As someone who builds chrome extensions, and is very familiar with monetisation of most extensions…
Ding ding ding! All your data are belong to us.
I explicitly never save user data (apart from auth and subscription status) in my extensions, and the only call back “home” is to check whether the authenticated user has an active subscription.
I’m also going to make my more powerful chrome extensions “source available” so people can see exactly what it does with your data, and on your machine. Not “open source” because I don’t want contributions
> Not “open source” because I don’t want contributions
Minor nit: You can make something FOSS by publishing the code under a FOSS license. You don't have to accept PRs, you don't have to take bug reports or feature requests, you don't have to foster a community. Open Source can be as simple as "here is a tarball of source code that you can use", full stop. (As an extreme case in multiple senses, sqlite famously is public domain, and also generally doesn't take any contributions - https://www.sqlite.org/copyright.html )
Of course, you are fully entitled to go Source-available too, and if you want to facilitate audits without actually giving anyone else the right to use your code then that's the way to go. I just want to point out that there are options between "not FOSS" and "community-centric development".
> I’m also going to make my more powerful chrome extensions “source available” so people can see exactly what it does with your data, and on your machine. Not “open source” because I don’t want contributions
You should also encourage/teach users how to check the source of extensions they've installed locally. It's actually pretty easy. If you're not obfuscating, you may not even need to make the source explicitly available.
