Is SignUp - Sign Language for Netflix & Disney+ safe?

Medium risk

SignUp sends streaming page URLs and titles with a persistent analytics ID to its backend and Google Analytics.

On Netflix, Disney+, Peacock, Hotstar, and YouTube pages, SignUp reports the page title and full page URL when its content script starts. The background script uses a stored client ID, requests coarse location from ipinfo.io, then posts analytics events to backend.aslcaptioning.com and Google Analytics.

v2.8.6Chrome Web Store
45Risk
Who publishes it

No other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Website
www.signupcaptions.com/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

The extension reports every streaming page you load to a persistent tracking ID

On every Netflix, Disney+, Hotstar, Peacock, or YouTube page load, the extension sends the page title, full URL, and a persistent client ID to two analytics services.

We captured this with coarse IP-location attached.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a supported streaming page.

youtube.com, netflix.com, disneyplus.com, peacocktv.com, or hotstar.com finishes loading with the extension active.

The extension did this

The extension reports the page and a tracking ID to two analytics services.

The content script sends your page title and URL to the background, which attaches a persistent client ID and your coarse location.

Captured request
POSThttps://backend.aslcaptioning.com:3710/analytics

Observed during dynamic analysis: request fired immediately after the test page finished loading.

Body
{  "source": "extension",  "events": [    {      "name": "page_view",      "params": {        "page_title": "Rick Astley - Never Gonna Give You Up (Official Video) (4K Remaster) - YouTube",        "page_location": "https://www.youtube.com/watch?v=dQw4w9WgXcQ"      }    },    {      "name": "location_tracking",      "params": {        "region": "England",        "country": "GB"      }    }  ]}
Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-CC5YLYEDM4&api_secret=<redacted>
Body
{  "client_id": "1c30c500-59aa-48a6-81eb-04e8f440c9f0",  "events": [    {      "name": "page_view",      "params": {        "page_title": "Rick Astley - Never Gonna Give You Up (Official Video) (4K Remaster) - YouTube",        "page_location": "https://www.youtube.com/watch?v=dQw4w9WgXcQ"      }    },    {      "name": "location_tracking",      "params": {        "region": "England",        "country": "GB"      }    }  ]}
What each page view sends
  • Page title
    Rick Astley - Never Gonna Give You Up (Official Video) (4K Remaster) - YouTube

    The exact title of the page you were viewing.

  • Page URL
    https://www.youtube.com/watch?v=dQw4w9WgXcQ

    The full address of the page, including any video ID or search terms it contains.

  • Client ID
    1c30c500-59aa-48a6-81eb-04e8f440c9f0

    A random ID created once and reused forever, so every visit ties back to the same install.

  • Coarse location
    England, GB

    Your region and country, looked up from your IP address via a third-party service.

The code that does this

The automatic page_view call

Readable version

Same call, readable

contentScript.bundle.js
chrome.runtime.sendMessage({  type: "sendAnalyticsEvent",  name: "page_view",  extra: {    page_title: document.title,    page_location: document.location.href  }}).then(() => {  console.log("page_view event tracked");});

background.bundle.js: client ID + dual dispatch

background.bundle.js
const GA_URL = "https://www.google-analytics.com/mp/collect";const BACKEND_URL = "https://backend.aslcaptioning.com:3710";async function getClientId() {  let id = (await chrome.storage.local.get("clientId")).clientId;  if (!id) {    id = self.crypto.randomUUID();    await chrome.storage.local.set({ clientId: id });  }  return id;}// events array (h) built from the page_view + location_tracking events,// then POSTed to both endpoints with the same payload shape.fetch(new URL("/analytics", BACKEND_URL).toString(), {  method: "POST",  body: JSON.stringify({ source: "extension", events: h })});fetch(`${GA_URL}?measurement_id=${measurementId}&api_secret=${apiSecret}`, {  method: "POST",  body: JSON.stringify({ client_id: await getClientId(), events: h })});
Where the data ends up
    • backend.aslcaptioning.com

    The extension's own analytics backend; receives your page title, URL, and client ID on every supported page.

    • www.google-analytics.com

    Google Analytics Measurement Protocol collection endpoint; receives the same page data under a GA4 property.

    • ipinfo.io

    Third-party IP geolocation lookup; returns your region and country, which is then forwarded in the analytics event.

Where it sends data

Destinations our analysis observed SignUp - Sign Language for Netflix & Disney+ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    SignUp - Sign Language for Netflix & Disney+ sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • ipinfo.iowidely used

    SignUp - Sign Language for Netflix & Disney+ sends data to ipinfo.io. A widely used service: 45 other extensions we have analysed send data here.

  • backend.aslcaptioning.com

    SignUp - Sign Language for Netflix & Disney+ sends data to backend.aslcaptioning.com. No other extension we have analysed sends data here.

Updated 30 September 2026gbllbjbhbafgdcolenjhdoabdjjbjoom