Is Joko | Cash back & promo codes safe?

Clean risk

Joko transmits full merchant page URLs and shopping events with persistent user and device IDs to its servers and Amplitude.

When you visit a supported shopping site, Joko records the full page URL, your account ID, device ID, and session ID and transmits them to its AWS ingest endpoint. It also captures shopping actions such as offer activations, affiliate link clicks, and coupon applications and forwards those events to Amplitude. On sites where coupon automation is enabled, Joko injects a script that intercepts Authorization header values from the page's own network requests and stores them locally for use in coupon-application API calls.

Jokov2.1.84Firefox Add-ons
3Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 2.1.84. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on www.facebook.com

    https://www.facebook.com/v4.0/dialog/oauth*

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Watch every request your browser makes

    webRequest

Where it sends data

Destinations our analysis observed Joko | Cash back & promo codes contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.amplitude.com

    Joko | Cash back & promo codes sends data to api.amplitude.com. 13 other extensions we have analyzed send data here.

  • 5lcadbj7za.execute-api.eu-west-1.amazonaws.com

    Joko | Cash back & promo codes sends data to 5lcadbj7za.execute-api.eu-west-1.amazonaws.com. No other extension we have analyzed sends data here.

Updated 2 November 2026amo-2697235