Clarify the displayItems are not shared with payment handler

[marcoscaceres]

People are concerned about their purchases being sent to third-party payment handlers (via displayItems) .

In the privacy section, we should make it crystal clear that these don't get sent to third-party payment handlers. We might also want to tighten text around that in a normative sense.

[ianbjacobs]

It is already the case that Payment Handler API does not include displayItems. Do we need to say more in Payment Request API?

[marcoscaceres]

It's more about things like native apps acting as payment handlers (not really concerned about tech we control at w3c). It's unclear what happens there.

[rsolomakhin]

Android payment apps don't get display items.

"Is ready to pay" params:

• methodNames
• methodData
• topLevelOrigin
• topLevelCertificateChain
• paymentRequestOrigin

Payment params:

• methodNames
• methodData
• topLevelOrigin
• topLevelCertificateChain
• paymentRequestOrigin
• total
• modifiers (including only supportedMethods, data, and total)
• paymentRequestId

[marcoscaceres]

That's awesome to hear and see. Note that I want to add the note because I know it's going to keep coming up as a question (someone already asked me about this on the twitters). I want developers and users to feel at ease with the API (hence adding a note). I'm not worried that anyone is actually leaking this info out of the browser.

[markalanrichards]

@marcoscaceres thanks 👍
After the chat on Twitter I thought I'd pop on here to raise a PR as suggested and realised you were way ahead of me

[marcoscaceres]

@markalanrichards, no problem. Sorry, was about to ping you on twitter to let you know I'd filed this. I'll ping you for review once I draft somethings... or if you are feeling up to it, and want to propose some text, that's also very welcomed!

[marcoscaceres]

Ah, just saw you sent a pull request also. Excellent. Will make comments there.

[cyberphone]

You may run into issues here. Showing line items in native apps is going to be a standard feature. Sending them to the bank is an entirely different thing.

[marcoscaceres]

Closed via #670