Privacy Policy clearly details data retention periods

GDPR Art. 5(1)(e) (storage limitation) and Art. 13(2)(a) (right to information) together require that users are told how long their data is retained and that data is not kept longer than necessary. A privacy policy silent on retention gives users no way to exercise their GDPR Art. 17 right to erasure — they cannot request deletion of data if they do not know how long it is held or where. CCPA §1798.100 similarly obligates disclosure of retention practices. For extensions, where users often forget they have installed a tool that is still collecting data, indefinite-retention silence compounds the harm.

Add a "Data Retention" section to your PRIVACY.md or hosted policy that specifies a concrete period for each data type collected:

## Data Retention

| Data type        | Retention period                              |
|------------------|-----------------------------------------------|
| User preferences | Until extension is uninstalled                |
| Usage logs       | 30 days, then automatically deleted           |
| Error reports    | 7 days, used only for debugging               |
| Cached page data | Session only — cleared when extension closes  |

If your code already enforces deletion (e.g., via a scheduled chrome.alarms cleanup), reference the code behavior in the policy. If it does not, add the cleanup logic to match whatever period you document.