      not use Chrome's synchronized storage.
     </p>
     <p>
       Connect grants are sensitive credentials used to access only collections
@@ -90,25 +115,26 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
     <h2>Where data goes</h2>
     <p>
       The production extension contacts <code>connect.mdbase.dev</code> for
-      authorization and collection operations. Depending on your collection,
-      records and files are handled by the readable copy mdbase keeps (a Cloud
+      authorization and collection operations. The mdbase SDK in the extension
+      also contacts <code>log.mdbase.dev</code>, mdbase's first-party
+      collection log and file transport. It carries the operations on
+      collections you have authorized and is not an analytics service.
+      Depending on your collection, records and files are handled by the readable copy mdbase keeps (a Cloud
       copy collection) or by one of your own devices through the mdbase relay
       (a Private collection). Not all traffic remains on your computer. The{" "}
       <a href="/privacy/">Connect privacy page</a> describes account, routing
       and Cloud copy handling.
     </p>
     <p>
-      When the mdbase desktop app runs on your computer, you may separately
-      allow the extension to reach it directly. This is optional;
-      Chrome controls the localhost and local-network permissions. Websites
-      you capture and DOI registries have their own privacy practices.
+      Websites you capture, DOI registries and, if you turn it on, Wikimedia's
+      Citoid service have their own privacy practices.
     </p>
 
     <h2>Purposes, service providers and sharing</h2>
     <p>
       Reader uses this information to prepare and save sources, look up citation
       metadata, store annotations, access an authorized collection, recover
-      interrupted writes and, if enabled, recognize saved pages. Connect
+      interrupted writes and recognize saved pages. Connect
       processes account and grant details, routing metadata and bounded usage
       counts needed to operate the service; its operator report uses aggregate
       counts rather than returning individual records or page contents.
@@ -121,14 +147,15 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
       Render provides database recovery, and encrypted logical database
       backup artifacts are retained through GitHub Actions. Account email may
       be delivered through Resend. DOI registries receive a DOI when
-      a lookup is made, and the original website serves content or a PDF when
-      you choose to capture it. These providers may process the network and
+      a lookup is made, Wikimedia receives a page address when you have
+      turned on Citoid lookup, and the original website serves content or a
+      PDF when you choose to capture it. These providers may process the network and
       operational information necessary to provide those services. The
       extension does not contain an advertising or third-party analytics SDK.
       We do not sell user data, use or transfer it for purposes unrelated to
       Reader's stated function, or use or transfer it to determine
-      creditworthiness or for lending. Transfers to service providers and DOI
-      registries are limited to the functions described above.
+      creditworthiness or for lending. Transfers to service providers, DOI
+      registries and Wikimedia are limited to the functions described above.
     </p>
     <p>
       Our use of information received from Google APIs adheres to the
@@ -147,18 +174,17 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
         recovery state can persist across browser restarts.
       </li>
       <li>
-        Turn off saved-page recognition in extension Settings to stop
-        background address lookups and request removal of website access.
+        Limit Reader's site access in Chrome's extension settings to stop
+        background saved-page lookups for the pages you visit.
       </li>
       <li>
-        Settings → Disconnect this browser → Disconnect and clear local data
-        removes extension-local state, session drafts and IndexedDB credentials
-        after confirmation. It also requests removal of optional website and
-        local-network permissions. Finish pending saves first: a write already
-        sent may still complete, and recovery information is discarded.
+        Removing the extension from Chrome deletes its extension-local
+        storage, session drafts and IndexedDB data, including its Connect
+        credentials, in that browser. Finish pending saves first: a write
+        already sent may still complete, and recovery information is discarded.
       </li>
       <li>
-        Clearing this browser does not revoke server-side grants or delete
+        Removing the extension does not revoke server-side grants or delete
         collection content, and does not affect other browsers. Highlights
         already drawn on an open page may remain until it is reloaded. Revoke
         Reader's application access in Connect and remove records/files in
@@ -186,6 +212,6 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
       Changes to this policy will be posted at this address with an updated
       effective date.
     </p>
-    <p>Effective date: 27 September 2026.</p>
+    <p>Effective date: 2 November 2026.</p>
   </article>
 </BaseLayout>