Louis: new product article on the stayfocusd chrome extension. covers the chrome web store listing contradiction (gen ai analytics feature alongside "does not collect personal data"), the may 2026 arnott capability disclosure with the us-centric pii filter, tuckner's december 2025 secure annex identification, and the 2020 buzzfeed disclosure of sensor tower's secret vpn and adblock app dragnet as historical publisher precedent.

2026-05-30T02:47:21Z

new product article on the stayfocusd chrome extension. covers the chrome web store listing contradiction (gen ai analytics feature alongside "does not collect personal data"), the may 2026 arnott capability disclosure with the us-centric pii filter, tuckner's december 2025 secure annex identification, and the 2020 buzzfeed disclosure of sensor tower's secret vpn and adblock app dragnet as historical publisher precedent.

New page

{{ProductCargo
|ArticleType=Product
|Category=Browser extension
|Company=Sensor Tower
|Description=Productivity Chrome extension; researcher classified it "Capability" for AI chat scraping; exfiltrates URLs with US-only PII filter
|InProduction=Yes
|Website=https://www.stayfocusd.com/
}}

'''StayFocusd''' is a productivity Chrome extension published by mobile-analytics company [[Sensor Tower]] that, as of May 15, 2026, advertises both a ''"Gen AI Analytics"'' feature tracking users' ''"usage of AI chat platforms"'' and a privacy bullet promising it ''"does not collect personal data from the web pages you visit"'' on the same Chrome Web Store listing.<ref name="cws">{{Cite web |title=StayFocusd – Website Blocker & Focus Timer & Shorts Blocker |url=https://chromewebstore.google.com/detail/stayfocusd-website-blocke/laankejkbhbdhmipfmgcngdelahlfoji |website=Chrome Web Store |publisher=Sensor Tower |date=2026-05-15 |access-date=2026-05-29}}</ref> On May 11, 2026, independent researcher James Arnott classified the extension as ''"Capability"'' on the ''AI Chat Scraper Wall of Shame'', documenting that StayFocusd exfiltrates ''"almost every URL you visit"'' for its roughly 700,000 users while shipping a remote-configured infrastructure to scrape AI chat conversations that was wired up but server-side gated during initial testing, and was then enabled.<ref name="arnott">{{Cite web |last=Arnott |first=James |title=AI Chat Scraper Wall of Shame |url=https://amibeingpwned.com/ai-chat-scraper-wall-of-shame/ |website=Am I Being Pwned |date=2026-05-11 |access-date=2026-05-29}}</ref> The Chrome Web Store has not removed the extension; it retains both the ''"Featured"'' and ''"Established Publisher"'' badges.<ref name="cws" />

== Background ==

StayFocusd is listed in the Chrome Web Store's ''Workflow & Planning'' category and is described on its listing as a tool to ''"limit the amount of time you spend on time-wasting websites."''<ref name="cws" /> The listing names six features, including a ''"Nuclear Option"'' that blocks selected sites for a fixed window and ''"cannot be canceled"'' once activated, alongside the ''"Gen AI Analytics"'' bullet quoted above.<ref name="cws" /> The extension is published by Sensor Tower with a developer address of 275 Battery St #800, San Francisco, & is version 4.5.13 as of May 15, 2026, with a footprint of 6.77 MiB & 10 supported languages.<ref name="cws" /> The Chrome Web Store displays a count of 700,000 users & 8.7K ratings averaging 4.5.<ref name="cws" />

The product's marketing site, stayfocusd.com, identifies the operator in its footer as ''"© 2026 ST Pulse, a Sensor Tower company. All rights reserved,"'' confirming the current ownership chain.<ref name="sfd">{{Cite web |title=StayFocusd |url=https://www.stayfocusd.com/ |website=stayfocusd.com |publisher=ST Pulse / Sensor Tower |date=2026 |access-date=2026-05-29}}</ref>

== Chrome Web Store listing contradiction ==

The current Chrome Web Store overview lists, within the same bulleted feature list, two statements that describe opposite behaviors. The first reads:

<blockquote>''"🤖 Gen AI Analytics: Track and analyze your usage of AI chat platforms directly from the StayFocusd."''</blockquote><ref name="cws" />

The second, several bullets later on the same page, reads:

<blockquote>''"🔒 Privacy protection: StayFocusd does not collect personal data from the web pages you visit."''</blockquote><ref name="cws" />

The listing's permission rationale, addressing the ''"Read and change all your data on the websites you visit"'' prompt that Chrome shows at install time, repeats the second framing. Sensor Tower writes that the permission is required so the extension can block sites, & makes a third privacy assurance on the same page:

<blockquote>''We will never collect personal data from the web page content that you are browsing.''</blockquote><ref name="cws" />

The listing does not reconcile this with the ''"Gen AI Analytics"'' bullet, which by its own text tracks what AI chat platforms a user visits & how they use them.

== AI Chat Scraper Wall of Shame disclosure ==

On May 11, 2026, James Arnott published the ''AI Chat Scraper Wall of Shame'' on amibeingpwned.com, a classification of browser extensions whose code paths exfiltrate browsing data or AI chat transcripts. StayFocusd appears in row 4 of his table, with 700,000 users, ownership attributed to SensorTower, a status of ''"Capability,"'' & obfuscation marked ''"LZ-String (light)."''<ref name="arnott" />

Arnott defines the ''"Capability"'' classification:

<blockquote>''"The exfiltration infrastructure is there (remote endpoint, code path, the lot) but didn't fire in our observation window. We attribute this to server-side gating."''</blockquote><ref name="arnott" />

He distinguishes this from ''"Confirmed"'' entries such as Stylish, [[Similarweb]], & WhatRuns, where exfiltration of AI chat content was observed directly in the sandbox.<ref name="arnott" />

=== Remote-config gate flipped between tests ===

Arnott notes that the remote-config switch governing the AI chat exfiltration code path was off when he first tested StayFocusd, & on by the time he published. In his entry for the extension, he writes:

<blockquote>''"We saw StayFocusd set up their infrastructure for AI chat scraping. When we tested it before there was only a remote config which they could enable at any point, but it wasn't enabled. It has since been enabled."''</blockquote><ref name="arnott" />

Remote configuration of this kind, in Arnott's words, lets an extension ''"fetch instructions from a server at runtime, changing behavior after install without an update"'' & is ''"a convenient way to dodge sandbox detection."''<ref name="arnott" />

=== URL exfiltration & the US-centric PII filter ===

Independently of the AI chat gate, Arnott documents that StayFocusd already exfiltrates the URLs a user visits, subject to a filter that he describes as failing for any user outside the United States:

<blockquote>''"They exfiltrate almost every URL you visit and have the infrastructure to scrape your AI chats. They do have exceptions: a whitelist of adult sites, US health sites, and some regex for US-focused sensitive data in query parameters, such as social security numbers and zipcodes. This protection is US-centric and breaks for everyone else. UK users get no such filtering."''</blockquote><ref name="arnott" />

For non-US users, the consequence is that the regex matching United States Social Security numbers & ZIP codes does not cover the equivalents in other jurisdictions (United Kingdom National Insurance numbers, Canadian postal codes, European personal identifiers), so query strings containing such identifiers are not stripped before exfiltration.<ref name="arnott" />

=== LZ-String obfuscation ===

Arnott records that some of the exfiltrated payload is wrapped in [[LZ-String]] compression. He does not treat this as a technical safeguard:

<blockquote>''"Some of this data is obfuscated via LZ-String, which could be considered 'compression'. It's far less extensive than Stylish."''</blockquote><ref name="arnott" />

His methodology, stated on the same page, is a sandboxed pipeline of dynamic & static analysis followed by manual verification: he records outbound network requests while reproducing user behavior in an isolated browser.<ref name="arnott" /> Arnott published a companion video on YouTube under the channel ''amibeingpwned,'' titled ''"StayFocusd, is this productivity tool acting like Spyware?,"'' demonstrating the network traffic.<ref name="yt">{{Cite web |last=Arnott |first=James |title=StayFocusd, is this productivity tool acting like Spyware? |url=https://www.youtube.com/watch?v=IOdGJEky1SU |website=YouTube |publisher=amibeingpwned |access-date=2026-05-29}}</ref>

=== StayFree, the SensorTower-owned sibling ===

The Wall of Shame's row 7 records StayFree, a smaller productivity extension with 200,000 users, also owned by SensorTower, also classified ''"Capability,"'' & also obfuscated with LZ-String (light). Arnott described the relationship between the two extensions in one sentence:

<blockquote>''StayFree essentially has the same features as StayFocusd, same remote activated capability to scrape AI chats and collect URLs, with limited PII exceptions.''</blockquote><ref name="arnott" />

== Secure Annex identification ==

Five months before Arnott's disclosure, on December 28, 2025, John Tuckner of Secure Annex published an analysis of ''"prompt poaching,"'' a term he coined for browser extensions that silently capture user prompts to & responses from chatbots such as ChatGPT, Claude, & DeepSeek. Tuckner's post focused primarily on [[Similarweb]], but it named StayFocusd by hand as a second example & attributed it to the same publisher:

<blockquote>''"We've also discovered past versions of the extension Stayfocusd, a featured productivity extension run by the a similar web analytics company, Sensor Tower, containing behaviorally similar code which has recently been updated to be only slightly less invasive containing metadata about conversations but not the conversations themselves."''</blockquote><ref name="tuckner">{{Cite web |last=Tuckner |first=John |title=Prompt poaching runs rampant in extensions |url=https://www.secureannex.com/blog/prompt-poaching/ |website=Secure Annex |date=2025-12-28 |access-date=2026-05-29}}</ref>

Tuckner's identification of StayFocusd in December 2025<ref name="tuckner" /> & Arnott's separate, sandbox-verified classification of the extension in May 2026<ref name="arnott" /> are two independent disclosures, made five months apart by different researchers. Tuckner did not publish a verbatim StayFocusd code sample; the JavaScript excerpts in his post correspond to Similarweb's code path, not to StayFocusd.<ref name="tuckner" /> Arnott observed StayFocusd's exfiltration infrastructure & remote-config gate without an active AI chat payload firing during his observation window.<ref name="arnott" />

== Publisher background ==

Sensor Tower is a mobile- & digital-intelligence company. BuzzFeed News described its commercial customer base as follows:

<blockquote>''Sensor Tower sells data and analysis about apps and the wider mobile ecosystem to developers, venture capitalists, publishers, and others to track the popularity, usage trends, and revenue of apps.''</blockquote><ref name="buzzfeed">{{Cite web |last=Silverman |first=Craig |title=Popular VPN And Ad-Blocking Apps Are Secretly Harvesting User Data |url=https://www.buzzfeednews.com/article/craigsilverman/vpn-and-ad-blocking-apps-sensor-tower |website=BuzzFeed News |date=2020-03-09 |access-date=2026-05-30}}</ref> The current StayFocusd marketing site identifies its operator as ''"ST Pulse, a Sensor Tower company."''<ref name="sfd" />

=== 2020 BuzzFeed News disclosure ===

In a March 9, 2020 investigation, Craig Silverman of BuzzFeed News reported that Sensor Tower had owned at least twenty mobile applications that fed data to its analytics products. The disclosure concerned ''mobile applications,'' not browser extensions, & predates the current StayFocusd controversy by more than five years; the publisher named on the StayFocusd Chrome Web Store listing is the same Sensor Tower.<ref name="buzzfeed" />

Silverman wrote:

<blockquote>''"Sensor Tower, a popular analytics platform for tech developers and investors, has been secretly collecting data from millions of people who have installed popular VPN and ad-blocking apps for Android and iOS, a BuzzFeed News investigation has found. These apps, which don't disclose their connection to the company or reveal that they feed user data to Sensor Tower's products, have more than 35 million downloads. Since 2015, Sensor Tower has owned at least 20 Android and iOS apps."''</blockquote><ref name="buzzfeed" />

Four of the apps named in the report were Free and Unlimited VPN, Luna VPN, Mobile Data, & Adblock Focus.<ref name="buzzfeed" /> Silverman documented that the apps prompted users to install a root certificate, describing it this way:

<blockquote>''A root certificate is a small file that lets its issuer access all traffic and data passing through a phone.''</blockquote><ref name="buzzfeed" />

After being contacted by BuzzFeed News, Apple removed Adblock Focus & Google removed Mobile Data. An Apple spokesperson told BuzzFeed News:

<blockquote>''A dozen of the Sensor Tower apps were previously removed from the iOS App Store due to violations.''</blockquote><ref name="buzzfeed" />

Asked why the ownership of the apps had not been disclosed, Sensor Tower's then-head of mobile insights Randy Nelson told BuzzFeed News the company had not done so for ''"competitive reasons."'' Nelson added in his response:

<blockquote>''The vast majority of these apps listed are now defunct (inactive) and a few are in the process of sunsetting.''</blockquote><ref name="buzzfeed" />

Nelson said the apps did not collect ''"sensitive user data such as passwords, usernames, etc."''<ref name="buzzfeed" />

== Chrome Web Store status ==

As of May 15, 2026, the Chrome Web Store listing for StayFocusd shows version 4.5.13 & retains two badges. The ''"Featured"'' badge is described on hover as ''"Follows recommended practices for Chrome extensions."''<ref name="cws" /> The ''"Established Publisher"'' badge is described on hover as ''"The publisher has a good record with no history of violations."''<ref name="cws" /> Google's announcement of the two badges, published April 20, 2022, says the Featured badge is awarded to extensions where Chrome staff have ''"manually evaluate[d] each extension"'' for adherence to best practices, ''"respecting the privacy of end-users,"'' & a clear listing page; the Established Publisher badge requires that ''"the publisher's identity has been verified"'' & that ''"the publisher has established a consistent positive track record."''<ref name="google-badge">{{Cite web |last=Kim |first=Debbie |title=Find great extensions with new Chrome Web Store badges |url=https://blog.google/products/chrome/extension-badges-google-chrome-store/ |website=The Keyword |publisher=Google |date=2022-04-20 |access-date=2026-05-29}}</ref>

Neither badge has been removed from the StayFocusd listing following Tuckner's December 28, 2025 identification or Arnott's May 11, 2026 classification.<ref name="cws" />

== Consumer guidance ==

Users who have installed StayFocusd & wish to remove it can do so from the Chrome ''chrome://extensions'' page. Because the extension's documented infrastructure is server-gated rather than always-on, the absence of observed AI chat exfiltration on a given device at a given time does not establish that no exfiltration has occurred or will occur; Arnott's own classification of the extension changed between his pre-publication testing & publication once Sensor Tower flipped the remote-config flag.<ref name="arnott" /> The presence of the Chrome Web Store ''"Featured"'' & ''"Established Publisher"'' badges, on the documented record, did not prevent the behavior described by Arnott from being shipped to 700,000 users.<ref name="arnott" /><ref name="cws" />

Readers outside the United States are specifically not covered by the PII whitelist Arnott documented in StayFocusd's URL-exfiltration code; the regex for Social Security numbers & ZIP codes does not match equivalents in other jurisdictions.<ref name="arnott" />

== See also ==

* [[Browser extension AI chat exfiltration]]
* [[Sensor Tower]]
* [[Similarweb]]
* [[WhatRuns]]
* [[Stylish (Chrome extension)]]

== References ==

{{reflist}}

[[Category:Products]]
[[Category:Browser extensions]]
[[Category:Chrome extensions]]
[[Category:Sensor Tower]]
[[Category:AI chat exfiltration]]

StayFocusd - Revision history