Is AlleRadar: Allegro Helper safe?

Medium risk

AlleRadar is medium risk. AlleRadar creates a permanent ID on first run, in synced settings. A recurring alarm sends it with your filters, sort order, note counts, price history to caverdant.online. Allegro interactions send the ID plus page/button clicked.

AlleRadarv3.9.10Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Persistent Device ID and Usage Telemetry Sent Without Disclosure

AlleRadar creates a permanent ID on first run, in synced settings.

A recurring alarm sends it with your filters, sort order, note counts, price history to caverdant.online.

Allegro interactions send the ID plus page/button clicked.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install AlleRadar and browse Allegro.pl listings or offer pages.

The extension did this

AlleRadar assigns you a permanent ID and, on a recurring schedule, sends it along with your filter settings and usage history to its own analytics server.

No opt-in prompt or disclosure of the destination domain is shown before the first upload.

What the periodic analytics upload sends
  • Your persistent ID
    usr_729384112

    A permanent identifier created on install and reused in every future upload. Ties every submission back to the same install indefinitely.

  • Your full filter configuration
    {"hideSponsored":false,"hidePromoted":true,"searchRegular":true,"blacklist":[]}

    Every filter toggle and setting you've configured (excluded sellers, sort preference, price-panel position, and more).

  • Listings removed from view
    482

    Running count of how many listings the filter has removed from your view.

  • Your last sort order
    price_asc

    The sort order you last used on an Allegro listings page.

  • Notes you've saved
    offerNotesCount: 12, productNotesCount: 5

    How many private notes you've attached to offers and to products.

  • Price-history tracked
    23 days tracked

    How many days of price history AlleRadar has recorded for products you've viewed.

  • AlleRadar version
    3.9.6

    Which version of the extension you have installed.

Captured request
POSThttps://caverdant.online/analytics/alleradar.php

{"success":true} - confirmed reachable during testing: a marker value planted in the stored persistent ID was observed verbatim in this outbound request.

Headers
Accept
application/json
Content-Type
application/json
Extension-Code
pommegranate
Body
{  "hideSponsored": false,  "hidePromoted": true,  "blacklist": [],  "searchRegular": true,  "totalRemovedCount": 482,  "lastSortType": "price_asc",  "isFilteringEnabled": true,  "user": "usr_729384112",  "isConfigUnchanged": true,  "totalPrices": 146,  "priceDaysCount": 23,  "uploadedPricesCount": 0,  "pricePanelOpenedCount": 9,  "isPricePanelDragged": false,  "offerNotesCount": 12,  "productNotesCount": 5,  "allegroUlubioneCount": 31,  "uiHiding": {},  "version": "3.9.6"}
Captured request
POSThttps://caverdant.online/events/alleradar/events.php

{"success":true} - on success, the locally queued telemetryEvents entries are cleared.

Headers
Accept
application/json
Content-Type
application/json
Extension-Code
pommegranate
Body
{  "user": "usr_729384112",  "events": [    {      "eventName": "search_regular",      "eventTarget": "search_regular_button_popup",      "contextType": "popup",      "contextId": "https://allegro.pl/oferta/przyklad-12345678901"    }  ],  "version": "3.9.6",  "source": "ext_chrome"}
When this fires

Every 4 hours

The background alarm fires every 240 minutes, but the analytics upload only actually sends if at least 24 hours have passed since the last successful upload. The queued-events upload has no such gate and sends on every alarm fire as long as at least one event is queued.

The code that does this

The code that assembles and sends both telemetry uploads.

Readable version

Analytics upload

// Runs on 'analyticsAlarm' when >=24h since the last successful upload.const payload = {  ...syncedConfig,               // filter settings, minus user + firstInstalledTimestamp  totalRemovedCount,  lastSortType,  isFilteringEnabled,  user: persistentUserId,        // the permanent usr_<random> ID  isConfigUnchanged,  totalPrices,  priceDaysCount,  uploadedPricesCount,  pricePanelOpenedCount,  isPricePanelDragged,  offerNotesCount,  productNotesCount,  allegroUlubioneCount,  uiHiding,  version: manifest.version};fetch('https://caverdant.online/analytics/alleradar.php', {  method: 'POST',  body: JSON.stringify(payload),  headers: { 'Content-Type': 'application/json', 'Extension-Code': 'pommegranate' }});

Queued-events flush

// Runs on 'analyticsAlarm' whenever telemetryEvents has queued entries.const userId = getOrCreatePersistentUserId();const payload = { user: userId, events: queuedTelemetryEvents, version: manifest.version, source: 'ext_chrome' };fetch('https://caverdant.online/events/alleradar/events.php', {  method: 'POST',  body: JSON.stringify(payload),  headers: { 'Content-Type': 'application/json', 'Extension-Code': 'pommegranate' }});// On success, clears chrome.storage.local.telemetryEvents
Where this telemetry ends up
    • caverdant.online

    Receives the periodic analytics upload (ID, filter config, counters) and the queued events upload (which Allegro pages you engaged with, and how). Reachability confirmed live.

Updated 30 September 2026mppahmgdcnapaalefnpnfoekkpggkkol