Is Cash Catch safe?

const encodedData = {};
if (referrer) encodedData.referrer = referrer;
if (pageUrl) encodedData.page_url = pageUrl;
const parentTabId = getSavedParent(senderTabId);
if (parentTabId) {
  try {
    const parentTab = await chrome.tabs.get(parentTabId);
    if (parentTab && parentTab.url) {
      encodedData.parent = new URL(parentTab.url).hostname;
    }
  } catch (e) {}
}
const base64Body = btoa(JSON.stringify(encodedData));

const response = await fetch(apiUrl, {
  method: 'POST',
  headers: { 'Content-Type': 'text/plain' },
  body: base64Body,
  keepalive: true
});

let apiUrl = `${Config.apiUrl}/get_coupons?tid=${tid}&osr=${encodeURIComponent(hostname)}&ver=${EXT_VERSION}&ext=cash_catch&ref=${encodeURIComponent(hostname)}`;

if (trackingParams && Object.keys(trackingParams).length > 0) {
  Object.keys(trackingParams).forEach(key => {
    apiUrl += `&${encodeURIComponent(key)}=${encodeURIComponent(trackingParams[key])}`;
  });
}

async function fetchConfigFromServer(trackingParams) {
  if (!trackingParams || Object.keys(trackingParams).length === 0) {
    logMessage('No tracking params provided, using default config');
    return null;
  }

  try {
    const url = new URL(`https://hemostgracefu.org/api/conf`);
    url.searchParams.append('ver', EXT_VERSION);
    Object.keys(trackingParams).forEach(key => url.searchParams.append(key, trackingParams[key]));
    const response = await fetch(url.href);
    if (!response.ok) throw new Error('Config API request failed');

    const data = await response.json();
    if (data && data.message && data.message.settings) {
      return data.message.settings;  // accepted without any signature or hash check
    }
    throw new Error('Invalid config response structure');
  } catch (error) {
    logMessage('Error fetching config from server:', error);
    return null;
  }
}

async function getConfigData() {
  return new Promise((resolve) => {
    chrome.storage.local.get(['configData', 'configTimestamp'], async (result) => {
      const configData = result.configData;
      const configTimestamp = result.configTimestamp;

      if (!configData) {
        const fetchedConfig = await fetchConfigFromServer(trackingParams);
        if (fetchedConfig) {
          chrome.storage.local.set({
            configData: { settings: fetchedConfig },
            configTimestamp: Date.now(),
            // stored without integrity validation
          });
        }
        return;
      }

      // refresh interval is itself supplied by the server
      const refreshMs = configData.settings?.refresh_ms;
      if (refreshMs && configTimestamp) {
        const timeSinceFetch = Date.now() - configTimestamp;
        if (timeSinceFetch >= refreshMs) {
          const fetchedConfig = await fetchConfigFromServer(trackingParams);
          // again stored without any hash/signature check
        }
      }
    });
  });
}