title: Chrome extension rejected: is it forbidden to fetch any json data from a backend?
body: <p>so I made a Chrome extension whose whole purpose is fetching certain data from the backend and process it to do stuff on a certain domain that the user visits.<br>
  I'm trying to have it published but it's getting rejected, and this is what they told me:  </p>
  
  <blockquote>
    <p>Your item was found to have requested/fetched one or more external scripts. An example of one such instance in your item was backend URL in background.js. Please remove all external fetches including Json type.  </p>
  </blockquote>
  
  <p>(This is actually the last of 3 emails they sent me, they just added a few more words in this part I quoted with every email... Since they send only one per day, it's very frustrating...)  </p>
  
  <p>I use <code>jQuery.ajax</code> in my background script, and after searching with google I found out that by default it tries to process json requests as jsonp requests (I'm not 100% sure though...), so I've set the <code>jsonp</code> property to <code>false</code> in every ajax call in my code. My extension still got rejected today, and they didn't send another email, so I'm just gonna guess they really did mean that I need to remove that call that fetches json from my backend.  </p>
  
  <p>Here's an example of an ajax call in my code:  </p>
  
  <pre><code>$.ajax({
      url: backendUrl + '/theendpoint',
      data: {
          paramName: 'paramValue'
      },
      dataType: 'json',
      cache: false,
      jsonp: false
  })
  </code></pre>
  
  <p>I'm pretty sure that I'm supposed to be allowed to do it. I've also searched to make sure, and other people do it too. So, what could actually be wrong?<br>
  I know it's hard by seeing hardly any code, but there's too much of it and the problem is just here in the ajax calls. And I can't post here the content of my manifest file.  </p>
  
  <p>I did add my backend to the <code>permissions</code> in the manifest. Do I have to add it to the <code>content_security_policy</code> too, even though I'm just fetching json from it, and not scripts?  </p>
  
  <p>Thanks for any help.  </p>
  
  <p><strong>Edit</strong>: side question: is it mandatory to provide a physical adress and a link to a privacy policy in my developer account? If yes, could that be the reason why the extension keeps getting rejected? (Last time it got rejected, they didn't even send me an email)</p>