From b86c1e70d355b7a625e63750cb12d718e89aeb15 Mon Sep 17 00:00:00 2001
From: lizhixuan <daoquqiexing@gmail.com>
Date: Fri, 23 Oct 2026 00:35:46 +0800
Subject: [PATCH] docs(plugin): privacy section and privacyPolicyUrl for the
 directory listing

The directory's compliance step asks the submitter to confirm that the plugin's
privacy policy describes the data it handles. The plugin README now has one
(no server, no telemetry, queries go only to the listed sources, nothing on
disk, keys only to their own source), and plugin.json links it.
---
 packages/mcp/src/__tests__/plugin-manifest.test.ts | 5 +++++
 plugins/refkit/.claude-plugin/plugin.json          | 3 ++-
 plugins/refkit/README.md                           | 9 +++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/packages/mcp/src/__tests__/plugin-manifest.test.ts b/packages/mcp/src/__tests__/plugin-manifest.test.ts
index 32fa5cc..3015032 100644
--- a/packages/mcp/src/__tests__/plugin-manifest.test.ts
+++ b/packages/mcp/src/__tests__/plugin-manifest.test.ts
@@ -280,6 +280,11 @@ describe('directory listing fields', () => {
     expect(width).toBeGreaterThanOrEqual(512)
   })
 
+  it('links a privacy policy that the plugin README actually contains', () => {
+    expect(claudeManifest.privacyPolicyUrl).toBe('https://github.com/refkitjs/refkit/blob/main/plugins/refkit/README.md#privacy')
+    expect(readFileSync(join(PLUGIN, 'README.md'), 'utf8')).toMatch(/^## Privacy$/m)
+  })
+
   it('links documentation and support over https', () => {
     expect(claudeManifest.documentationUrl).toBe('https://github.com/refkitjs/refkit/tree/main/plugins/refkit#readme')
     expect(claudeManifest.supportUrl).toBe('https://github.com/refkitjs/refkit/issues')
diff --git a/plugins/refkit/.claude-plugin/plugin.json b/plugins/refkit/.claude-plugin/plugin.json
index 50681eb..24faadc 100644
--- a/plugins/refkit/.claude-plugin/plugin.json
+++ b/plugins/refkit/.claude-plugin/plugin.json
@@ -20,5 +20,6 @@
   ],
   "icon": "./assets/icon.png",
   "documentationUrl": "https://github.com/refkitjs/refkit/tree/main/plugins/refkit#readme",
-  "supportUrl": "https://github.com/refkitjs/refkit/issues"
+  "supportUrl": "https://github.com/refkitjs/refkit/issues",
+  "privacyPolicyUrl": "https://github.com/refkitjs/refkit/blob/main/plugins/refkit/README.md#privacy"
 }
diff --git a/plugins/refkit/README.md b/plugins/refkit/README.md
index 91bfea3..8bfa56b 100644
--- a/plugins/refkit/README.md
+++ b/plugins/refkit/README.md
@@ -44,6 +44,15 @@ The server is keyless by default. It also turns on a key-based source when that
 | Jamendo | `REFKIT_JAMENDO_CLIENT_ID`, `JAMENDO_CLIENT_ID` |
 | Europeana | `REFKIT_EUROPEANA_KEY`, `EUROPEANA_KEY` |
 
+## Privacy
+
+refkit has no server of its own and collects nothing about you.
+
+- No accounts, telemetry or analytics: neither the plugin nor its MCP server sends anything to refkit's authors.
+- Your search queries go only to the sources listed above, each under its own privacy policy. Results link back to the source; nothing you search for or open is uploaded.
+- The server writes nothing to disk and keeps no cache; what it holds in memory ends with the process.
+- A key for a key-based source, if one is set in the environment, is sent only to that source's own API.
+
 ## Not legal advice
 
 Verdicts are a conservative heuristic over the license facts each source declares. They are not rights clearance and not legal advice. Check the source page before relying on a result.