Is Auto Refresh Plus safe?

// Sends analytics data — no check of 'privacyOff' before sending
async function reportAction(currentUrl, previousUrl, userId) {
  const payload = {
    tis: new Date().toISOString(),
    uid: userId,
    docref: previousUrl,
    uri: currentUrl
  };
  await postData('https://autorefreshplus.in/api/v1/analytics', payload);
  // NOTE: 'privacyOff' is stored in chrome.storage.local but is never
  // read here or in the caller before sending.
}

chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {
  const { status } = changeInfo;
  const { url } = tab;
  if (status === 'complete') {
    const tabState = await tabInfo(tabId);
    let userId = await getFromLocalStorage('uid');  // reads UID — not privacyOff
    let previousUrl = tabState?.url;
    if (isValidPage(url) && url !== previousUrl) {
      await reportAction(url, previousUrl, userId);  // called unconditionally
    }
  }
});

// Runs in the page's own JS context (manifest: world:'MAIN')
(() => {
  if (window.top !== window.self) return;             // top frame only
  if (!/^https?:$/.test(location.protocol)) return;

  const notify = () => document.dispatchEvent(new Event('__autorefresh_spa_nav__'));

  // Navigation API (modern browsers)
  const nav = window.navigation;
  if (nav && typeof nav.addEventListener === 'function') {
    nav.addEventListener('navigatesuccess', () => queueMicrotask(notify));
  }

  // Patch the two functions SPA routers use to change the URL in-place
  const origPushState = history.pushState;
  history.pushState = function (...args) {
    const result = origPushState.apply(this, args);
    queueMicrotask(notify);
    return result;
  };
  const origReplaceState = history.replaceState;
  history.replaceState = function (...args) {
    const result = origReplaceState.apply(this, args);
    queueMicrotask(notify);
    return result;
  };
})();

// Isolated-world content script — relays navigation events to background.js
(() => {
  if (window.top !== window.self) return;
  if (!/^https?:$/.test(location.protocol)) return;

  let lastUrl = '', lastTime = 0;
  const report = (url, referrer) => {
    const now = Date.now();
    if (url === lastUrl && now - lastTime < 5000) return;   // debounce
    lastUrl = url; lastTime = now;
    const navType = performance.getEntriesByType('navigation')[0]?.type || '';
    chrome.runtime.sendMessage({ message: 'pageview', uri: url, docref: referrer || '', navType }).catch(() => {});
  };

  const onLoad = () => report(location.href, document.referrer);
  document.readyState === 'loading'
    ? document.addEventListener('DOMContentLoaded', onLoad, { once: true })
    : onLoad();

  window.addEventListener('pageshow', (e) => {
    if (e.persisted && location.href !== lastUrl) report(location.href, document.referrer);
  });

  // Fires on the custom event dispatched by content-main.js's history hook,
  // and on native back/forward navigation
  let prevUrl = location.href;
  const onSpaNav = () => {
    const url = location.href;
    if (url === prevUrl) return;
    const referrer = prevUrl;
    prevUrl = url;
    report(url, referrer);
  };
  document.addEventListener('__autorefresh_spa_nav__', onSpaNav);
  window.addEventListener('popstate', onSpaNav);
})();

async function postData(url, payload) {
  try {
    const res = await fetch(url, {
      method: 'POST',
      credentials: 'include',   // attaches any cookie set for `url`'s domain
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(payload),
    });
    return await res.json();
  } catch (e) {
    // network errors are swallowed
  }
}