#11. Optional Data Storage

By default, no Addonium addon stores anything about who called it. storesData in the manifest defaults to false.

#11.1 When storesData: true

Set this when an addon implements library sync, per-user settings persistence, or anything else that survives across requests. It's purely a disclosure flag for hosts to show the user ("this addon remembers your library") - it does not change wire behavior.

#11.2 Encrypted-in-URL correlation (recommended default)

Rather than requiring a server-side user database, a Locked Addon that wants to remember a user is encouraged to fold the correlation identifier into the same tokenized URL segment described in §7:

token = base64url( AES-GCM_encrypt(secret_key, { uid, iat }) )

The addon's server decrypts the token on each request to recover uid and looks up/updates that user's rows - but the addon itself never needs a separate login step, session cookie, or exposed user-id in cleartext. Lose the URL, lose access to that data; that's an acceptable, author-chosen trade-off, and matches how BeatBoss/Eclipse already suggest handling addon auth via URL tokens.

This is a pattern recommendation, not a mandated algorithm - an author is free to store data any way they like, including plaintext, a real OAuth login, or nothing at all.