Is Tada Extension safe?

Medium risk

Tada Extension sends order history and merchant-page URLs to an AWS Firehose stream while you shop.

On supported shopping sites, while you are logged in and have not opted out, the extension reads order IDs, totals, dates, payment type, store address and product details from the page and uploads them with your member ID. It also batches the URLs you visit on flagged merchant sites, and once a week sends the IDs of your other enabled extensions to the vendor's API. Which pages are collected is controlled by configuration fetched from the vendor's servers.

v400.12.5.3845Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Tada Extension sends order history and cart data from 84 shops to AWS Firehose

Code analysis shows Tada reads order, cart and product fields from shop pages and sends them to an AWS Firehose stream, unless the member opts out.

Which pages run is set by remote JSON.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open an order history, cart or checkout page on a configured shop while logged in to Tada.

For example amazon.com/gp/your-account/order-history.

The extension did this

The extension injects a page reader and sends the order and product details it finds to an AWS Firehose stream.

Records are tagged with your member ID and the extension ID.

Fields the merchant selector configs read from shop pages
  • Order ID
    111-2938475-1029384

    Ties the record to a specific purchase you made at the shop.

  • Order total
    $84.17

    How much you spent on the order or in your cart.

  • Order date
    2026-08-14

    When you bought something.

  • Payment type
    Visa

    The payment method type shown on the order page.

  • Store name, address and zip
    Target Store, 1200 Main St, 94105

    The location of in-store pickups or purchases.

  • Product name, SKU, UPC
    Oral-B Pro 1000, UPC 069055862815

    Exactly which products you bought or carted.

  • Price, quantity, seller
    $49.99, qty 1, Amazon.com

    Per-item price, how many, and who sold it.

  • Member ID and extension ID
    memberId 48210937

    Added to each record so it can be linked to your Tada account.

The code that does this

Injection of the data-insights factory and the Firehose write

Readable version

Inject factory into the shop tab

worker/service-worker.js
// Injects the bundled scraper, then runs it with the selected merchant page config// (selectors for orderID, cartTotal, storeAddress, sku, upc, ...).var factoryFileLocation = "worker/extension-data-insights/data-insights-factory.js";await contentInjectionSvc.injectScriptFile(siteData.tab.tabId, factoryFileLocation);var diResult = new window.Prdg.DataInsightsFactory();diResult.runDataInsightsWhenReady(siteData, selectedMerchantPageConfig, 'coreonSiteDetected', client, consoleLevel, selectedMerchantConfig);

Opt-out gate

worker/service-worker.js
// Collection is on whenever the member is logged in and has not opted out.isEnabled = isLoggedIn && !isDataCollectionOptOut;

Firehose PutRecord

worker/service-worker.js
// Record type is ext.products.prepurchase / postpurchase / orderhistory.const record = JSON.stringify(new FirehoseData(typeName, datamap));await firehoseClient.send(new PutRecordCommand({    DeliveryStreamName: this.deliveryStream,    Record: { Data: Buffer.from(record) }}));
Hosts involved in configuring and receiving the data
    • ucontent.prdg.io

    Serves data-insights-all-merchants.min.json, which sets which pages and selectors run.

    • api.tada.com

    Returns the Firehose stream name, region and temporary AWS credentials.

    • firehose.<region>.amazonaws.com

    Receives the PutRecord calls carrying order and product data.

What this analysis does not show

No traffic was captured; this comes from the code. Collection depends on a remote flag, per-site settings and the opt-out preference. Tada is a rewards program, so this may be a disclosed term; no consent text was found.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Tada Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ucontent.prdg.io

    Tada Extension sends data to ucontent.prdg.io. 5 other extensions we have analysed send data here.

  • api.tada.com

    Tada Extension sends data to api.tada.com. 2 other extensions we have analysed send data here.

  • AWS Kinesis Firehose

    Tada Extension sends data to AWS Kinesis Firehose. Named as a recipient in this extension's own analysis.

Updated 15 October 2026dlmebkoiahbppacaicbgncnjhbpdfkcc