I spent the last few months building and shipping a Chrome extension called Promo Drop, a free tool that finds verified promo codes and cashback for products on Whop. It is live on the Chrome Web Store now. This is a write-up of what I learned getting it there, minus the one part I cannot share (more on that below).
Quick background on me: I studied at Lancaster University, spent a while day trading, and ended up buying courses and communities on Whop. I kept noticing two things. Working discount codes existed but were painful to find, and when there was no code, there was often no way to claw anything back. So I built the tool I wished existed.
Here is what actually taught me something.
Manifest V3 is a genuinely different mental model
If your knowledge of extensions is a few years old, throw it out. There is no persistent background page anymore. You get a service worker that Chrome spins up and tears down whenever it feels like it, so you cannot lean on in-memory state surviving between events. Anything that needs to persist has to go into storage, and you have to design around the worker being asleep most of the time. Half my early bugs were just me assuming a variable would still be there. It would not be.
The Web Store review process rewards being boring and honest
The single biggest thing that smoothed my reviews: request the absolute minimum permissions, and write a plain-English justification for every single one. Reviewers are looking for extensions that ask for more than they need. If your permissions map cleanly onto features a user can see, and your privacy policy actually matches your behaviour, you make their job easy and you get through faster. I also kept the extension scoped to only run where it needs to, rather than on every site, which is both better for users and an easier review.
Move your secret sauce off the client, on purpose
Here is the part I will not detail: how Promo Drop actually determines the codes. That logic is the whole value of the product, so it does not live in the extension at all. The client is deliberately thin. It sends a URL to my server, and the server responds with the result. The extension itself contains nothing that would let someone reverse-engineer the method.
This started as IP protection but turned out to be good engineering regardless. Anything shipped in an extension is fully readable by anyone who unzips the package, there is no such thing as a client-side secret. Pushing the real work server-side meant I could change the logic without shipping an update, cache results, rate-limit abuse, and keep the client tiny. If any part of your product is a competitive advantage, assume the client is public and design accordingly.
The ethics line was a feature decision, not an afterthought
Promo Drop earns an affiliate commission, and I made a rule early: attribution only ever happens on a genuine user action, and it never overwrites an affiliate link someone else set. No silent background cookie-dropping, no hijacking. Beyond it being the right thing, it is also just more durable, the aggressive stuff is exactly what gets extensions pulled and brands angry. Building the honest version from day one meant I never had to walk anything back.
Nobody wants your UI in their face
My first version threw a banner up the moment it had something. It worked, and it was annoying. I moved to a quieter model: a small indicator, and the details only when the user chooses to look. Engagement went up when I got out of the way. For anything that lives on top of someone else's page, restraint is the feature.
Would I do it again?
Yes. Shipping something real to a store with a review gate forces a discipline that side projects usually let you skip: least privilege, honest copy, a privacy policy you actually honour. Even if the extension went nowhere, I would have learned more than from ten unfinished repos.
If you want to see the finished thing, it is at https://promodrop.codes/ . Happy to answer questions about the MV3 or Web Store side in the comments.
