Is Clarify Al: YouTube Summaries safe?

Medium risk

Clarify AI sends YouTube transcripts and Google OAuth codes to its own backend, which may retain persistent Google refresh tokens.

When a user requests a summary, the extension collects the video transcript, title, video ID, and duration and transmits them to clarify.up.railway.app for AI processing. The extension also handles Google sign-in by forwarding the OAuth authorization code to the vendor backend, which exchanges it with Google using offline access — meaning the vendor backend may hold a persistent Google refresh token. No evidence was found of additional data collection beyond the summarization and authentication flows.

Clarify AIv1.8.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-522
SourceAI SANDBOX

Google OAuth Codes Sent to Clarify Backend

Google sign-in requests offline OAuth access; the extension posts the code to api.clarify-ai.org/auth/google/exchange.

A Docs path posts the same code, Drive scope, to .../google/docs/authorize.

Offline access can yield a refresh token.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You start Google sign-in or connect Google Docs from the extension.

The flow uses Google's consent page and requires your interaction.

The extension did this

The extension asks for offline access and forwards the returned authorization code to Clarify's backend.

The main sign-in path sends the code to `/auth/google/exchange`; the Docs path sends it to `/google/docs/authorize`.

02EvidenceFIELD TABLE
OAuth fields handled by the extension
FieldValueWhy it matters
Google authorization code
4/0AfJohXmR8Vq6pP2cQdE7ZyN9uK5aH1bT3L0s (illustrative)This short-lived code can be exchanged by the backend for Google account tokens for the scopes you approved.
Extension redirect URL
https://ogihgbocgnbhhdcmcolhipjhkmkecpeg.chromiumapp.org/This ties the consent response to this browser extension's sign-in flow.
Offline consent request
access_type=offline&prompt=consentThis tells Google the backend may receive a token that can be used after the initial sign-in is over.
Requested Google access
openid email profile; https://www.googleapis.com/auth/drive.fileThe sign-in path asks for basic account identity; the Docs path asks to create or edit files the app opens or creates.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.clarify-ai.org/auth/google/exchange
The source returns the endpoint response as JSON and stores returned token fields in extension storage.
Headers
Content-Typeapplication/json
04EvidenceCODE COMPARE
The code that does this

The shipped service worker asks Google for offline access, then posts the code to Clarify

What it actually does
OAuth URL construction requests an authorization code with offline consentbackground.js
initiateAuthFlow() {
  return t(this, void 0, void 0, (function*() {
    const e = chrome.identity.getRedirectURL(),
      t = `https://accounts.google.com/o/oauth2/v2/auth?${new URLSearchParams(Object.assign({client_id:"573056324362-gmav59in4a9nf5pj4m5q42e5qpmmtbrm.apps.googleusercontent.com",response_type:"code",access_type:"offline",prompt:"consent",redirect_uri:e,scope:this.config.scopes.join(" ")},this.config.authParams)).toString()}`,
      o = yield chrome.identity.launchWebAuthFlow({
        url: t,
        interactive: !0
      }), n = new URL(o).searchParams.get("code");
    if (!n) throw new Error("No authorization code received");
    return n
  }))
}
Main Google exchange sends code and redirectUri to the backendbackground.js
static exchangeCode(e) {
  return n(this, void 0, void 0, (function*() {
    const t = chrome.identity.getRedirectURL(),
      o = yield fetch(`${this.GOOGLE_AUTH_URL}/exchange`, {
        method: "POST",
        credentials: "include",
        headers: {
          "Content-Type": "application/json"
        },
        body: JSON.stringify({
          code: e,
          redirectUri: t
        })
      });
    if (!o.ok) throw new Error("Failed to exchange code");
    return o.json()
  }))
}

r.GOOGLE_AUTH_URL = "https://api.clarify-ai.org/auth/google", r.OTP_API_AUTH_URL = "https://api.clarify-ai.org/auth", r.tokenManager = new o({
  storageKeys: {
    accessToken: "accessToken",
    expiryTime: "expiryTime",
    refreshToken: "refreshToken"
  },
  scopes: ["openid", "email", "profile"]
}), r.refreshInFlight = null;
Google Docs exchange sends the same body shape to the Docs authorization endpointbackground.js
static exchangeCode(e) {
  return s(this, void 0, void 0, (function*() {
    const t = yield this.getMainAppToken();
    if (!t) throw new Error("Please sign in to the app first");
    const o = chrome.identity.getRedirectURL(),
      n = yield fetch(`${this.GOOGLE_DOCS_API_URL}/authorize`, {
        method: "POST",
        credentials: "include",
        headers: {
          "Content-Type": "application/json",
          Authorization: `Bearer ${t}`
        },
        body: JSON.stringify({
          code: e,
          redirectUri: o
        })
      });
    if (!n.ok) throw new Error("Failed to authorize Google Docs");
    return n.json()
  }))
}

i.GOOGLE_DOCS_API_URL = "https://api.clarify-ai.org/google/docs", i.tokenManager = new o({
  storageKeys: {
    accessToken: "googleDocsAccessToken",
    expiryTime: "googleDocsExpiryTime"
  },
  scopes: ["https://www.googleapis.com/auth/drive.file"],
  authParams: {
    include_granted_scopes: "true"
  }
}), i.mainAppTokenManager = new o({
  storageKeys: {
    accessToken: "accessToken",
    expiryTime: "expiryTime"
  },
  scopes: []
});
05EvidenceTHIRD PARTY LIST
External services involved in the exchange
  • accounts.google.com

    Shows the Google consent page and returns the authorization code to the extension redirect URL.

  • api.clarify-ai.org

    Receives the Google authorization code and redirect URL for the main sign-in and Google Docs authorization flows.

Data recipients

clarify.up.railway.app
Updated 17 September 2026ogihgbocgnbhhdcmcolhipjhkmkecpeg