Is Netflix Party is now Teleparty safe?

// In the We() event handler, after computing the active tab and current user state:const userBlock = {  id:          auth.currentUser?.uid ?? permId,  email:       auth.currentUser?.email,         // present only if signed in  name:        settings.userNickname,  signed_in:   isSignedIn,  plan:        plan,                             // 'free' | 'premium_monthly' | 'premium_annual'  on_trial:    onTrial,  firebase_id: auth.currentUser?.uid,  perm_id:     permId,                           // persistent install ID — see claim #2121  uuid:        appUuid};event = this.Ms(pageBlock, event, userBlock, permId);// Mirror to PostHog with the URL and title added explicitly:try {  const phEvent = Object.assign({}, event);  phEvent.extension_version = MANIFEST_VERSION;  phEvent.browser           = 'chrome';  phEvent.is_prod           = true;  if (activeTab) {    phEvent.current_tab_url   = activeTab.url;    phEvent.current_tab_title = activeTab.title;  }  if (destination === Destinations.BOTH || destination === Destinations.POSTHOG) {    PostHog.sendEvent(event.name, permId, phEvent);  }} catch (_) {}

// Ms() assembles the metis event by mutating a copy of the partial event:Ms(pageBlock, partialEvent, userBlock, permId) {  const device     = this.Ls(permId);              // {name, version, type, manufacturer, model, os_name, os_version, install_id: permId}  const appSession = this.Zt.getAppSession();      // 'app-sess-...'  const tsMs       = Date.now();  const app        = { name: 'chrome_ext', version: MANIFEST_VERSION };  const event      = Object.assign({}, partialEvent);  event.app                ||= app;  event.app_session        ||= appSession;  event.device              = device;  event.client_timestamp_ms = tsMs;  if (event.page == null) event.page = pageBlock;   // pageBlock = { url: tab.url, name: tab.title }  event.user                = userBlock;  return event;}

// Gs() is the actual outbound HTTP call:async Gs(event) {  const res = await fetch('https://metis.teleparty.com/v1/record', {    method:  'PUT',    headers: { 'Content-Type': 'application/json' },    body:    JSON.stringify(event)  });  if (res.status < 200 || res.status >= 300) throw new Error(res.statusText);}

// Runs the first time the extension boots without a userId in storage.async function mintUserId() {  const browser = navigator.userAgent.toLowerCase().includes('edg') ? 'edge' : 'chrome';  console.log('browser: ' + browser);  const res    = await fetch('https://data3.netflixparty.com/create-userId?browser=' + browser);  const userId = await res.text();   // server returns a 16- or 36-char identifier as the response body  const now    = new Date();  if (isUserIdValid(userId)) {    // Persist the ID forever (until uninstall + storage wipe).    chrome.storage.local.set({      userId,      recentlyUpdated:  true,      recentlyUpdated3: true,      date:             now.toString()    }, () => console.log('Settings saved'));    // Bake the same ID into the uninstall URL so the operator learns when    // *this specific user* uninstalls.    chrome.runtime.setUninstallURL(      'https://www.teleparty.com/uninstall' +      '?userId='  + userId +      '&browser=chrome' +      '&version=' + encodeURIComponent(chrome.runtime.getManifest().version)    );  }}

// The only sanity check on the server-issued ID is its length.function isUserIdValid(s) {  return s.length === 16 || s.length === 36;}

// Runs every time the background service worker starts.function bootstrapUserId() {  try {    storage.getAllItemsAsync().then(items => {      if (items.userId && isUserIdValid(items.userId)) {        // Refresh the uninstall URL with the existing ID + current version.        chrome.runtime.setUninstallURL(          'https://www.teleparty.com/uninstall' +          '?userId='  + items.userId +          '&browser=chrome' +          '&version=' + encodeURIComponent(MANIFEST_VERSION)        );      } else {        console.log('userId undefined/invalid in local storage -> now setting');        mintUserId();   // re-mint via /create-userId      }    });  } catch (_) {}}

// Older code-path: PUT a {userId, eventType, sessionId} record.async function logEvent(t) {  try {    const body = {      userId:    await this.getUserId(),   // returns the persistent permId      eventType: t.eventType,      sessionId: t.sessionId    };    console.log('event: ' + JSON.stringify(body));    await fetch('https://data3.netflixparty.com/log-event', {      method:  'PUT',      headers: { 'Content-Type': 'application/json' },      body:    JSON.stringify(body)    });  } catch (e) {    console.log('log event error : ' + e);  }}

// A/B test bucketing keyed on the same persistent identifier.async function logExperiment(t) {  try {    const body = {      permId:  await this.getUserId(),      event:   t.eventType,      name:    t.experimentName,      version: t.experimentVersion    };    console.log('event: ' + JSON.stringify(body));    await fetch('https://data3.netflixparty.com/log-experiment', {      method:  'POST',      headers: { 'Content-Type': 'application/json' },      body:    JSON.stringify(body)    });  } catch (e) {    console.log('log exp error : ' + e);  }}