docs(store): privacy policy + listing copy (#61)

docs/privacy-policy.md

@@ -0,0 +1,74 @@
+# gitmarks — Privacy Policy
+
+_Last updated: 2026-06-19_
+
+gitmarks is a serverless browser extension and web app for syncing your
+bookmarks to **your own private GitHub repository**. This policy explains what
+data it handles and where that data goes.
+
+## The short version
+
+- **There is no gitmarks server.** The developer operates no backend, database,
+  or analytics. We never receive your data.
+- Your bookmarks live in **a GitHub repository you own and control**.
+- Your GitHub token and settings are stored **locally on your device**.
+- The extension talks to **only one network host: `https://api.github.com`**.
+
+## What data gitmarks handles, and where it goes
+
+| Data | Where it's stored | Who can see it |
+|---|---|---|
+| Your bookmarks (`bookmarks.json`, `tags.json`) | Your private GitHub repo | You (and GitHub, as your repo host) |
+| Your GitHub personal access token (PAT) | Locally — `chrome.storage.local` (extension) / `localStorage` (web app) | Anyone with access to your unlocked browser profile |
+| Settings (repo owner/name/branch, options) | Locally, same as above | Same as above |
+| Bookmark/tab URLs and titles | Read from your browser, written to your repo | You |
+
+gitmarks does **not** collect, transmit to the developer, sell, or share any of
+this data. It is never sent anywhere except the GitHub API, on your behalf,
+authenticated with your own token.
+
+## Permissions and why they're needed
+
+- **`storage`** — save your settings and a local id map on your device.
+- **`bookmarks`** — read and write your browser's native bookmark tree to keep
+  it in sync with your repo.
+- **`alarms`** — schedule a periodic (5-minute) check for remote changes.
+- **`activeTab`** — read the current tab's URL and title when you click
+  "Save this page".
+- **`tabs`** (optional, requested only when you click "Save all tabs") — read
+  the URLs and titles of the open tabs in the current window so they can be
+  saved together. Not requested at install time.
+- **Host access to `api.github.com`** — read and write your bookmark files in
+  your repo.
+
+## Third parties
+
+The only third party involved is **GitHub**, because your bookmarks are stored
+in your GitHub repository and all requests go to the GitHub API. Your use of
+GitHub is governed by [GitHub's Privacy Statement](https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement).
+gitmarks uses no analytics, advertising, tracking, or other third-party
+services.
+
+## Your control
+
+- **Revoke access at any time** by deleting the fine-grained token in
+  GitHub → Settings → Developer settings → Personal access tokens.
+- **Remove local data** by clicking "Sign out" in the web app, or uninstalling
+  the extension (which clears its local storage on that device). Uninstalling
+  does **not** revoke the token on GitHub — delete it there as above.
+- **Delete your data** by deleting the bookmark files or the repository on
+  GitHub.
+
+## Children
+
+gitmarks is a developer tool and is not directed to children under 13.
+
+## Changes
+
+Material changes to this policy will be reflected in this file in the public
+repository, with an updated date above.
+
+## Contact
+
+Questions or concerns: open an issue at
+<https://github.com/paperhurts/gitmarks/issues>.

docs/store-listing.md

@@ -0,0 +1,105 @@
+# Store listing copy
+
+Ready-to-paste text for the Chrome Web Store and Firefox AMO submissions.
+Positioning: developers + the privacy / own-your-data crowd.
+
+---
+
+## Name
+`gitmarks`
+
+## Category
+Productivity
+
+## Summary (Chrome: ≤132 chars)
+> Sync bookmarks to your own private GitHub repo. No server, no account, no tracking — your data is a file you control.
+
+(118 chars.)
+
+## Short description (Firefox AMO summary, ≤250 chars)
+> Bookmarks that live in your own GitHub repo. Two-way sync with your browser's bookmark bar, cross-browser and cross-device, with full git history. No server, no account, no tracking. You own your data — it's just a file in a repo you control.
+
+---
+
+## Detailed description
+
+**Your bookmarks, in your own Git repo.**
+
+gitmarks syncs your browser bookmarks to a private GitHub repository that you
+own — as a plain, human-readable JSON file. There's no gitmarks server, no
+account to create, and no tracking. Your data never touches anyone's backend but
+GitHub's, authenticated with your own token.
+
+**Why you'll like it**
+
+• **You own your data.** Bookmarks are a `bookmarks.json` file in your private
+repo. Export it, read it, diff it, delete it — no lock-in.
+• **A time machine for your bookmarks.** Every change is a git commit, so your
+full history is preserved forever. Restore anything.
+• **Two-way sync with your native bookmarks.** Add, edit, or remove a bookmark
+in your browser and it syncs to your repo within seconds; changes on GitHub pull
+back into your browser.
+• **Save the current tab — or all open tabs** — in one click, grouped into a
+dated folder.
+• **Cross-browser & cross-device.** Chrome and Firefox share the same repo.
+• **A companion web app** to search, tag, organize, and export your bookmarks.
+• **Private by design.** No server, no analytics, no third parties. The
+extension talks only to api.github.com.
+• **Open source.** Read every line: https://github.com/paperhurts/gitmarks
+
+**What you need**
+
+A GitHub account, a private repository for your bookmarks, and a fine-grained
+personal access token scoped to only that repo (Contents: read/write). Setup
+takes a couple of minutes — the extension walks you through it.
+
+**Note:** gitmarks is built for people comfortable with GitHub. If you want
+one-click cloud sync with no setup, your browser's built-in sync is simpler;
+gitmarks is for people who want to *own* their bookmarks.
+
+---
+
+## Permission justifications (for the store review form)
+
+- **storage** — Stores your settings and a local bookmark-id map on your device.
+- **bookmarks** — Reads and writes your browser's bookmark tree to sync it with
+  your GitHub repo.
+- **alarms** — Schedules a periodic (5-minute) check for changes made on GitHub
+  or another device.
+- **activeTab** — Reads the current tab's URL and title when you click
+  "Save this page".
+- **tabs** (optional, on-demand) — Requested only when you click "Save all tabs",
+  to read the URLs/titles of open tabs in the current window. Not requested at
+  install.
+- **Host permission `https://api.github.com/*`** — Reads and writes your bookmark
+  files in your GitHub repository. This is the only host gitmarks contacts.
+
+## Data use disclosures (Chrome "Privacy practices" tab)
+
+- Personally identifiable / authentication info? **Stored locally only** (your
+  GitHub token). Not collected by the developer, not transmitted to us.
+- Does this item collect or use user data? It reads bookmarks/tabs and writes
+  them **to the user's own GitHub repository**; the developer receives nothing.
+- Sold to third parties? **No.**
+- Used for purposes unrelated to core functionality? **No.**
+- Used for creditworthiness / lending? **No.**
+- We certify compliance with the Developer Program Policies.
+
+Privacy policy URL: `https://paperhurts.github.io/gitmarks/privacy-policy.html`
+(host `docs/privacy-policy.md` on GitHub Pages — see below).
+
+---
+
+## Assets checklist
+- Icon 128×128 — ✅ generated (`assets/gitmarks.svg` → PNGs).
+- Screenshots 1280×800 — ✅ options page + popup (generated; add 1–3 more
+  showing the web app / save flow if desired).
+- Small promo tile 440×280 — ⬜ optional but recommended (a branded card with
+  the wordmark + tagline "Bookmarks that live in your Git repo").
+
+## Hosting the privacy policy
+`docs/privacy-policy.md` needs to be reachable at a public URL. Options:
+1. Render it into the existing GitHub Pages site as `privacy-policy.html`, or
+2. Link to the rendered Markdown on GitHub:
+   `https://github.com/paperhurts/gitmarks/blob/main/docs/privacy-policy.md`
+   (acceptable to both stores, but a Pages URL looks more official).