Is Treatstream safe?
Treatstream reads your delivery address from food-ordering sites like GrubHub and sends it with a session token to treatstream.com.
On supported food-delivery sites the content script scrapes the delivery address shown on the page and POSTs it, along with a Treatstream session token, to treatstream.com/addtreat/chkAddress. The list of sites it acts on is fetched remotely from treatstream.com/addtreat/getSetting and applied verbatim, so the active-site set can be changed from the server. On GrubHub it also reads OAuth/session cookies and intercepts restaurant API request URLs that embed your location coordinates, and it runs DevTools-detection routines on each supported page.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itTreatStream GP - no other listings under this identity, 13 shared hostnames
TreatStream GP - no other listings under this identity, 13 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 13 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Treatstream contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- treatstream.com
Treatstream sends data to treatstream.com. No other extension we have analysed sends data here.