Is Lolli: Earn Bitcoin and Cash Back safe?
Lolli sends the hostname of every site you visit to its own servers to check for a cashback match.
On every tab navigation and tab switch, Lolli looks up the domain against api.lolli.com to see if it's a known cashback merchant, regardless of whether the site is a shopping site. It also fetches a coarse country code from the same API. Separately, the extension decides whether to show its cashback popup using unauthenticated signals from the page itself (window objects, CSS classes/IDs, cookie names) meant to detect competing cashback extensions, which a site's own script could set without a real competitor being present.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Lolli contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.lolli.com
Lolli sends data to api.lolli.com. No other extension we have analyzed sends data here.