Is Picodi.com Cashback safe?

Medium risk

Picodi is medium risk. Picodi.com Cashback sends Picometric telemetry on coupon-assist events: page URL in uri_str, event details in data, install ID in iid. An earlier traffic run missed this beacon since auto-apply needed a logged-in checkout with cart items.…

Picodiv7.5.13Chrome Web Store
55Risk
Who publishes it

Picodi.com SA - no other listings under this identity, 4 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Picodi
Declared legal entity
Picodi.com SA
Registered address
Przemyslowa 12, Kraków 30-701, PL
Registered contact
Bartlomiej Tyranowski

Shared hosts - 4 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

cdn.picodi.com
Also called by 1 other listing: Picodi.com Cashback
metric.picodi.com
Also called by 1 other listing: Picodi.com Cashback
my.picodi.com
Also called by 1 other listing: Picodi.com Cashback
picodi.com
Also called by 1 other listing: Picodi.com Cashback

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Picodi sends coupon-page URLs to Picometric

Picodi.com Cashback sends Picometric telemetry on coupon-assist events: page URL in uri_str, event details in data, install ID in iid.

An earlier traffic run missed this beacon since auto-apply needed a logged-in checkout with cart items.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You start or view Picodi's coupon auto-apply flow on a shopping page.

The extension did this

The extension sends Picometric telemetry that includes the page address and a persistent installation ID.

Picometric request fields
  • Current page URL
    https://www.asos.com/checkout (illustrative)

    Shows the shopping or checkout page active when coupon assistance runs.

  • Coupon event label
    CAA_START

    Shows which coupon-assist step happened, such as starting, showing, succeeding, or failing.

  • Coupon event data
    {"shopUrlName":"asos","numberOfCoupons":3} (illustrative)

    Adds shop-specific coupon context to the page event.

  • Installation ID
    847362915

    Lets the telemetry provider connect coupon events from the same browser installation over time.

Captured request
GEThttps://metric.picodi.com/us/t

No live response captured in the traffic pass; endpoint and method come from the shipped code path.

Headers
Content-Type
application/json
The code that does this

Coupon events forward the current page to Picometric

Readable version

CAA start event with page URL

content.js
e.prototype.onTestButtonClick = function() {  this.$emit("toggle-popup"), this.$emit("set-modal-type", "PROGRESS"), this.couponApplier.caaStart(), this.couponApplier.caaAnalyticsHelper.sendAnalytics("START"), this.couponApplier.picometricHelper.pushEvent(this.locale, "CAA_START", JSON.stringify({    shopUrlName: this.shopUrlName,    numberOfCoupons: this.numberOfCoupons  }), window.location.href), this.sendGaEvent(), this.createRedirectPinTab()}

Picometric helper forwards the URL field

content.js
const ci = new(function() {  function t() {}  return t.prototype.pushEvent = function(t, e, i, n) {    M.send((function(r) {      r.setType(tt.PICOMETRIC_PUSH_EVENT).setAsync(!0).setValue("locale", t).setValue("event", "c").setValue("label", e).setValue("data", i).setValue("uri_str", n)    }))  }, t}());

Background sender builds the Picometric GET request

background.js
const Yt = function() {  function t(t) {    this.installationId = t  }  return t.prototype.getUrl = function() {    return "".concat("https://metric.picodi.com/").concat(this.locale, "/t")  }, t.prototype.getHeader = function() {    return {      "Content-Type": "application/json"    }  }, t.prototype.setLocale = function(t) {    this.locale = t  }, t.prototype.send = function(t, e, r, o) {    return $t(this, void 0, Promise, (function() {      var i, a = this;      return qt(this, (function(u) {        return i = this.getUrl(), [2, new Promise((function(u, s) {          var c = new n;          fetch(i + "?" + new URLSearchParams({            event: t,            label: e,            data: r,            uri_str: o,            iid: a.installationId.toString()          }), {            method: "GET",            headers: a.getHeader()          }).then((function(t) {            c.setResponse(t), u(c)          })).catch((function(t) {            c.setError(t), s(c)          }))        }))]      }))    }))  }, t}();
External host receiving the coupon-page telemetry
    • metric.picodi.com

    Picodi Picometric telemetry endpoint receiving coupon event label, event data, current page URL, and installation ID.

Install Beacon Transmits Browser Fingerprint to Picodi API

The first Picodi Cashback run after install sends a beacon with your user-agent, platform, language, install date, and a random persistent ID.

It fires once, can't be disabled; user-agent and platform act as fingerprint signals.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install the extension for the first time.

The extension did this

The extension immediately registers with Picodi's API, transmitting your browser's user-agent, platform, and language alongside a freshly minted persistent device ID.

This registration is unconditional and automatic. There is no opt-out. The beacon fires before you visit any shopping site.

Captured request
GEThttps://api-ec1.picodi.com/api/addon/install?installationId=e3fda999f0193&token=93a2532c03834&defaultLang=uk&browserLang=en-GB&userAgent=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7)&platform=MacIntel&installationDate=2026-06-05%2023%3A54%3A00
Fields sent in the install beacon
  • Installation ID
    e3fda999f0193

    A randomly generated 13-character string stored permanently. All future requests to Picodi's API use this value to identify your device.

  • Token
    93a2532c03834

    A second 13-character random string generated at the same time as the installation ID, sent alongside it.

  • User-agent string
    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36

    Your browser's full user-agent, revealing OS version, browser version, and device type.

  • Platform
    MacIntel

    The OS platform reported by the browser (e.g. MacIntel, Win32, Linux x86_64).

  • Browser UI language
    en-GB

    The language your browser is set to, identifying your configured locale.

  • Installation date
    2026-06-05 23:54:00

    The exact date and time the extension was first run.

  • Affiliate subsid (optional)
    af123456

    If an affiliate tracking cookie is present, its value is appended as userId, linking your install to an ad-network referral.

Where the install beacon is sent
    • api-ec1.picodi.com

    Picodi's primary API endpoint. Receives the install beacon with device fingerprint fields and registers the installationId against the device profile.

GA4 Telemetry Reports Popup Interactions and Shop Names

Each time Picodi Cashback's popup opens on a shopping site, it sends the page URL, shop name, and a persistent device identifier to Google Analytics automatically, letting Google link your activity across sessions.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You visit a shopping site and the Picodi popup appears, or you open or close it.

The extension did this

The extension sends your page URL, the shop name, and a persistent device ID to Google Analytics automatically.

This fires on every popup open, close, and page load on an activated shop page. No user interaction with the popup is required for the page_view event.

Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-8THS6RNFGK&api_secret=<redacted>
Headers
Content-Type
application/x-www-form-urlencoded
Body
{  "client_id": "e3fda999f0193",  "events": [    {      "name": "page_view",      "params": {        "country_prefix": "uk",        "page_title": "cashback_prompt",        "page_location": "/uk/cb/asos/notify",        "shop_url_name": "asos",        "test_variant": "B"      }    }  ]}
Fields sent to Google Analytics on every popup interaction
  • Device identifier (client_id)
    e3fda999f0193

    A 13-character ID generated at install and stored permanently. Links all your activity on every shopping site to the same profile at Google.

  • Shop name (shop_url_name)
    asos

    The name of the retail site you are visiting, e.g. 'asos' or 'amazon.com'.

  • Page URL (shop_url_name on open/close)
    [asos] - https://www.asos.com/women/dresses/

    On popup open and close events, the full current page URL is appended to the shop_url_name field.

  • Locale / region (country_prefix)
    uk

    Your browser's configured locale, identifying your country.

  • Session ID
    1717632000000

    A timestamp-based session identifier, rotated every 30 minutes.

Where the telemetry data is sent
    • www.google-analytics.com

    Google Analytics 4, receives popup interaction events, shop names, page URLs, and the persistent device identifier.

What it can do

Permissions this extension asks for, as declared in version 7.5.12. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 7.5.13, which we have not unpacked yet.

  • Read and change your data on every site you visit

    *://*/*

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Watch every request your browser makes

    webRequest

Updated 30 September 2026kafpjghdfockenndmdalblagbonhemkf