Is StayFree - Website Blocker, Web Usage Stats, Shorts Blocker safe?

// Constant for the shared remote config endpoint
const SHARED_CONFIG_URL = 'https://api.stayfreeapps.com/v1/remote_config/shared-web-config';

// Sets up a config fetcher that:
//   1. GETs both SHARED_CONFIG_URL and the stayfree-chrome URL on startup
//   2. Persists the last-fetched time and response to chrome.storage
//   3. Re-fetches on @alarm/update-remote-config alarm
function createRemoteConfigClient({ storage, urls, defaultConfig }) {
  const fetcher = createConfigFetcher({
    urls: [SHARED_CONFIG_URL, ...urls],
    defaultConfig,
    persistConfig: (cfg) => storage.setItem('remote-config', cfg),
    persistLastFetchedTime: (t) => storage.setItem('remote-config-last-fetched-at', t),
    restoreConfig: async () => (await storage.getItem('remote-config')) ?? undefined,
    restoreLastFetchedTime: async () => (await storage.getItem('remote-config-last-fetched-at')) ?? undefined,
  });
  return {
    fetchLatest: fetcher.fetchLatest,
    addChangeListener: fetcher.addChangeListener,
    getLastFetchedTime: () => fetcher.lastFetchedTime,
    getValue: () => fetcher.value,
  };
}

// Second remote config endpoint — controls genAiParsers, chatbotSelectors,
// adNetworks, pageViewIgnoreList, uploadWebUsage, sampleIntegerPercent.
const STAYFREE_CHROME_CONFIG_URL = 'https://api.stayfreeapps.com/v1/remote_config/stayfree-chrome';

// Registers on every navigation completion.
// Skips: disabled by remote config, URLs with no query string, domains in pageViewIgnoreList.
// Applies partial PII redaction (_C) before storing.
function setupQueryParamCollector({ api, appId, installId, enabled, urlIgnorelist, storageKey, uploadInterval, countryCode }) {
  // Schedule periodic batch upload every 5 minutes
  scheduleUploadAlarm(storageKey, uploadInterval, api.uploadQueryParams);

  chrome.webNavigation.onCompleted.addListener(async (navEvent) => {
    try {
      if (!await enabled()) return;          // gated by remote config uploadWebUsage flag

      const parsed = parseUrl(navEvent.url);
      if (!parsed) return;

      const { hostname, path } = parsed;
      const url = new URL(navEvent.url);
      const fullPath = `${hostname}${path}`;

      // Skip domains in pageViewIgnoreList (e.g. mail.google.com, webmd.com)
      if (urlIgnorelist.some(pattern => matchGlob(fullPath, pattern))) return;

      const timestamp = Math.round(Date.now() / 1000);
      const rawParams = Object.fromEntries(url.searchParams.entries());

      // Apply partial PII redaction — strips emails, phone numbers, SSNs,
      // person names, social media mentions, and URLs.
      // Short values like search terms or OAuth codes pass through.
      const queryParams = Object.entries(rawParams).map(([name, value]) => ({
        name,
        value: redactPii(value),
        timestamp,
      }));

      if (queryParams.length === 0) return;

      const batch = { appId, installId, countryCode, websites: { [hostname]: { [path]: { query_params: queryParams } } } };
      await appendToLocalStorage(storageKey, batch);
    } catch (err) {
      console.error('Error storing query params:', err);
    }
  });
}

// Called by the 5-minute alarm. Reads the batch from storage and POSTs it.
async function uploadQueryParams({ appId, installId, countryCode, websites }) {
  const body = {
    app_id: appId,
    install_id: installId,
    time_zone: getTimezone(),       // e.g. 'America/New_York'
    country_code: countryCode,
    websites: websites,             // { hostname: { path: { query_params: [...] } } }
  };
  await apiClient.post('/v1/query_params/upload', { method: 'POST', retry: 0, body });
}

setupMessageListeners() {
  if (Ca.storage == null) throw Error("The storage permission is required for pathmatics' ad-finder");
  this.messenger.onMessage(jF, async e => {
    const i = await dF(await this.sendMessageToBackground({
      type: "ads#FETCH_HTTP_RESPONSE",
      payload: e
    }));
    return {
      response: i,
      transferables: [i]
    }
  }), $g() && (this.messenger.onMessage(AF, async () => ({
    response: await this.config.getInstallId()
  })), this.messenger.onMessage(zF, async e => {
    const i = el(e);
    if (i == null) return;
    const a = i.crawlId;
    let n = i.zys ?? [];
    if (typeof n == "string" && (n = el(n)), n == null) return;
    const s = Date.now();
    for (const r of n) {
      const o = {
        id: `${a}-${r.hash}`,
        type: "pathmatics",
        timestamp: s,
        details: r
      };
      this.config.logger?.log("Ad detected", o);
      try {
        await this.config.onAdDetected?.(o)
      } catch (l) {
        this.config.logger?.error("onAdDetected failed", {
          err: l
        })
      }
    }
    await this.sendMessageToBackground({
      type: "ads#CRAWL",
      payload: i
    }).catch(this.config.logger?.error)
  }), this.messenger.onMessage(TF, async () => ({
    response: await _g(this.sendMessageToBackground)
  })))
}

async upload(e) {
  if (!await this.config.isEnabled()) return;
  const t = this.prepareData(e);
  this.config.logger?.log("Uploading data:", t);
  const a = await this.fetch(this.config.crawlUploadUrl, {
    method: "POST",
    body: T2.compressToUint8Array(JSON.stringify(t)),
    headers: {
      "Content-Type": "application/octet-stream"
    }
  }).then(i => this.config.logger?.log({
    status: i.status
  })).catch(this.config.logger?.error);
  this.config.logger?.log("Response:", a)
}
prepareData(e) {
  return {
    ...e,
    PartnerVersion: Ke.runtime.getManifest().version,
    ExtensionId: Ke.runtime.id,
    ExtensionVersion: this.config.extensionVersion,
    UserAgent: navigator.userAgent,
    BrowserLanguage: navigator.language,
    BlankZys: null,
    PanelPartnerId: this.config.panelPartnerId
  }
}

function HR(e) {
  const t = SR(e),
    a = new xR(t);
  x2(n => {
    const r = s => {
      throw t.logger?.error("Error handling message from ad-finder: " + JSON.stringify(n), s), s
    };
    switch (n.type) {
      case "ads#CRAWL":
        return a.upload(n.payload).catch(r);
      case "ads#GET_EXTERNAL_CONFIGURATION":
        return Promise.resolve(e.getInstallId()).then(s => $R(`${e.pmExternalConfigUrl}?installId=${s}`)).catch(r);
      case "ads#FETCH_HTTP_RESPONSE":
        return fetch(n.payload).then(s => {
          const o = parseInt(s.headers.get("Content-Length") ?? "");
          return !isNaN(o) && o > 1 << 25 ? new ArrayBuffer(0) : s.arrayBuffer()
        }).then(s => s.byteLength > 1 << 25 ? D2(new ArrayBuffer(0)) : D2(s));
      default:
        return Ju
    }
  }, t.logger)
}