Is ASO - Toolbox by StoreMaven safe?
ASO - Toolbox by StoreMaven sends profile email and store-page analytics to StoreMaven's App Engine endpoint.
The extension reads the signed-in Chrome profile email and stores persistent toolbox user and session IDs. When the toolbox loads a store page or the user changes country, language, device, logo, or iframe settings, it sends analytics that include the email, IDs, app metadata, selected localization/device, and current store page URL.
Who publishes itStoremaven - no other listings under this identity
Storemaven - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
ASO Toolbox by StoreMaven sends your Chrome email on every app listing view
Viewing a Play Store or App Store listing with ASO Toolbox installed reads your signed-in Chrome email and a persistent device ID, then sends both with the page URL to StoreMaven's analytics backend.
Not mentioned in the listing.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a Google Play, App Store, or iTunes app listing page with the ASO Toolbox extension installed.
The content script runs automatically on any matching store listing URL.
The extension reads your signed-in Chrome account email and a persistent device ID, then sends both with the exact page URL to StoreMaven's analytics backend.
The same beacon fires again whenever you change the country, language, or device selector in the toolbox.
- Your Chrome account emailjane.doe@gmail.com (illustrative)
If you're signed into Chrome, the email tied to your profile rides along with every beacon.
- Persistent device IDb7e2a1f0-3c4d-4e9a-8b1f-6d2c9a7e0f31--1757374800000
A UUID created once and reused forever, letting StoreMaven link every future listing view back to this browser.
- Session ID4d9f1c2e-7a8b-4c3d-9e0f-1a2b3c4d5e6f--1757374800000
A rotating ID that groups the beacons from roughly one hour of activity.
- Store listing page URLhttps://play.google.com/store/apps/details?id=com.whatsapp
The exact app page you're viewing, including the app's store ID.
- App, country, language, device chosencom.whatsapp / US / en / android
Which app you're previewing and which region, language, and device you selected in the toolbox.
sendBeacon (fire-and-forget, no response body observed)
{ "action": "pageLoad", "toolVersion": "3.0.0", "email": "", "uid": "b7e2a1f0-3c4d-4e9a-8b1f-6d2c9a7e0f31--1757374800000", "appId": "com.whatsapp", "appName": "WhatsApp Messenger", "developerName": "WhatsApp LLC", "language": "en", "country": "us", "context": "toolEngagement", "storePlatform": "android", "sessionId": "4d9f1c2e-7a8b-4c3d-9e0f-1a2b3c4d5e6f--1757374800000", "device": "android", "status": "success", "url": "https://play.google.com/store/apps/details?id=com.whatsapp"}Reading the profile email and building the analytics beacon
Toolbox init: reads chrome.identity profile email (renamed)
main.552f6a4ba91a25744928.jsfunction initToolbox(ctx) { var self = this; ctx.patchState({ loadingState: LoadingState.LOADING }); ctx.dispatch(new SetToolboxLoading(true)); try { // Reads the signed-in Chrome profile email. Granted by the // "identity" + "identity.email" permissions in manifest.json. chrome.identity.getProfileUserInfo(function (profile) { return __awaiter(self, void 0, void 0, function* () { const toolboxVersion = chrome.runtime.getManifest().version; // Persistent device UUID, created once and reused forever // (chrome.storage.sync key "sm_toolbox_uid"). const uid = yield this.localStorageService.getUserId(); const state = ctx.getState(); const appId = parseAppIdFromUrl(state.platform, state.url, state.urlParams); const appSessionStatus = yield this.localStorageService.getAppSessionStatus(appId); ctx.patchState({ toolboxVersion, appId, email: profile.email, // Chrome account email, stored in app state uid, appSessionStatus, }); this.setPlatformDevices(ctx, state.platform); this.setPlatformLocalization(ctx, state.platform); ctx.patchState({ loadingState: LoadingState.LOADED }); }); }); } catch (e) { ctx.patchState({ loadingState: LoadingState.ERROR }); }}Building and sending the beacon (renamed)
main.552f6a4ba91a25744928.jsfunction sendAnalytic(action, extra) { // Per-request auth token: current timestamp, RSA-OAEP encrypted with a // key bundled in the extension. Not user data, just a backend auth check. var authToken = this.authService.getToolboxApiToken(); var url = this.API_URL + "/aso_tool/v2?t=" + encodeURIComponent(authToken); this.getAnalyticsBaseFields().then(function (baseFields) { // baseFields already carries { toolVersion, email, uid, appId, appName, // developerName, language, country } from app state (see analyticsData // selector, set by initToolbox). var body = Object.assign({ action: action }, baseFields, extra); navigator.sendBeacon(url, JSON.stringify(body)); // no consent prompt });}function getAnalyticsBaseFields() { return __awaiter(this, void 0, void 0, function* () { const platform = this.store.selectSnapshot(ToolboxState.platform) === "android" ? "android" : "ios"; // Persistent session UUID, reused for 1 hour (chrome.storage.sync key // "sm_toolbox_session_id"). const sessionId = yield this.localStorageService.getSessionId(); const eventTime = new Date(); const clientTime = toLocalTime(eventTime); return Object.assign({}, this.store.selectSnapshot(ToolboxState.analyticsData), { context: "toolEngagement", storePlatform: platform, clientTime, eventTime, status: "success", sessionId, device: this.store.selectSnapshot(ToolboxState.selectedDevice).type, url: this.store.selectSnapshot(state => state.core.url), // the store listing page you're viewing }); });}- events-dot-mvns-creative-testing-prod.uc.r.appspot.com
StoreMaven's own analytics backend (Google App Engine), the same company that publishes this extension. Receives email, device/session IDs, and page URL on every listing view.
What it can do
Permissions this extension asks for, as declared in version 3.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on serve-dot-mvns-creative-testing-prod.uc.r.appspot.com
https://serve-dot-mvns-creative-testing-prod.uc.r.appspot.com/*
Read and change your data on events-dot-mvns-creative-testing-prod.uc.r.appspot.com
https://events-dot-mvns-creative-testing-prod.uc.r.appspot.com/*
See the address and title of every tab you have open
tabs
Sign you in with your Google account
identity
See the email address of your Google account
identity.email
Store data in your browser
storage
Where it sends data
Destinations our analysis observed ASO - Toolbox by StoreMaven contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- events-dot-mvns-creative-testing-prod.uc.r.appspot.com
ASO - Toolbox by StoreMaven sends data to events-dot-mvns-creative-testing-prod.uc.r.appspot.com. No other extension we have analysed sends data here.