# Chrome Web Store — Obsidio Wallet (submission pack)

Use this file while filling the Developer Dashboard. Copy fields verbatim where possible.

**Package to upload:** zip of unpacked extension (store build) — see `STORE_BUILD.md`.  
**Privacy policy URL:** https://obsidio.network/extension/privacy.html  
**Homepage:** https://obsidio.network/extension/  
**Support email:** hello@obsidio.network  

---

## Listing — basic info

| Field | Value |
|--------|--------|
| **Name** | Obsidio Wallet |
| **Summary** (max ~132 chars) | Non-custodial Obsidio wallet. Dilithium keys stay on your device. Connect dApps via window.obsidio. |
| **Category** | Productivity *(or Finance / Shopping if Finance available in your region — prefer Productivity if unsure)* |
| **Language** | English |
| **Visibility** | Public |

### Detailed description (paste into “Description”)

```
Obsidio Wallet is a non-custodial browser extension for the Obsidio network.

YOUR KEYS STAY ON YOUR DEVICE
• Private keys are generated and stored locally in the extension.
• Obsidio cannot see, export, or recover your keys from our servers.
• We do not custody funds and cannot reverse blockchain transactions.

WHAT YOU CAN DO
• Create or import an Obsidio account (ons1… address)
• View OBS and other network asset balances
• Sign and send transfers you approve
• Use multi-wallet accounts in one popup
• Connect websites that use the window.obsidio provider (similar to other self-custody wallets)

HOW IT WORKS
• Signing uses post-quantum Dilithium cryptography packaged inside the extension (WASM).
• Chain data is read and transactions are broadcast only to https://obsidio.network over HTTPS.
• Sensitive actions require your confirmation in the extension UI.

NOT A CUSTODIAL SERVICE
Obsidio Wallet is software that helps you control your own keys. It is not a bank, exchange, or hosted wallet. If you lose your recovery material, we cannot restore access.

Learn more: https://obsidio.network
Privacy: https://obsidio.network/extension/privacy.html
Install help: https://obsidio.network/extension/
```

### Short promotional text (optional)

```
Self-custody Obsidio wallet — keys on your device, Dilithium signatures, dApp connect via window.obsidio.
```

---

## Privacy practices tab (dashboard)

### Single purpose

```
Provide a non-custodial cryptocurrency wallet for the Obsidio blockchain: manage local keys, view balances, approve and sign transactions, and expose a page provider (window.obsidio) for Obsidio dApps.
```

### Does this extension collect user data?

Select carefully (recommended answers for this build):

| Disclosure | Answer |
|------------|--------|
| Personally identifiable information | **No** |
| Health information | **No** |
| Financial and payment information | **No** *(we do not collect bank/card data; on-chain balances are public chain data fetched for the user’s own address)* |
| Authentication information | **No** *(no Obsidio cloud login; local unlock only)* |
| Personal communications | **No** |
| Location | **No** |
| Web history | **No** |
| User activity | **No** *(no analytics SDK)* |
| Website content | **Yes — limited** *(only when a page calls window.obsidio so the extension can return accounts / request signatures the user approves)* |

If the form forces a “financial” checkbox because it is a wallet, disclose:  
“Extension displays blockchain balances for addresses the user controls. No bank account or card data is collected.”

### Certifications

- [x] I do not sell or transfer user data to third parties (except as needed to operate / legal)
- [x] I do not use data for unrelated purposes / creditworthiness
- [x] Limited Use compliance
- [x] Privacy policy URL provided

### Remote code

```
No. All executable code and Dilithium WASM ship inside the extension package. No eval of remote scripts.
```

---

## Permission justifications (copy per permission)

### `storage`

```
Required to store wallet accounts, public addresses, and encrypted/local key material on the user’s device so the wallet can unlock and sign without a custodial server.
```

### Host permission `https://obsidio.network/*` (and www)

```
Required to call Obsidio JSON-RPC over HTTPS: fetch balances, nonces, chain status, and broadcast user-approved signed transactions. No other production hosts are used for RPC.
```

### Content scripts / host access to `https://*/*` (page provider)

```
Required to inject the window.obsidio provider so websites can request accounts and transaction signatures—the standard non-custodial wallet pattern. The content script only bridges postMessage to the extension; private keys never enter the page. The user must approve sensitive actions in the extension UI. We do not scrape page content for advertising or tracking.
```

### `wasm-unsafe-eval` (CSP)

```
Required solely to instantiate the bundled Dilithium WASM module for local key generation and transaction signing. No remote WASM is loaded.
```

---

## Reviewer notes (optional “Notes for reviewer”)

```
Obsidio Wallet is a non-custodial MV3 wallet for https://obsidio.network.

Test plan for reviewers:
1. Load the extension → open popup → create wallet / unlock.
2. Confirm keys are not uploaded (Network tab: only HTTPS to obsidio.network RPC).
3. Open https://obsidio.network/dex/ (or /wallet/) → window.obsidio should initialize; no keys exposed to the page.
4. Content script is only for the page provider bridge (inject.js + content.js), not ads/tracking.

Privacy policy: https://obsidio.network/extension/privacy.html
Support: hello@obsidio.network

localhost host permissions were removed from the Store build; RPC host is production HTTPS only.
```

---

## Graphics checklist

| Asset | Size | Notes |
|--------|------|--------|
| **Icon** | 128×128 | Already in `icons/icon128.png` (Neon Split-Ring) |
| **Screenshots** | 1280×800 or 640×400 | Min 1, up to 5. English UI only. See `STORE_SCREENSHOTS.md` |
| **Small promo tile** | 440×280 | Optional but recommended |
| **Marquee** | 1400×560 | Optional |

Do **not** put “guaranteed returns”, fiat “buy with card” CTAs, or custodial wording on creatives.

Suggested screenshot captions (English):

1. “Non-custodial — keys stay on your device”
2. “Balances & send from the popup”
3. “Connect Obsidio dApps via window.obsidio”
4. “Multi-wallet accounts”
5. “Dilithium signatures · HTTPS RPC only”

---

## Pre-submit checklist (pass rate)

- [ ] Store zip built **without** `localhost` / `127.0.0.1` host_permissions
- [ ] Manifest description starts with non-custodial wording
- [ ] Privacy policy live on HTTPS (same domain preferred)
- [ ] No remote code / no minified remote fetch of JS
- [ ] Screenshots show English UI and no misleading “exchange custody” claims
- [ ] Single purpose text matches actual features (wallet only)
- [ ] Support email monitored
- [ ] Version bump for store (e.g. 0.4.15)
- [ ] Test unpacked Store zip once before upload

---

## Common rejection traps (avoid)

1. **Broad hosts + weak justification** — always explain MetaMask-style provider.
2. **localhost in production manifest** — looks like unfinished / dual-use tooling.
3. **“We keep your crypto safe on our servers”** marketing — contradicts non-custodial.
4. **Missing privacy policy** or policy that claims you collect nothing while using storage + RPC.
5. **Russian-only screenshots** — listing language is English.
6. **Unrelated features** (VPN, shopping coupons, new-tab takeover) in the same extension.