Is Intentional – Website Blocker & Focus App safe?

Medium risk

Intentional sends extension analytics and blocked-page events with a persistent ID to PostHog.

The extension creates or reuses a local analytics distinct ID and sends install, update, settings-count, and site-blocked events to PostHog. On the blocked page, review clicks, upgrade CTA clicks, and affiliate-link clicks can include the blocked hostname or blocked URL domain.

Janez Cadezv1.1.23Chrome Web Store
45Risk
Who publishes it

Janez Cadez - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Janez Cadez
Website
www.tryintentional.com/support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Persistent Analytics ID Tracks Sites You Block

Intentional creates a random ID on first run, stored locally.

Adding or visiting a blocked site sends it to PostHog with the domain, and for visits, schedule type.

Confirmed via reddit.com: same ID recurred, tying activity to one install.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You add a website to your block list, or you visit a site you've already blocked.

Both are normal uses of the extension's core blocking feature.

The extension did this

The extension sends the domain name and a permanent tracking ID to PostHog, a third-party analytics company.

The ID is generated once on install and reused for every future analytics event, including these blocking events.

What's included when you block or visit a blocked site
  • Your tracking ID
    a43fe28c-c006-4704-a12a-8fb72ac36130

    A random ID created once and reused forever, so PostHog can group all of your blocking activity under one identity.

  • Domain you blocked or visited
    reddit.com

    The actual site name you're managing with the extension, the site you're trying to avoid.

  • Blocking mode
    always_on

    Whether the block is always active or only active on a schedule.

  • Extension version
    1.1.23

    The installed version number, sent with every event.

Captured request
POSThttps://eu.i.posthog.com/capture/

PostHog capture endpoint accepts the event; the extension does not inspect the response.

Headers
Content-Type
application/json
Body
{  "api_key": "phc_Om0oybqBi8GAuB2YahIkv7BsxdaOZcBMsSTEFxrd22l",  "event": "domain_added",  "properties": {    "distinct_id": "a43fe28c-c006-4704-a12a-8fb72ac36130",    "extension_version": "1.1.23",    "environment": "production",    "domain_count": 1,    "source": "manual",    "domain": "reddit.com"  },  "timestamp": "2026-08-15T21:04:12.441Z"}
The code that does this

The analytics ID is created once and attached to every capture call

Readable version

Distinct ID: read-or-create

const ANALYTICS_ID_KEY = "intentionalAnalyticsDistinctId";let cachedIdPromise = null;async function getOrCreateDistinctId() {  return cachedIdPromise || (cachedIdPromise = new Promise((resolve) => {    chrome.storage.local.get([ANALYTICS_ID_KEY], (stored) => {      const existing = stored[ANALYTICS_ID_KEY];      if (typeof existing === "string" && existing.length > 0) {        resolve(existing);        return;      }      const newId = crypto.randomUUID();      chrome.storage.local.set({ [ANALYTICS_ID_KEY]: newId }, () => resolve(newId));    });  }), cachedIdPromise);}

PostHog capture call

async function sendAnalyticsEvent(eventName, properties = {}) {  if (!eventName) return;  try {    const distinctId = await getOrCreateDistinctId();    const payload = {      api_key: POSTHOG_API_KEY,      event: eventName,      properties: {        distinct_id: distinctId,        extension_version: chrome.runtime.getManifest().version,        environment: "production",        ...stripUndefinedValues(properties),      },      timestamp: new Date().toISOString(),    };    await fetch(`${POSTHOG_HOST}/capture/`, {      method: "POST",      headers: { "Content-Type": "application/json" },      body: JSON.stringify(payload),    });  } catch (err) {    console.debug("PostHog capture failed:", err);  }}
Where blocking activity is sent
    • eu.i.posthog.com

    Receives the persistent distinct_id, event name, and properties (blocked domain, blocking mode). PostHog is a third-party analytics vendor; this is its EU ingestion endpoint.

Where it sends data

Destinations our analysis observed Intentional – Website Blocker & Focus App contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • eu.i.posthog.com

    Intentional – Website Blocker & Focus App sends data to eu.i.posthog.com. 12 other extensions we have analysed send data here.

Updated 30 September 2026aapcigpegmhncjofolnjdibbimmegdpo