Privacy and local scanning
Privacy notes for the local Chrome extension ZIP scanner
Understand what the local scanner reads, what it does not upload, and which analytics data should never be collected.
Run local ZIP scanPrivacy-safe next step
Use the scanner without uploading your source package
Choose the extension ZIP in your browser to run the local static scan. The page should not send source code, manifest content, snippets, detected URLs, file names, file paths, or scan-limit details to analytics.
Independent local static preflight only. This is not an official Chrome Web Store validation result.
Guide
What to check
Your ZIP stays in the browser
The scanner reads the selected ZIP with browser APIs and produces a local static report. It does not need an account, server upload, or Chrome Web Store login. The scanner should not transmit ZIP names, file paths, manifest content, source snippets, detected URLs, or package contents.
What the report uses
The report uses manifest.json, file references, extension pages, JavaScript text, CSP declarations, permissions, icon metadata, and package structure found inside the selected ZIP.
What analytics must not collect
Analytics should not send source code, manifest content, snippets, file names, file paths, package names, extension IDs, ZIP names, detected URLs, or ZIP contents. Only aggregate event counts, severity totals, partial-scan status, and rules_version should be tracked.
Partial scan notes stay local
When the browser skips unknown-size or very large files, that partial-scan note is included in the local report. It should not be sent to analytics with file names, paths, snippets, detected URLs, or source content.
Separate local scan data from analytics
The scanner can show file paths, snippets, rule IDs, and scan-limit notes in the user's local report. Those details should stay in the browser and must not be sent to analytics or advertising scripts.
Advertising disclosure
Google advertising cookies and choices
Third-party advertising cookies
This site may use Google AdSense. Third-party vendors, including Google, may use cookies to serve ads based on prior visits to this site or other websites.
Personalized ads
Google's advertising cookies enable Google and its partners to serve ads based on visits to this site and other sites on the Internet.
Opt-out choices
Users can opt out of personalized advertising in Google Ads Settings or review broader choices through AboutAds.
Practical notes
How to apply this before resubmission
Keep scan data local by design
The trust promise of this tool depends on the scanner reading the ZIP in the browser and keeping package details out of analytics. The visible report can include file paths, snippets, skipped-file notes, and rule IDs because the user needs those details to fix the extension. Those details should remain in the browser session or in a user-initiated download, not in tracking events or third-party scripts.
- •Do not send ZIP names, file paths, snippets, manifest content, or detected URLs to analytics.
- •Treat downloaded JSON reports as user-controlled local files.
- •Keep advertising and third-party scripts away from upload, scan, copy, and download flows.
Explain partial scans without weakening trust
Browser-side scanning needs limits for ZIP size, file count, expanded size, and very large text files. When the scanner skips an entry, it should say so clearly in the scan-limit section instead of hiding the skipped file. A partial scan can still be useful, but users need to know which parts of the package were not inspected before relying on the report.
- •Show scan-limit notes separately from code findings.
- •Do not count browser safety limits as policy violations.
- •Recommend manual review when important files were skipped.
Separate local scan privacy from your extension privacy
This privacy page describes the scanner website, not the extension you upload. The scanner can keep ZIP analysis local while your own extension may still need a separate privacy policy, dashboard disclosures, and permission explanations. Do not reuse the scanner privacy wording as your extension policy unless it actually describes your product behavior.
- •Scanner privacy: what this website reads in your browser.
- •Extension privacy: what your submitted extension reads, stores, or transmits.
- •Dashboard privacy fields: how you disclose extension behavior to Chrome Web Store reviewers.
What downloaded reports may contain
A downloaded JSON or Markdown report is created by your browser for your own review. It may include rule IDs, finding messages, severity, confidence labels, file paths inside the ZIP, short source snippets, and scan-limit notes. That information is useful for debugging, but it should not be collected by analytics or shared publicly without reviewing what it reveals about your extension.
- •Treat reports as developer debugging artifacts.
- •Remove source snippets before pasting reports into public forums.
- •Do not attach reports to reviewer notes unless they are short and relevant.
Why advertising and analytics stay outside the scan flow
For a local code-audit tool, user trust depends on keeping upload, scan, copy, and download actions isolated from third-party scripts. The page should not send ZIP names, file paths, snippets, detected URLs, or manifest contents to analytics. If advertising is used elsewhere on the site, it should not be placed inside the scanner workbench or near report actions.
- •Keep scan event analytics aggregate-only.
- •Do not send filenames or detected URL strings as event parameters.
- •Keep third-party scripts away from the upload and report controls.
Checklist
Action checklist
- □ Do not upload source code.
- □ Do not collect ZIP names, file paths, source snippets, detected URLs, or manifest content in analytics.
- □ Do not store ZIP contents.
- □ Keep ads and third-party scripts away from the upload, scan, copy, and download flow.
- □ Do not claim Chrome Web Store approval is guaranteed.
- □ Use the scanner as a local preflight check, not a legal or official validation result.
- □ Do not send generated JSON reports, source snippets, file paths, detected URLs, or scan-limit notes to analytics, advertising, or remote logging tools.
Examples
Common cases this page helps with
Safe analytics event
scan_success with high_count, medium_count, low_count, partial_scan, and rules_version is acceptable because it is aggregate diagnostic data.
Unsafe analytics event
Sending manifest.json, source snippets, ZIP names, file names, detected URLs, or file paths would expose extension implementation details and should be avoided.
User-facing trust copy
Your ZIP is read locally in this browser. The scanner does not upload your extension package.
FAQ
Frequently asked questions
Does the scanner upload my extension ZIP?
No. The intended product behavior is browser-only scanning. Your ZIP should be read locally to generate a static report, and analytics should not receive ZIP names, file paths, source snippets, detected URLs, or manifest content.
Does the scanner store source code?
No. Do not add persistence or analytics that stores source files, snippets, manifest contents, or package paths.
Is the scan an official approval result?
No. It is a local static preflight scan and cannot guarantee Chrome Web Store approval.
Official sources
Sources used for this page
These links are listed so scanner findings and page guidance can be checked against Chrome's source documentation. This site remains an independent preflight tool.
Chrome Web Store: Fill out the privacy fields
Explains the Developer Dashboard privacy practices tab, single purpose, and permission justification fields.
Chrome Web Store Developer Program Policies
Sets the broader user trust, transparency, and user data handling policy baseline for Chrome Web Store items.
Related guides