Ground Reader policy in Connect service and retention evidence

Author: callumalpass

docs/reader-extension-privacy-review.md

@@ -2,18 +2,26 @@
 
 Proposed URL: `https://mdbase.dev/apps/reader/extension/privacy/`.
 
-This page is a **draft**, not an approved policy. Do not merge/deploy or enter the URL in the Chrome Web Store until the publisher and service operator approve the facts below. It describes the 0.2.0 candidate uploaded from `mdbase-reader` commit `adc9d27f86d0040320f5f26f2d96c176c33aa92b`; if the submitted ZIP changes, re-audit it. The source audit, data-category mapping and candidate hash are in `mdbase-reader/docs/chrome-web-store/` on `fix/extension-store-hardening`.
+This page is a **draft**, not an approved policy. Do not merge/deploy or enter the URL in the Chrome Web Store until the publisher approves the final wording. It describes the 0.2.0 candidate uploaded from `mdbase-reader` commit `adc9d27f86d0040320f5f26f2d96c176c33aa92b`; if the submitted ZIP changes, re-audit it. The source audit, data-category mapping and candidate hash are in `mdbase-reader/docs/chrome-web-store/` on `fix/extension-store-hardening`.
+
+## Repository findings used in the draft
+
+- **Operator/contact:** The owner confirmed both are Callum Alpass. `mdbase-cloud-ops/docs/account-and-service-inventory.md` lists `callum@mdbase.dev` as the Google OAuth support and product email; this draft proposes that publicly reachable address for privacy requests. Confirm the actual mailbox receives requests before publication.
+- **Topology:** `mdbase-cloud-ops/docs/render-production.md` describes Render Connect, hosted provider, relay broker and separate PostgreSQL databases. The hosted provider handles records/files; the control plane does not persist record payloads. `docs/r2-storage.md` describes Cloudflare R2 file objects and deferred deletion after retained references are gone. The existing `/privacy/` page already distinguishes local connector data, encrypted relay payloads and provider-readable hosted data.
+- **Backups/logs:** `mdbase-cloud-ops/docs/disaster-recovery.md` and `.github/workflows/backups.yml` document Render PITR and encrypted logical exports retained for 90 days as GitHub artifacts on the database-only path. A complete AWS S3 archive is designed but gated by `RECOVERY_ARCHIVE_ENABLED`; do not claim it is live without checking that setting. `docs/render-production.md` and `docs/observability.md` describe privacy-bounded Render application logs, but do not establish a public, exact log-retention interval. Do not promise instant erasure from backups.
+- **Usage/retention:** `mdbase-connect/docs/usage-report.md` describes aggregate operator reports from existing account/grant/token/usage rows and daily deletion of expired authorization/protocol-usage rows no longer needed after 395 days. This does not set a 395-day retention period for all account, audit, provider or backup data.
+- **Revocation/deletion:** `mdbase-connect/apps/editor/src/ConnectApp.tsx` has application-grant revocation controls; local/hosted authority confirmation may be pending. `apps/editor/src/AccountManagement.tsx` conditionally disables account deletion when the service reports it unavailable. The ops desired `render.yaml` enables it, but a live check is required before claiming it is currently available. Browser-local extension reset is not server-side revocation. Hosted record/file deletion can leave retained versions or backups.
+- **Email:** `mdbase-cloud-ops/docs/account-and-service-inventory.md` identifies Resend for account-related delivery. DOI lookups and original-site PDF requests are documented in the extension-store-hardening audit, not Connect.
 
 ## Confirm before publication
 
-- Name the legal/person operator, effective date and a tested public contact channel for privacy/deletion requests. The Reader repository's public GitHub issue URL currently returns 404; do not use it as support contact.
-- Verify production Connect, hosted-collection and relay providers/subprocessors; network metadata, logs, backups, retention and deletion. The general Connect policy covers part of this but does not establish extension-specific practices. Link to it without implying all traffic is local or end-to-end encrypted.
-- Verify Connect grant revocation, collection record/file deletion and account deletion instructions. Local extension cleanup does **not** revoke a server grant or remove saved collection data.
-- Confirm purposes and sharing with the operator, including no sale, unrelated use, creditworthiness/lending use and Chrome Limited Use compliance. Do not check the Web Store's three certifications merely because source code has no ad SDK.
+- Test `callum@mdbase.dev` as a privacy contact, and set the effective date to the actual publication date. Confirm operator wording and the public handling process for privacy/deletion requests.
+- Check live production settings for backup archive activation, log retention and account deletion. The repositories provide desired state and implementation but cannot prove all live provider settings or data already retained there.
+- Confirm no sale/impermissible transfer, unrelated use, lending/creditworthiness use and Chrome Limited Use compliance as operator practices. Do not check the Web Store's three certifications merely because source code has no ad SDK.
 - Reconcile Web Store data categories with the actual submitted build and backend: website content, visited URLs, authorization credentials, account identifiers, IP/location and activity/usage reporting. Recheck optional HTTPS permission and DOI traffic before claiming they stop or omit data.
 - Check the published page against the production ZIP and the other Reader/Connect pages. The site's in-progress Reader documentation currently exists as untracked work in the canonical `mdbase.dev` checkout, not on this branch; coordinate separately rather than copying or overwriting it.
 - After approval and deployment, fetch the public URL without authentication and verify its content, canonical URL and links before entering it in the Chrome Web Store. Save the draft, re-open “Why can't I submit?”, and submit only with explicit publisher approval.
 
 ## Validation
 
-`pnpm check` and `pnpm build` pass. `pnpm check:links` currently reports an unrelated existing `/sdk/` → `/spec/#section-14` fragment problem on `origin/main`; the new policy's local link and inline-code checks pass after the spacing fix.
+`pnpm check` and `pnpm build` pass. `pnpm check:links` reports an unrelated existing `/sdk/` → `/spec/#section-14` fragment problem on `origin/main`; new policy links and inline-code checks pass.

src/pages/apps/reader/extension/privacy/index.astro

@@ -10,9 +10,9 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
     <header>
       <h1>mdbase Reader browser extension privacy</h1>
       <p>
-        This page covers the mdbase Reader browser extension. The
-        <a href="/privacy/">mdbase website and Connect privacy page</a> covers the
-        related website and Connect service.
+        This page covers the mdbase Reader browser extension, operated by
+        Callum Alpass. The <a href="/privacy/">mdbase website and Connect privacy page</a>
+        covers the related website and Connect service.
       </p>
     </header>
 
@@ -103,6 +103,28 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
       you capture and DOI registries have their own privacy practices.
     </p>
 
+    <h2>Purposes, service providers and sharing</h2>
+    <p>
+      Reader uses this information to prepare and save sources, look up citation
+      metadata, store annotations, access an authorized collection, recover
+      interrupted writes and, if enabled, recognize saved pages. Connect
+      processes account and grant details, routing metadata and bounded usage
+      counts needed to operate the service; its operator report uses aggregate
+      counts rather than returning individual records or page contents.
+    </p>
+    <p>
+      Production Connect and its hosted provider run on Render with managed
+      PostgreSQL. Hosted files are stored as opaque objects in Cloudflare R2;
+      the hosted provider handles authorized record and file operations.
+      Render provides database recovery, and encrypted logical database
+      backup artifacts are retained through GitHub Actions. Account email may
+      be delivered through Resend. DOI registries receive a DOI when
+      a lookup is made, and the original website serves content or a PDF when
+      you choose to capture it. These providers may process the network and
+      operational information necessary to provide those services. The
+      extension does not contain an advertising or third-party analytics SDK.
+    </p>
+
     <h2>Retention and controls</h2>
     <ul>
       <li>
@@ -128,16 +150,31 @@ import BaseLayout from "../../../../../layouts/BaseLayout.astro";
       <li>
         Clearing this browser does not revoke server-side grants or delete
         collection content, and does not affect other browsers. Highlights
-        already drawn on an open page may remain until it is reloaded. Manage
-        grants in Connect and remove records/files in your collection.
+        already drawn on an open page may remain until it is reloaded. Revoke
+        Reader's application access in Connect and remove records/files in
+        your collection using its controls. Revocation for a connector-backed
+        collection can remain pending until that connector confirms it.
       </li>
     </ul>
+    <p>
+      Connect deletes expired authorization and usage rows that are no longer
+      needed, generally after about 13 months. Other account, grant and audit
+      information can be retained while needed for service, security or legal
+      purposes. Hosted file deletion may first leave retained versions and
+      backups that are removed through maintenance or backup expiry; deletion
+      from all recovery copies is not immediate. The provider and Render may
+      retain operational logs. The <a href="/account-deletion/">Connect account-deletion page</a>
+      explains account-level controls and exceptions; local collection files
+      on your own computers are not removed by deleting an account.
+    </p>
 
     <h2>Contact and changes</h2>
     <p>
-      <!-- Publication gate: replace this with the publisher-approved, publicly reachable privacy contact and confirm the operator's legal identity, service providers, logs, backups and deletion procedures before merging. -->
-      Privacy contact and effective date are pending publisher confirmation.
-      Changes to this policy will be posted at this address.
+      For privacy questions or requests, contact
+      <a href="mailto:callum@mdbase.dev">Callum Alpass at callum@mdbase.dev</a>.
+      Changes to this policy will be posted at this address with an updated
+      effective date.
     </p>
+    <p>Effective date: pending publication approval.</p>
   </article>
 </BaseLayout>