Purple Copper: user data policy - secure transmission

What the policy actually says

If your Product handles personal or sensitive user data (including personally identifiable information, financial and payment information, health information, authentication information, website content and resources, form data, web browsing activity, user-provided content and personal communications), then your Product must: Post a privacy policy, and Handle the user data securely, including transmitting it via modern cryptography.

Program policy and Google's troubleshooting entry

What Google lists as triggering it

• The extension is not transmitting user data securely.
• The data is being transmitted to an unsecure domain

What Google says to do about it

• Ensure data is securely transmitted.
• Don't transmit user data over HTTP. If possible, use secure protocols for all requests.
• Don't encode data in request headers or query parameters, even over HTTPS. Headers and request URLs often appear in server logs, which can unintentionally leak this information.
• Use the Chrome DevTools or other network monitoring tools to watch the network requests the extension makes.

Check your own package for this

The same verified data drives a free command line checker. It reads an unpacked extension and reports what would be flagged, citing the notification ID and Google's verbatim text. No dependencies, nothing leaves your machine, MIT licensed.

git clone https://github.com/Circadian-agent/webstore-lint
node webstore-lint/bin/webstore-lint.mjs ./my-extension

A clean run is not a promise of approval. The checker reads your package; it cannot see your store listing, your privacy policy page or your screenshots, and several policies are satisfied in exactly those places.

If you have already been rejected

The resubmission pack is written work, produced against your actual package after you buy it: a justification for every permission you request pointing at the lines that need it, the narrower permission where one exists, and a single purpose statement that matches what your code does. It is 149 USD, once.

It does not buy an approval, because we do not review extensions and cannot promise what Google decides. It buys the writing that the dashboard asks you for and that a rejection means you now have to get right.

The other 35

All 36notification IDs, with the four 2026 policy changes and the places Google's own pages contradict each other, are on the full reference. The dataset behind it is CC BY 4.0.

• Blue Argon
• Blue Nickel and Blue Potassium
• Blue Titanium
• Blue Zinc, Blue Copper, Blue Lithium and Blue Magnesium
• Grey Copper
• Grey Lithium
• Grey Magnesium
• Grey Nickel
• Grey Potassium
• Grey Silicon
• Grey Titanium
• Grey Zinc
• Purple Lithium
• Purple Magnesium
• Purple Nickel
• Purple Potassium
• Red Magnesium, Red Copper, Red Lithium and Red Argon
• Red Nickel, Red Potassium and Red Silicon
• Red Titanium
• Red Zinc
• Yellow Argon
• Yellow Lithium
• Yellow Magnesium
• Yellow Nickel
• Yellow Potassium
• Yellow Zinc