Is Privacy | Protect Your Payments safe?
We analyzed Privacy | Protect Your Payments version 2.4.17's actual code and gave it a 72/100 trust score. This is a legitimate payment autofill…
Bottom line
This is a legitimate payment autofill extension, but its all-site visibility and telemetry make it worth using cautiously.
What it can access
It can inspect nearly every webpage and fill payment fields, while cookie access is limited to Privacy and localhost; this broadly supports its payment purpose but remains powerful. [Q1][Q2][Q4]
Security weaknesses
Broad all-site page access and automatic field changes create exposure if the extension or its service is compromised, although filling requires a user-selected card. [Q2][Q24]
Signs of misuse
It sends checkout URLs, card references, and a persistent session ID to Privacy services for requests and telemetry, but no unrelated collection or clear misuse is established. [Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site content access, tabs, activeTab, storage, and cookies. All-site access is required for checkout detection and autofill; cookie access is limited by website access to Privacy domains and localhost.
Runs content.js in all frames on <all_urls> and requests storage, tabs, activeTab, and cookies; cookie hosts are limited to *.privacy.com and localhost. — manifest.json:content_scripts/permissions/host_permissions
Uses page access to find checkout fields, place the Privacy button/interstitial, and fill a selected virtual card. — content.js.map:src/lib/checkout/index.ts
Which websites can it run on, and can it read or change what appears on those pages?
It can run in every frame on every website except Lithic. It observes relevant page changes, inspects checkout controls, and inserts a Privacy button and iframe overlay near detected fields.
Matches <all_urls>, uses all_frames, and excludes only *.lithic.com. — manifest.json:content_scripts
Observes page mutations, locates payment controls, and adds or removes extension UI. — content.js.map:src/scripts/content.ts and src/lib/checkout/index.ts
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can identify password/text/tel/number inputs that look like card or billing fields, but the scanner reads attributes, labels, select choices, and geometry—not the values the user typed. Extension-owned login and card screens naturally process account and payment data.
getAttributes allowlists autocomplete, class, id, maxlength, name, pattern, placeholder, size, and title; it does not read input.value except fixed card-type radio options. — content.js.map:src/lib/checkout/parser/parser.processor.ts
The extension UI sends user-entered Privacy login credentials and manages the user's virtual cards through Privacy's API. — index.js.map:src/store/auth/authStore.ts and card APIs
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores a Privacy bearer token, optional trusted-device ID, and session ID locally, and can set cookies only for allowed Privacy hosts. It cannot read arbitrary-site cookies, browser history, bookmarks, or downloads.
Stores the Privacy API token, two-factor user token, and optional remembered-device identifier in extension local storage. — index.js.map:src/store/auth/authStore.ts
Includes a handler to set a supplied short-lived auth cookie through chrome.cookies. — background.js.map:src/scripts/background.ts
Cookie scope is constrained to *.privacy.com and localhost; no history, bookmarks, or downloads permission is requested. — manifest.json:host_permissions
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests none of the listed device, clipboard-read, native messaging, or management permissions. — manifest.json:permissions
The embedded Privacy iframe is granted clipboard-write, not clipboard-read. — content.js.map:src/lib/checkout/interstitial.ts
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends login, account, virtual-card, transaction, funding, and feature requests to services.app.privacy.com. Checkout/autofill telemetry includes the current tab URL and card UUID; Sentry may receive popup errors with the active URL.
Sends authenticated extension API requests to https://api.app.privacy.com/api/v1|v2/extension with a persistent session ID and extension metadata. — background.js/index.js maps:src/lib/request/index.ts
Tracks Fill Checkout with cardUuid and tab URL and reports a URL when payment fields were not found. — index.js.map:src/lib/cards/useCheckout.ts
Sentry is enabled for popup errors and the custom error handler includes the active tab URL. — index.js.map:src/main.ts
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Every extension entry point is a packaged file. — manifest.json:background/content/action entry points
Remote responses are parsed as JSON and consumed as application data. — background.js/index.js maps:request and API modules
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It continuously rescans page structure locally after page changes, but opening its card picker and filling checkout require the user to focus/click a detected field and select a card. It also sends a dismissal event when its popup closes.
MutationObserver triggers local payment-field rescans while autofill is enabled. — content.js.map:src/scripts/content.ts
The Privacy UI appears on field focus/click; fillCheckout runs only after a card payload is received from extension UI. — content.js.map:src/lib/checkout/index.ts
Sends an Extension: Dismissed event when the popup port disconnects. — background.js.map:src/scripts/background.ts
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No settings or management permission is requested; uninstallSelf displays Chrome's confirmation dialog. — manifest.json/background.js.map:permissions and src/lib/extension/management.ts
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Includes complete original background, request, storage, API, and event sources. — background.js.map:sourcesContent
Includes complete checkout parser, filler, UI injection, and content-script sources. — content.js.map:sourcesContent
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Application sources use ordinary imports, callbacks, timers, and JSON parsing only. — *.js.map:first-party sourcesContent review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Includes tab URL in explicit checkout-fill and failure events. — index.js.map:src/lib/cards/useCheckout.ts
Tracks Extension: Checkout with the active URL when the Privacy interstitial mounts. — interstitial.js.map:src/InterstitialApp.vue
Mutation scanning does not contain a network call or transmit ordinary page URLs by itself. — content.js.map:src/scripts/content.ts
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a random session ID stored locally and attaches it to every Privacy services request. It may also retain a server-issued trusted-device ID for remembered two-factor authentication.
Creates uuidv4 sessionID when absent, stores it, and adds it as a request header. — background.js/index.js maps:src/lib/request/index.ts
Stores x-tfa-deviceid when the user chooses a remembered-device login flow. — index.js.map:src/store/auth/authStore.ts
Does it send cookies, session details, authentication data, or page contents elsewhere?
Privacy account credentials and the extension's bearer token are sent only to Privacy's services. Full virtual-card data is fetched into the extension and then written into the checkout page, but the code does not send merchant-page contents or user-entered card fields elsewhere.
Submits login/TFA data to the Privacy API and stores the returned bearer token. — index.js.map:src/apis/auth/auth.ts and src/store/auth/authStore.ts
Passes selected Privacy card and billing values internally to content scripts for local field filling. — index.js/content.js maps:src/lib/cards/useCheckout.ts and checkout filler
Does not read or upload current user-entered field values. — content.js.map:checkout parser
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads a fixed allowlist of field attributes instead of values. — content.js.map:src/lib/checkout/parser/parser.processor.ts
Focus/click listeners calculate the field's location and open the Privacy card picker; there is no key event listener. — content.js.map:src/lib/checkout/index.ts
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
A selected card is explicitly passed to fillCheckout through the extension message bus. — index.js.map:card stores and src/lib/cards/useCheckout.ts
Message commands originate from packaged extension contexts; no externally_connectable entry exists. — background.js.map:src/scripts/background.ts
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Page modifications are limited to Privacy autofill UI and selected payment/address fields. — content.js.map:complete first-party source review
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or downloads permission is requested. — manifest.json:permissions
sendRequest performs ordinary fetches for internal Privacy API calls. — background.js.map:src/scripts/background.ts
Can it communicate with software on the computer or services running on localhost?
The manifest allows Privacy services access on localhost, apparently for development, but the production services base is fixed to services.app.privacy.com. No native messaging or active localhost service call was found.
Includes *://localhost/* alongside Privacy production hosts. — manifest.json:host_permissions
The production bundle resolves the API base to https://api.app.privacy.com. — background.js:compiled API URL
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
insertAdjacentHTML receives the compile-time packaged logo string, not network data. — content.js.map:src/lib/checkout/button.ts
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Exposes only the interstitial page/script and static assets; no externally_connectable section is present. — manifest.json:web_accessible_resources
Privileged actions use chrome.runtime messaging confined to packaged extension contexts. — content.js.map:src/lib/checkout/index.ts
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Passes the current hostname to the suggestions page after the user opens the Privacy control. — content.js.map:src/lib/checkout/index.ts
Uses account and feature responses to display eligible cards and settings. — index.js.map:card/feature API modules
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Uses a debounced MutationObserver with a limited attribute filter to rerun the payment-field parser. — content.js.map:src/scripts/content.ts
Does it change form fields or where a form sends its information?
Autofill deliberately changes card number, CVV, expiration, card type, cardholder name, and billing-address controls after the user selects a Privacy card. It dispatches normal input/change events but does not change the form action or submit the purchase.
Writes selected Privacy card and billing values into matched inputs/selects and triggers relevant DOM events. — content.js.map:src/lib/checkout/filler/index.ts
fillCheckout is invoked by an internal message carrying the card chosen in Privacy's interstitial. — content.js.map:src/lib/checkout/index.ts
No form.action assignment or form submission call was found. — content.js.map:complete first-party review