Is StayFree safe?

Question

Is StayFree safe?

Accepted Answer

StayFree is high risk. Our dynamic analysis observed two GET requests to api.stayfreeapps.com — one to /v1/remote_config/stayfree-chrome and one to /v1/remote_config/shared-web-config — fire within one second of the extension loading, before any user interaction. The responses control which AI chat services the extension monitors, which ad-detection patterns it uses, which sites are excluded from usage tracking, and whether URL query parameter collection is enabled. Because all of these settings are fetched from a remote server, the extension's data-collection behavior can be changed at any time without a Chrome Web Store update. Our dynamic analysis confirmed this behavior using a canary search term. After navigating to amazon.com (/s?k=BIRD_12345_canary) and google.com (/search?q=BIRD_12345_canary), the extension sent a POST request to api.stayfreeapps.com/v1/query_params/upload approximately five minutes later. The request body contained the canary string plus query parameters from every other site visited during the session (Amazon, Google, Reddit, YouTube). The extension collects URL query strings from every navigation except a fixed list of excluded domains (mail.google.com, webmd.com, mayoclinic.com, gist.github.com, and a few others), batches them in local storage, and uploads in bulk every five minutes. A partial redaction step removes recognized patterns like email addresses, phone numbers, and SSNs, but short arbitrary values — search queries, OAuth state tokens, session identifiers — are transmitted as-is.

Is StayFree - Website Blocker, Web Usage Stats, Shorts Blocker safe?

Findings