Is Smart Auto Refresh safe?
Smart Auto Refresh is medium risk. Smart Auto Refresh contacts a geolocation service on every load, without notice, sending your IP and getting back country, city, and postal code. Unrelated to its refresh function. Cached in synced storage, following you across devices.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Auto Refresh Extension Fetches IP Geolocation on Every Startup
Smart Auto Refresh contacts a geolocation service on every load, without notice, sending your IP and getting back country, city, and postal code.
Unrelated to its refresh function.
Cached in synced storage, following you across devices.
You install or launch your browser with Smart Auto Refresh enabled.
No further interaction is required, the data collection happens before any page-refresh functionality is used.
The extension sends your IP address to ip-api.com and stores the returned country, city, and postal code in synced browser storage.
The fetch runs on every cold start until a cached result is present in chrome.storage.sync.
Geolocation fetch, service worker startup (bg.js:149-167)
// IIFE runs immediately on service worker startup !(async function () { if (locationCache) return locationCache; // Return cached value if already stored let cached = await storageGet('location_data'); if (cached) return (locationCache = cached); // Fetch geolocation from third-party service — discloses user IP let response = await fetch('http://ip-api.com/json'); if (response) { try { response = await response.json(); } catch (e) { return; } // Store country, city, zip in synced storage country = response.countryCode; city = response.city; zip = response.zip; if (country) { storageSet({ location_data: (locationCache = { country, city, zip }) }); } } })();| Field | Value | Why it matters | |
|---|---|---|---|
Country code | GB | The country your IP address resolves to, derived by ip-api.com. | |
City | Hove | The city associated with your IP address. | |
Postal code | BN3 | The postal code associated with your IP address, can narrow your location to a neighbourhood. |
- ip-api.com
Third-party IP geolocation API. Receives the user's public IP address on every cold start and returns approximate location data. Not affiliated with the extension developer.
The request uses plain HTTP (not HTTPS), meaning the query and response are visible to any network observer between the browser and ip-api.com. The extension's use of chrome.storage.sync also means the cached location result propagates to all other devices signed into the same Chrome profile.