Is Trim: IMDB Rating on Netflix, Prime & Disney+ safe?
Trim IMDB Rating sends your streaming page URLs, browsing metadata, and Netflix content details to its own servers and Google Analytics.
On Netflix, the extension reads movie and show metadata from the page DOM — including titles, cast, genres, and your geographic locale — and transmits this data along with the current page URL to goodmovies.io with each ratings request. Page views across Netflix, Prime Video, Disney+, HBO, Hulu, Apple TV, Peacock, and Paramount+ are also reported to Google Analytics with a persistent client ID that links activity across sessions. When a user authenticates via gettrim.cc, the extension receives a JWT token, forwards it to goodmovies.io/auth, and retains the returned email address and customer ID in memory.
Who publishes itgoodmovies - 3 other listings from the same operator, none carrying a finding
goodmovies - 3 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 67k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Streaming page views sent to Google Analytics with persistent user ID
Each time you navigate within Netflix, Prime Video, Disney+, HBO Max, Hulu, Apple TV+, Peacock, or Paramount+, Trim sends the page URL, title, and referrer to Google Analytics under a persistent ID, letting the publisher track your viewing.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any page on a supported streaming service.
Supported services: Netflix, Amazon Prime Video, Disney+, HBO Max, Hulu, Apple TV+, Peacock, Paramount+.
The extension posts the page URL, title, and referrer to Google Analytics together with a persistent device ID.
The ID is generated once and stored in chrome.storage.local; it does not reset between browser sessions.
HTTP 204 No Content, event accepted by Google Analytics Measurement Protocol
- Content-Type
- application/json
{ "client_id": "5f7b3a1d-3592-4ae2-81fb-f594137bf64a", "events": [ { "name": "page_view", "params": { "page_title": "Watch Demon Slayer: Kimetsu no Yaiba | Netflix", "page_location": "https://www.netflix.com/gb/title/81091393", "page_referrer": "https://www.netflix.com/browse", "session_id": "1717660234512", "engagement_time_msec": 100, "request_id": "abc123", "trim_version": "8.03" } } ]}- Device ID5f7b3a1d-3592-4ae2-81fb-f594137bf64a
A permanent random ID set the first time the extension runs, letting Analytics link every streaming page you visit to your device.
- Full page URLhttps://www.netflix.com/gb/title/81091393
The exact address of the streaming page, which can include the title ID and region code (e.g. /gb/title/81091393 on Netflix).
- Page titleWatch Demon Slayer: Kimetsu no Yaiba | Netflix
The browser tab title, which typically contains the name of the film or show you are viewing.
- Referring URLhttps://www.netflix.com/browse
The page you came from, for example, a Netflix browse or genre page, which reveals navigation patterns within the platform.
- Session ID1717660234512
A timestamp-derived ID that groups your activity within a 30-minute window, allowing per-session viewing sequences to be reconstructed.
Page-view assembly in the Netflix content script and background dispatch
What the page-view function does in plain terms
// On each navigation, collect page metadata and forward to GAfunction sendPageView(extraParams = {}) { const params = { page_title: document.title, // e.g. "Watch Demon Slayer | Netflix" page_location: document.location.href, // full URL page_referrer: document.referrer, // previous page ...extraParams }; chrome.runtime.sendMessage({ action: 'analyze', event: 'page_view', params });}// background.js: clientId persists across browser sessionsasync function getOrCreateClientId() { let { clientId } = await chrome.storage.local.get('clientId'); if (!clientId) { clientId = crypto.randomUUID(); await chrome.storage.local.set({ clientId }); } return clientId; // same UUID on every future call}- www.google-analytics.com
Google Analytics endpoint (property G-6R0YJ1856Q). Receives page URL, title, referrer, and persistent device ID on every navigation. Accessible to the publisher via GA4.
Netflix page URL and geo locale sent to goodmovies.io with each ratings request
Each time Trim fetches IMDB or Rotten Tomatoes ratings on Netflix, it sends the page's URL plus your locale, country, and movie IDs to goodmovies.io, the publisher's server, which logs which titles you viewed, when, and where.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You load or scroll a Netflix browse page containing content tiles.
The extension's MutationObserver fires each time new DOM elements appear on Netflix.
The extension sends the full Netflix page URL and your geo locale to goodmovies.io alongside the movie IDs it is looking up ratings for.
The geo object includes locale (language and country) and requestCountry (country ID and name) read directly from Netflix's internal React context.
HTTP 200, goodmovies.io returns rating data for the requested movie IDs
- Accept
- application/json
- Content-Type
- application/json
{ "version": "3", "queries": [ { "movieId": "81091393" } ], "geo": { "locale": { "id": "en-GB", "language": "en", "countryCode": "GB" }, "requestCountry": { "id": "GB", "countryName": "United Kingdom" } }, "location": "https://www.netflix.com/gb/title/81091393"}- Current page URLhttps://www.netflix.com/gb/title/81091393
The exact Netflix URL viewed, encoding title ID and region (e.g. /gb/). With server timestamps this rebuilds your Netflix browse history.
- Localeen-GB
Your Netflix locale, language, and country, read from Netflix's React data. Reveals which regional library you're accessing.
- CountryUnited Kingdom (GB)
Full country name and country ID from Netflix's geo model. Tells goodmovies.io which Netflix region you are subscribed to.
Rating request assembly in netflix/content.js, lines 147-168
Plain-English reading of T()
// Called on each MutationObserver trigger when new content tiles appearfunction sendRatingsRequest(movieIdList, module, refetches, requestType) { const geo = module.getGeo(); // {locale: {id, language, countryCode}, requestCountry: {id, countryName}} const payload = { version: '3', queries: movieIdList, // array of { movieId: '81091393' } geo: geo, // user's locale and country from Netflix internals location: window.location.href // full current Netflix URL }; const ratingEndpoint = module.ratingUrl(window.location.hostname); // ratingUrl() always returns 'https://goodmovies.io/rating' chrome.runtime.sendMessage({ action: 'getRatings', url: ratingEndpoint, data: payload, // includes full URL and geo — not just movie IDs refetches, type: requestType });}- goodmovies.io
Rating API run by Trim's publisher. Receives movie/show ID batches with your current page URL, locale, and country per page load. Retention policy isn't disclosed in the listing.
What it can do
Permissions this extension asks for, as declared in version 8.03. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on goodmovies.io
https://goodmovies.io/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed IMDB Rating on Netflix, Prime & Disney+ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
IMDB Rating on Netflix, Prime & Disney+ sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- goodmovies.io
IMDB Rating on Netflix, Prime & Disney+ sends data to goodmovies.io. No other extension we have analysed sends data here.