ghts\n \n \n \n\n\n// optionPage.js\nconst shareInsights = document.querySelector('#shareInsights')\nshareInsights.addEventListener('change', () => {\n chrome.storage.sync.set({ shareInsights: shareInsights.checked })\n})","sourceFile":"options.html + optionPage.js"}],"deobfuscated":[{"caption":"isOptedOutPii() checks storage key 'sharePersonalData'","code":"$26","sourceFile":"paramount.min.js:3370-3467"},{"caption":"The only options screen in the extension, and it only ever touches a different key ('shareInsights')","code":"\n

\n Share anonymous viewing insights\n \n \n \n

\n\n// optionPage.js\nconst shareInsights = document.querySelector('#shareInsights')\nshareInsights.addEventListener('change', () => {\n chrome.storage.sync.set({ shareInsights: shareInsights.checked })\n})","sourceFile":"options.html + optionPage.js"}],"technicalNote":"getOptedOut()/isOptedOutPii() (paramount.min.js:3370-3467) read storage key 'sharePersonalData'; only 'shareInsights' has a UI control (options.html, optionPage.js)."},{"kind":"third_party_list","caption":"Where the data goes","hosts":[{"host":"me3x.online","purpose":"Command endpoint: receives accountId/profileId/extensionUserId, issues data-collection commands, and receives subscription/billing/continue-watching uploads."},{"host":"metricsmint.quest","purpose":"Separate PII beacon: receives your base64-encoded email address and country whenever you view an account/subscriptions page."}]},{"kind":"artifact","purpose":"reproducer","filename":"check_optout.js","language":"js","description":"Replays the extension's own opt-out check against a storage value that was never set by any shipped UI control, showing tracking stays on.","code":"// Reproduces the extension's getOptedOut()/isOptedOutPii() logic\n// (paramount.min.js:3370-3467) against a mock chrome.storage.sync.\n\nfunction mockStorageGet(key, store) {\n return Promise.resolve({ [key]: store[key] });\n}\n\nasync function getOptedOut(key, store) {\n const value = (await mockStorageGet(key, store))[key];\n return value === false; // opted out ONLY if explicitly set to false\n}\n\nasync function isOptedOutPii(store) {\n return getOptedOut('sharePersonalData', store);\n}\n\n(async () => {\n // No shipped screen ever writes 'sharePersonalData' (only 'shareInsights'\n // has a UI toggle in options.html), so a real install's storage looks like this:\n const realWorldStorage = { shareInsights: true };\n\n const optedOutPii = await isOptedOutPii(realWorldStorage);\n console.log('sharePersonalData in storage:', realWorldStorage.sharePersonalData);\n console.log('isOptedOutPii() result:', optedOutPii); // always false\n})();","usage":"1. Save as check_optout.js. 2. Run: node check_optout.js. 3. Observe optedOutPii resolves to false even though sharePersonalData was never configured."},{"kind":"plain_note","body":"Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture."}],"scaleMetrics":[{"label":"Collection interval","value_label":"Every 5 minutes","fill":0.7,"tier":"warning"},{"label":"User-facing opt-out","value_label":"None (control never wired up)","fill":1,"tier":"error"},{"label":"Third-party destinations","value_label":"2 vendor servers","fill":0.5,"tier":"warning"},{"label":"Fields sent per cycle","value_label":"9+ identity and billing fields","fill":0.6,"tier":"warning"}],"trustTier":"ai-found","userActions":[]},"variant":"inline","expectedKind":"unexpected","showVerificationBadge":false}]]}]],false]}]]}] 22:["$","footer",null,{"className":"border-border space-y-6 border-t pt-6","children":["$","div",null,{"className":"text-muted-foreground flex flex-wrap gap-x-5 gap-y-1 text-xs","ch

Is Hide Spoilers works with Paramount Plus [QVI] safe?

Findings