Is Taho safe?
Taho is medium risk. Taho sends PostHog analytics after onboarding, including Analytics Toggled and Chain Added events keyed to a persistent UUID. The shipped SW enables analytics by default on first run and sends dApp connection events with the site's origin.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Taho sends wallet analytics to PostHog by default
Taho sends PostHog analytics after onboarding, including Analytics Toggled and Chain Added events keyed to a persistent UUID.
The shipped SW enables analytics by default on first run and sends dApp connection events with the site's origin.
You install and start using the wallet extension.
Connecting a dApp or adding a chain creates wallet activity for the background service.
The extension sends analytics events to PostHog with a persistent identifier.
The source shows dApp connection events include the connected site's origin and chain ID.
| Field | Value | Why it matters | |
|---|---|---|---|
Persistent analytics ID | 8ef5023a-6f40-4d3a-bf0f-2ef8f2d91fb9 (illustrative; observed value began 8ef5023a) | Lets the analytics service link multiple wallet events from the same browser profile over time. | |
Event name | Chain Added | Shows what wallet action happened, such as toggling analytics or adding a chain. | |
Connected dApp origin | https://app.uniswap.org (illustrative dApp origin) | Shows which web application your wallet connection was granted to. | |
Chain ID | 1 | Shows which blockchain network the wallet action was associated with. | |
PostHog project key | phc_<redacted> | Routes the analytics event into Taho's PostHog project. |
| Accept | application/json |
| Content-Type | application/json |
The service worker enables analytics, builds the payload, and emits dApp connection events
function shouldSendPosthogEvents() {
return !!"phc_<redacted>";
}
function createPosthogPayload(personUUID, eventName, payload) {
return JSON.stringify({
uuid: esm_browser_v4(),
distinct_id: personUUID,
api_key: "phc_<redacted>",
event: eventName,
timestamp: (new Date).toISOString(),
properties: {
$lib: USE_ANALYTICS_SOURCE,
$current_url: typeof window !== "undefined" ? window.location.href : "service-worker",
...payload
}
});
}
function sendPosthogEvent(personUUID, eventName, payload) {
try {
if (shouldSendPosthogEvents()) {
fetch(POSTHOG_URL, {
method: "POST",
body: createPosthogPayload(personUUID, eventName, payload),
headers: {
"Content-Type": "application/json",
Accept: "application/json"
}
});
}
} catch (e) {
lib_logger.debug("Sending analytics event failed with error: ", e);
}
}async internalStartService() {
await super.internalStartService();
const {uuid, isNew} = await this.getOrCreateAnalyticsUUID();
let {isEnabled, hasDefaultOnBeenTurnedOn} = await this.preferenceService.getAnalyticsPreferences();
if (!hasDefaultOnBeenTurnedOn) {
isEnabled = true;
hasDefaultOnBeenTurnedOn = true;
await this.preferenceService.updateAnalyticsPreferences({
isEnabled,
hasDefaultOnBeenTurnedOn
});
await this.emitter.emit("enableDefaultOn", undefined);
}
if (isEnabled) {
browser_polyfill_default().runtime.setUninstallURL(false ? 0 : `${"https://taho.xyz"}/goodbye?uuid=${uuid}`);
if (isNew) {
await this.sendAnalyticsEvent(AnalyticsEvent.NEW_INSTALL);
}
}
this.#analyticsUUID = uuid;
}dapp_emitter.on("grantPermission", (async permission => {
this.analyticsService.sendAnalyticsEvent(AnalyticsEvent.DAPP_CONNECTED, {
origin: permission.origin,
chainId: permission.chainID
});
await Promise.all(this.chainService.supportedNetworks.map((async network => {
await this.providerBridgeService.grantPermission({
...permission,
chainID: network.chainID
});
})));
}));- app.posthog.com
Receives wallet analytics capture events for Taho's PostHog project.
- taho.xyz
Receives the uninstall URL callback with the persistent analytics UUID when Chrome opens the uninstall survey URL.