Temporary data caches cleared when user logs out or uninstalls

GDPR Art. 5(1)(e) requires personal data not be retained longer than necessary — cached session data that survives a logout or uninstall violates this principle. A user who logs out of an extension expecting their session to be cleared can still have their data re-accessed if the extension is re-opened without re-authentication. GDPR Art. 17 (right to erasure) is practically impossible to honor if cached data persists beyond logout. CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) covers this failure. Uninstall handlers that do not clear extension storage leave personal data on the user's device indefinitely — often forgotten and never cleaned up.

Implement a logout() function that clears all session state, and hook it to the extension's uninstall event:

function logout() {
  // Clear in-memory state
  currentUser = null;
  sessionCache = {};

  // Clear extension storage keys written during the session
  chrome.storage.local.remove(['authToken', 'sessionId', 'cachedProfile']);
}

// Clear on uninstall — chrome.runtime.setUninstallURL can trigger server-side cleanup
// For local cleanup, use onSuspend in MV2 or alarm-based cleanup in MV3
chrome.storage.local.get(null, (items) => {
  const sessionKeys = Object.keys(items).filter(k => k.startsWith('session_'));
  chrome.storage.local.remove(sessionKeys);
});

Document which storage keys are session-scoped vs. persistent preferences, and ensure logout() targets only session keys to avoid destroying legitimate user settings on re-install.