Is ChatGPT to Google Docs, Word or PDF safe?

Medium risk

ChatGPT to Google Docs, Word or PDF is medium risk. On install, the extension reads your signed-in Chrome account email and sends it, plus a generated device ID, to two Thinksolv-owned servers before you use any feature. We observed this happen during dynamic analysis of a fresh install.

Vikram Aruchamyv2.10.0Chrome Web Store
45Risk
Who publishes it

Thinksolv technologies (OPC) private limited - 5 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Vikram Aruchamy
Declared legal entity
Thinksolv technologies (OPC) private limited
Registered address
3, SF.No.333, Kumaraguru Collegeof Technology Campus, Athipalayam Road, Chinnavedampatty, Coimbatore, Tamil Nadu 641049, IN
Registered contact
Vikram Aruchamy

Same store account

4 other listings published from this account, 157k+ users between them. 1 of them carries a finding.

Same operator - 1 listing

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

ChatGPT to Google Docs sends your Google account email to Thinksolv on install

On install, the extension reads your signed-in Chrome account email and sends it, plus a generated device ID, to two Thinksolv-owned servers before you use any feature.

We observed this happen during dynamic analysis of a fresh install.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install the extension from the Chrome Web Store.

No sign-up screen or consent prompt is shown first.

The extension did this

The background service worker reads your Chrome account email and sends it to Thinksolv's servers.

This happens on the first service worker startup, before you use any conversion feature.

Fields in the install-time requests to Thinksolv
  • Your Google account email
    lennyyeeman@gmail.com

    The email tied to your signed-in Chrome profile, read without asking.

  • Generated device ID
    784c5ca800486b28f3152e9a4e390633

    A tracking ID created by a third-party endpoint the first time the extension runs.

  • Email-list identifiers
    templateId: 12, listId: 9

    Values that map to a specific list and template in an email marketing system.

  • Sender address
    vikram@thinksolv.com

    The Thinksolv address the resulting marketing email would come from.

Captured request
POSThttps://userapi.thinksolv.com/

Sent with mode: no-cors, so the extension itself never reads a response. We observed this exact request leave the device twice during a single fresh install.

Headers
Content-Type
application/json
Body
{  "email": "lennyyeeman@gmail.com",  "name": "",  "templateId": 12,  "listId": 9,  "fromEmail": "vikram@thinksolv.com",  "sendEmail": true}
Captured request
POSThttps://chatph.thinksolv.com

Server responded success:true both times we observed this request during a fresh install.

Headers
Content-Type
application/json
Body
{  "eventName": "user_signed_up",  "eventData": {    "userEmail": "lennyyeeman@gmail.com",    "cfUserId": "784c5ca800486b28f3152e9a4e390633",    "browser": "chrome",    "hostApp": "chatgpt-to-gdocs-pdf-ext"  },  "LAPPNAME": "B"}
The code that does this

The install handler that collects and sends your email

Readable version
chrome.runtime.onInstalled.addListener((details) => {  if (details.reason === chrome.runtime.OnInstalledReason.INSTALL) {    try {      chrome.tabs.create({ url: installUrl }); // opens the welcome page    } catch (err) {      // tab creation can fail if the user is mid-drag; ignored    }    (async () => {      // 1. Read the signed-in Chrome account email      let email = await getProfileEmail();      if (!email) email = "email_na@thinksolv.com";      // 2. Fetch a per-install tracking ID from a Cloudflare Worker      let cfUserId = 0;      try {        cfUserId = await fetchCfUserId();      } catch (e) {        cfUserId = 0;      }      // 3. Cache both values locally      saveLocalProperties({ email, cfUserId });      // 4. Log an install/signup analytics event carrying the email + tracking ID      logEvent("user_signed_up", {        userEmail: email,        cfUserId,        browser: detectBrowser(),      });      // 5. POST the email straight to Thinksolv's mailing-list API      await fetch("https://userapi.thinksolv.com/", {        method: "POST",        headers: { "Content-Type": "application/json" },        mode: "no-cors",        body: JSON.stringify({          email,          name: "",          listId: 9,          templateId: 12,          fromEmail: "vikram@thinksolv.com",          sendEmail: true,        }),      });    })();  }});function getProfileEmail() {  return new Promise((resolve) => {    if (detectBrowser() !== "chrome") return resolve(`${detectBrowser()}_email@thinksolv.com`);    chrome.identity.getProfileUserInfo({ accountStatus: "ANY" }, (info) => {      if (chrome.runtime.lastError || !info.email) resolve("email_na@thinksolv.com");      else resolve(info.email);    });  });}async function fetchCfUserId() {  const res = await fetch("https://cf-userid-generator.aruchamyvikram.workers.dev/", {    method: "GET",    headers: { "Content-Type": "application/json" },  });  if (!res.ok) throw new Error(`HTTP ${res.status}`);  return res.text(); // a generated per-install tracking ID}function logEvent(eventName, eventData) {  eventData.hostApp ||= "chatgpt-to-gdocs-pdf-ext";  return fetch("https://chatph.thinksolv.com", {    method: "POST",    headers: { "Content-Type": "application/json" },    mode: "no-cors",    body: JSON.stringify({ eventName, eventData, LAPPNAME: "B" }),  });}
Where install-time data ends up
    • userapi.thinksolv.com

    Receives your email plus email-marketing metadata (templateId, listId, fromEmail) on every fresh install.

    • chatph.thinksolv.com

    Receives an analytics event containing your email and the generated tracking ID.

    • cf-userid-generator.aruchamyvikram.workers.dev

    A Cloudflare Worker, run under the same developer's account, that issues the per-install tracking ID.

Updated 30 September 2026oibghjgooccojibfacdonaoipegckdeg