Is ChatGPT Delete All Chats safe?
ChatGPT Delete All Chats computes a persistent browser fingerprint on chatgpt.com and sends it to antonkhoteev.com on every API call.
On each chatgpt.com page load the extension uses a bundled FingerprintJS library to derive a stable visitor ID from canvas, WebGL, audio, font, and screen entropy, then stores it as your userId. That fingerprint is attached to every backend request the extension makes to antonkhoteev.com, including config, actions, payment, subscription, rating, and message calls, letting the developer's server recognize your browser across sessions.
Who publishes itAnton Khoteev - 2 other listings from the same operator, 2 of them carrying a finding
Anton Khoteev - 2 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 120k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Browser Fingerprint Sent to antonkhoteev.com as Your Persistent ID on ChatGPT
On chatgpt.com, this extension computes a FingerprintJS fingerprint from your canvas, WebGL, audio, fonts, and screen, then sends it as userId to antonkhoteev.com with a random userUuid.
It persists across restarts, being device-derived.
What actually happens
You open chatgpt.com with the extension installed.
The extension's overlay computes a browser fingerprint from your device and uses it as the persistent ID it sends to the developer's server.
No click is required; it runs automatically when the overlay mounts on page load, before you delete or archive anything.
Captured request
Returns the remote config JSON (user, rating, review, usage, subscription, paywall). The notable part is the request: userId is a 32-hex FingerprintJS visitorId, distinct from the dashed random userUuid sent alongside it.
What the /config request carries
- Browser fingerprint (sent as userId)11ef1e80b8b0ae1323589e8ed04a7c1b
A hash from your device's canvas, WebGL, audio, fonts and screen. It's the same every visit, even after clearing the extension's storage.
- Random install ID (userUuid)ae5c0a29-48e9-474e-bf3c-018b3faf0a3f
A separate randomly generated UUID for this install. On its own this would identify the install without needing a device fingerprint.
- Extension version5.0.2
Which version of the extension you have installed.
The code that does this
The extension's own source (shipped readable in the package) that builds and sends the fingerprint.
What it does, in plain terms
// On overlay mount, initUser() reads chrome.storage.local.// If no userId is stored yet, it calls generateUserId(), which// runs the bundled FingerprintJS (canvas/WebGL/audio/fonts/screen// entropy) and returns result.visitorId — a stable per-device hash.// That visitorId is then persisted as 'userId' and reused forever.//// initConfig() immediately issues:// GET antonkhoteev.com/khoteev-api/dac/config?userId=<fingerprint>&userUuid=<random uuid>&version=<ver>// so the device fingerprint leaves the machine on the first page load.What's stored on your device
Cached under 'userId', computed once and reused. The same device yields the same visitorId, so deleting this key just regenerates it.
- Location
- chrome.storage.local (extension origin)
{ "userId": "11ef1e80b8b0ae1323589e8ed04a7c1b", "userUuid": "ae5c0a29-48e9-474e-bf3c-018b3faf0a3f"}Where the identifier is sent
- antonkhoteev.com
Developer's own backend (path /khoteev-api/dac). Receives the fingerprint as userId plus a random userUuid on /config and on action, payment, rating, review, and message endpoints.
Reproduce it yourself
Run in the chatgpt.com page console with the extension active to read the stored identifiers and confirm that userId is a 32-hex FingerprintJS fingerprint, distinct from the dashed random userUuid, then watch it leave the device on the /config request.
- Chrome with the extension installed
- A chatgpt.com tab
// verify-fingerprint-id.js// 1) Inspect the identifiers the extension stored.chrome.storage.local.get(['userId','userUuid'], (s) => { const isHexFp = /^[0-9a-f]{32}$/.test(s.userId || ''); const isUuid = /^[0-9a-f-]{36}$/.test(s.userUuid || ''); console.log('userId :', s.userId, '\u2192 32-hex fingerprint?', isHexFp); console.log('userUuid:', s.userUuid,'\u2192 random UUID-4? ', isUuid); console.log('distinct identifiers?', s.userId !== s.userUuid);});// 2) See the fingerprint leave the device.// Open DevTools \u2192 Network, filter 'antonkhoteev.com', reload chatgpt.com,// and read the userId query param on the /khoteev-api/dac/config request.- 1Open chatgpt.com with the extension installed.
- 2Open DevTools, paste this script in the console.
- 3Confirm userId is a 32-hex fingerprint, userUuid a UUID-
- 4
- 5In Network, filter antonkhoteev.com, reload, read userId on /config.
Where it sends data
Destinations our analysis observed ChatGPT Delete All Chats contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- antonkhoteev.com
ChatGPT Delete All Chats sends data to antonkhoteev.com. 2 other extensions we have analyzed send data here.