Is ChatGPT to PDF - One-Click Export & Batch Save safe?

Medium risk

ChatGPT to PDF sends subscription-check email addresses to Google Analytics.

When the popup or options page checks whether a user is subscribed, the extension includes the stored subscriber email address in analytics event parameters. The background script posts those events, along with a generated client ID, to Google Analytics Measurement Protocol.

aluov3.3.0Chrome Web Store
45Risk
Who publishes it

org - 6 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
aluo
Declared legal entity
org
Registered address
xianganwanjiaonailuchengjie, 345num, 九龍, 香港 510000, CN
Registered contact
strongerzhou
Website
github.com/joysey/chatgpt-to-notion/issues

Same store account

6 other listings published from this account, 14k+ users between them. 2 of them carry a finding.

Save ChatGPT to Notion8k+MediumChatGPT to Evernote2k+CleanEmail Hunter Pro1k+CleanAIExportHub: Bulk Export AI Chats1k+LowChatGPT Prompts Hub1k+Cleanmidjourney to notion1k+Medium

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

payv2.chatgpt2notion.com
Also called by 7 other listings, including Save ChatGPT to Obsidian markdown file, Export Gemini AI Chats to PDF
nodeapi.chatgpt2notion.com
Also called by 9 other listings, including Save ChatGPT to Obsidian markdown file, Claude to Obsidian & Markdown Export

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Subscription checks send the user's email to Google Analytics.

When you check subscription status in the popup or options page, the extension forwards the subscription email to Google Analytics' Measurement Protocol endpoint, including form input and stored subscription data.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user performs a subscription-status check in the popup or options page.

The extension did this

The extension forwards the subscription email in Google Analytics event parameters.

Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-YZT7QC3LV7&api_secret=<redacted>
Fields in the request
  • Your subscription email
    user@example.com (illustrative)

    Identifies the account email included in the subscription-status analytics event.

  • Stored subscription data
    isSubcribered: true (illustrative)

    Provides account-status context that the extension keeps in browser storage.

Where it sends data

Destinations our analysis observed ChatGPT to PDF - One-Click Export & Batch Save contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    ChatGPT to PDF - One-Click Export & Batch Save sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

Updated 30 September 2026hjdhbhggcljjjfenfbdbbhhngmkglpkl