Web Store Submission — Listing, Review, Privacy Policy

"You upload a zip. Chrome reviews it. Some days it's published in two hours, others it takes a week. Lesson 3 is what the dashboard asks for, what gets your submission held up, and the privacy policy that the reviewer actually reads."

The Dashboard Setup

chrome.google.com/webstore/devconsole. One-time setup:

• Pay the one-time $5 developer registration fee. Same fee for hobbyists and corporations.
• Verify your developer email (Google verifies it via the standard email loop).
• Add a payment profile if you plan to monetize (free extensions can skip this).

The dashboard lists your extensions; each new extension is a new "Item" you create and upload a zip into.

The Listing Fields

Per extension you fill in:

• Title — what users see in search results. Up to 45 chars. Make it descriptive: 'ClipDeck — save text clips' beats 'ClipDeck'.
• Summary — one-line pitch. Up to 132 chars. The search-result subhead.
• Description — long-form. Markdown-ish. What it does, what it doesn't do, who it's for.
• Category — Productivity, Communication, Developer Tools, etc. Pick the most accurate; reviewers re-categorize if wrong.
• Language — primary store language. You can localize later via the Web Store's translation system OR via the manifest's _locales directory.
• Visibility — Public, Unlisted, Private (Google Workspace only). Pick before submission; can change later but each change re-triggers review.
• Permission justifications — for each permission your manifest declares, a one-paragraph explanation of why. Reviewers read these. Vague answers ('we need it for features') get held; specific ones ('downloads is used by the Export Clips feature triggered from the popup') sail through.

Privacy Policy URL

Required for any extension that handles user data — including chrome.storage.local. Minimum legitimate content:

• What data the extension collects (clip text, source URL, source title).
• Where that data lives (locally on the user's machine, in chrome.storage.local).
• Whether it's transmitted anywhere ("no" is a totally acceptable answer if true).
• How the user controls it (export, delete, uninstall removes everything).

Host the policy on a domain you control (GitHub Pages works fine). Two paragraphs of honest English is sufficient — Chrome reviewers want truth, not GDPR boilerplate. Don't paste a template; reviewers spot them.

The Single Purpose Policy

Chrome rejects extensions that bundle multiple unrelated features. 'ClipDeck — save text clips, browse them in a side panel' is one purpose, four interfaces (popup, panel, hotkey, omnibox). 'ClipDeck Plus — save clips AND generate passwords AND auto-translate' is three purposes; ship as three extensions.

The judgment is sometimes fuzzy. A clip-saver that also exports clips is fine (export is part of the clip lifecycle). A clip-saver that also reads your email isn't (email is a different domain). When in doubt, write the purpose as one sentence and ask: would the user expect every feature from that sentence? If yes, fine. If they'd be surprised, split.

The Review Process

Submission goes to automated checks first (within minutes), then human review (hours to days). Automated checks: manifest validation, malware scanning, permission consistency. Human review: read the description, click the screenshots, install the extension, exercise it. If anything's unclear they hold the submission with a note explaining what they want; you respond in the dashboard and re-submit.

Common holds:

• Vague permission justification — the reviewer can't tell why you need a permission.
• Privacy policy mismatch — the manifest collects something the policy doesn't mention.
• Description doesn't match behavior — described features that don't work, or undescribed features that do.
• Trademarked names — using 'Chrome' or 'Google' or a famous trademark in your title without permission.
• Spam-like wording — keyword stuffing in description ('best fastest most amazing clip saver').

The Update Cadence

Each update is a fresh review. Patches usually sail through in hours; permission changes trigger a deeper look. Bump the manifest version for every upload — Chrome rejects re-uploads of the same version. Use semver loosely: 1.0.0, 1.0.1, 1.1.0, etc.