Clarify Chrome Web Store Limited Use policy

PRIVACY.md

@@ -48,6 +48,10 @@ article-detail live pages. CNKI English and CNKI batch behavior are
 experimental, and ScienceDirect is best effort when publisher access controls
 replace the article DOM. These support labels do not change the local data flow.
 
+## Chrome Web Store Limited Use
+
+Paper Library Checker's use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. User data is used only to provide or improve the extension's single purpose and is not sold, used for advertising, transferred for unrelated purposes, or used to determine creditworthiness or for lending purposes.
+
 ## Authentication data
 
 The Zotero add-on generates a 256-bit random pairing token on first run and

store-assets/chrome-web-store/privacy-practices.md

@@ -23,6 +23,12 @@ add-on on the loopback interface. If enabled by the user, the extension may
 send the current public page URL to a separately installed translation-server
 on the loopback interface.
 
+## Limited Use
+
+User data is used only to provide or improve the extension's single purpose.
+It is not sold, used for advertising, transferred for unrelated purposes, or
+used to determine creditworthiness or for lending purposes.
+
 ## Remote code
 
 No, this extension does not use remote code.

test/chrome-web-store.test.mjs

@@ -141,8 +141,14 @@ test("Chrome Web Store materials recommend the current workflow category", async
 });
 
 test("privacy and permission documents state the Chrome Web Store boundaries", async () => {
+  const publicPrivacy = await readFile(path.join(root, "PRIVACY.md"), "utf8");
   const privacy = await readFile(path.join(storeRoot, "privacy-practices.md"), "utf8");
   const permissions = await readFile(path.join(storeRoot, "permission-justifications.md"), "utf8");
+  for (const content of [publicPrivacy, privacy]) {
+    assert.match(content, /only to provide or improve the extension's single purpose/);
+    assert.match(content, /not sold, used for advertising, transferred for unrelated purposes/);
+    assert.match(content, /creditworthiness or for lending purposes/);
+  }
   assert.match(privacy, /No, this extension does not use remote code\./);
   assert.match(privacy.replace(/\s+/g, " "), /not sent to the maintainer/);
   assert.match(permissions, /`storage`/);