Is Substital safe?

Substital embeds the GiveFreely affiliate SDK and sends device and user IDs to GiveFreely when its popup opens on merchant sites.

When the Substital popup opens, it injects the bundled GiveFreely adunit SDK (v1.17.6) into the active tab. The SDK checks whether the current page is a registered affiliate merchant and fires analytics events — including a persistent device ID and a GiveFreely user ID — to a remote events endpoint. The extension also includes a hardcoded OpenSubtitles API key in its bundle and broadcasts the currently-playing Netflix video title via a wildcard postMessage.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.