# Chrome Web Store submission

Everything the listing form asks for, written out. Replace anything in
`[BRACKETS]` before submitting.

Build the upload with `./store/package.sh` — it fails the build on the things
review rejects for, rather than letting you find out a week later.

---

## Listing

**Name** (45 char limit)

```
Sahi — Writing Assistant
```

**Short description** (132 char limit)

```
Catches spelling, grammar and tone as you write in Gmail and WhatsApp Web. Knows Indian English and clinical vocabulary.
```

**Category:** Workflow & Planning
**Language:** English

**Detailed description**

```
Sahi checks your writing where you actually write it — Gmail, WhatsApp Web,
Outlook on the web, and ordinary text boxes.

Pause for a second and the mistakes are underlined. Click one to see the fix and
take it, or leave it. Nothing is sent while you are still typing.

WHAT MAKES IT DIFFERENT

Sahi is built for how English is written in Indian workplaces, and especially in
hospitals.

- Catches the habits general checkers miss: "revert back", "do the needful",
  "informations", "kindly intimate", "myself Rajesh".
- Turns chat shorthand into something you can send a client: pls, plz, thanx, ur.
- Leaves drug names, clinical abbreviations and brand names alone instead of
  underlining every one of them.
- Rewrites Hinglish into professional English in one click.
- Also rewrites for tone: formal, friendly, or shorter — without adding
  promises, apologies or deadlines you never wrote.

FOR ORGANISATIONS

Sahi is self-hosted. You run the server, you hold the data, and you decide
whether anything is processed by an AI service at all — with that switched off it
runs entirely on your own infrastructure.

Administrators get a dictionary for their own vocabulary, editable rules for
house style, per-person access keys, usage reporting, and a report of the
mistakes their team repeats most.

Deploy across a fleet with Chrome policy: the server address and key arrive
automatically and there is nothing for staff to configure.

GETTING STARTED

You need a Sahi server and an access key from your administrator. Enter both in
the extension's settings and start typing.
```

---

## Privacy practices tab

**Single purpose**

```
Sahi has one purpose: to check the text a user is writing in a web page's text
fields and offer corrections to it.
```

**Permission justifications** — paste each one verbatim.

| Permission | Justification |
|---|---|
| `storage` | Stores the user's server address, access key and on-off preferences, and reads the settings an administrator supplies through Chrome policy. |
| `contextMenus` | Adds a single right-click item on editable fields so the user can rewrite the text they have selected. |
| `alarms` | Schedules periodic refresh of the field-selector configuration so the extension keeps working when a supported site changes its markup. |
| Host access to `mail.google.com`, `web.whatsapp.com`, `outlook.office.com`, `outlook.live.com` | These are the sites the extension checks writing on. It reads the text of the field the user is typing in, in order to underline mistakes and apply corrections the user accepts. It does not read any other part of the page. |
| Optional host access to all sites | Requested only when a user explicitly chooses to enable checking on a site beyond the four above. Never granted by default. |
| Remote code | None. All code is contained in the package; the extension only exchanges JSON with the self-hosted server the user configures. |

**Data usage disclosures** — tick these and no others:

- *Personally identifiable information* — **No**
- *Health information* — **No**, unless your deployment is used for clinical text. If it is, declare **Yes**: the text of a field may contain clinical detail. Declare it rather than defend it later.
- *Financial and payment information* — No
- *Authentication information* — No
- *Personal communications* — **Yes**. The text of an email or message being composed is sent to the user's configured server to be checked. Say so plainly.
- *Location* — No
- *Web history* — No
- *User activity* — **Yes**. Counts of checks performed and the hostname they occurred on.
- *Website content* — **Yes**. Only the contents of the text field the user is typing in.

**Certifications** — all three are true of Sahi and can be ticked:

- Not being sold to third parties
- Not being used for purposes unrelated to the item's single purpose
- Not being used to determine creditworthiness or for lending

**Privacy policy URL:** host `store/privacy-policy.html` and paste the URL.

---

## Notes for the reviewer

Paste this into the review notes field. A reviewer who cannot make the extension
do anything will reject it.

```
Sahi is self-hosted: the extension does nothing until it is pointed at a server.

To test:
1. Open the extension's options page.
2. Server address: [YOUR TEST SERVER URL]
   Access key:     [ISSUE A DISPOSABLE KEY AND PASTE IT HERE]
3. Press "Test connection" — it should report Connected.
4. Open Gmail, start a new message, and type:
      pls revert back on the informations i recieved
5. Stop typing. Four underlines appear within about a second. Click one to see
   the suggested correction, and press Accept to apply it.

The key above is disposable and will be revoked after review.
```

Revoke that key on the Access keys page once the item is published.

---

## Assets to produce

- **Icon** — 128×128. `extension/icons/128.png` is in the package.
- **Screenshots** — 1280×800, at least one, five is better. Suggested set:
  1. A Gmail draft with underlines showing, one suggestion card open.
  2. The same in WhatsApp Web.
  3. The rewrite menu open on a Hinglish message.
  4. The Insights page — repeated mistakes with acceptance rates.
  5. The dictionary, showing clinical terms.
- **Small promo tile** — 440×280, optional but improves placement.

Take screenshots against real content you own. Do not use a patient's message,
even a redacted one.

---

## Before you press submit

- [ ] Privacy policy hosted at a public URL and linked
- [ ] A working test key in the reviewer notes
- [ ] Version bumped in `manifest.json`
- [ ] `./store/package.sh` passes
- [ ] Screenshots taken from a real deployment, no real patient data
- [ ] `allowed_origins` on the production server is no longer `*`
- [ ] The seeded admin password has been changed (Health page will tell you)