Is Smart Auto Refresh safe?
Smart Auto Refresh is medium risk. Smart Auto Refresh contacts a geolocation service on every load, without notice, sending your IP and getting back country, city, and postal code. Unrelated to its refresh function. Cached in synced storage, following you across devices.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Auto Refresh Extension Fetches IP Geolocation on Every Startup
Smart Auto Refresh contacts a geolocation service on every load, without notice, sending your IP and getting back country, city, and postal code.
Unrelated to its refresh function.
Cached in synced storage, following you across devices.
What actually happens
You install or launch your browser with Smart Auto Refresh enabled.
No further interaction is required, the data collection happens before any page-refresh functionality is used.
The extension sends your IP address to ip-api.com and stores the returned country, city, and postal code in synced browser storage.
The fetch runs on every cold start until a cached result is present in chrome.storage.sync.
Captured request
Returns JSON: {"status":"success","country":"United Kingdom","countryCode":"GB","city":"Hove","zip":"BN3","lat":50.8371,"lon":-0.1683,"isp":"BT","org":"British Telecom","query":"86.188.x.x"}
The code that does this
Geolocation fetch, service worker startup (bg.js:149-167)
// IIFE runs immediately on service worker startup !(async function () { if (locationCache) return locationCache; // Return cached value if already stored let cached = await storageGet('location_data'); if (cached) return (locationCache = cached); // Fetch geolocation from third-party service — discloses user IP let response = await fetch('http://ip-api.com/json'); if (response) { try { response = await response.json(); } catch (e) { return; } // Store country, city, zip in synced storage country = response.countryCode; city = response.city; zip = response.zip; if (country) { storageSet({ location_data: (locationCache = { country, city, zip }) }); } } })();Data stored in chrome.storage.sync after fetch
- Country codeGB
The country your IP address resolves to, derived by ip-api.com.
- CityHove
The city associated with your IP address.
- Postal codeBN3
The postal code associated with your IP address, can narrow your location to a neighbourhood.
External host receiving user IP
- ip-api.com
Third-party IP geolocation API. Receives the user's public IP address on every cold start and returns approximate location data. Not affiliated with the extension developer.
Why the plaintext HTTP channel matters
The request uses plain HTTP (not HTTPS), meaning the query and response are visible to any network observer between the browser and ip-api.com. The extension's use of chrome.storage.sync also means the cached location result propagates to all other devices signed into the same Chrome profile.
What it can do
Permissions this extension asks for, as declared in version 2.1.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
See the address and title of every tab you have open
tabs
Run its own code inside the pages you visit
scripting