StayFocusd

StayFocusd is a productivity Chrome extension published by mobile-analytics company Sensor Tower that, as of May 15, 2026, advertises both a "Gen AI Analytics" feature tracking users' "usage of AI chat platforms" and a privacy bullet promising it "does not collect personal data from the web pages you visit" on the same Chrome Web Store listing. On May 11, 2026, independent researcher James Arnott classified the extension as "Capability" on the AI Chat Scraper Wall of Shame, documenting that StayFocusd exfiltrates "almost every URL you visit" for its roughly 700,000 users while shipping a remote-configured infrastructure to scrape AI chat conversations that was wired up but server-side gated during initial testing, and was then enabled. The Chrome Web Store has not removed the extension; it retains both the "Featured" and "Established Publisher" badges.

StayFocusd

Basic Information
Release Year
Product Type	Browser extension
In Production	Yes
Official Website	https://www.stayfocusd.com/

Background

StayFocusd is listed in the Chrome Web Store's Workflow & Planning category and is described on its listing as a tool to "limit the amount of time you spend on time-wasting websites." The listing names six features, including a "Nuclear Option" that blocks selected sites for a fixed window and "cannot be canceled" once activated, alongside the "Gen AI Analytics" bullet quoted above. The extension is published by Sensor Tower with a developer address of 275 Battery St #800, San Francisco, & is version 4.5.13 as of May 15, 2026, with a footprint of 6.77 MiB & 10 supported languages. The Chrome Web Store displays a count of 700,000 users & 8.7K ratings averaging 4.5.

The product's marketing site, stayfocusd.com, identifies the operator in its footer as "© 2026 ST Pulse, a Sensor Tower company. All rights reserved," confirming the current ownership chain.

Chrome Web Store listing contradiction

The current Chrome Web Store overview lists, within the same bulleted feature list, two statements that describe opposite behaviors. The first reads:

"🤖 Gen AI Analytics: Track and analyze your usage of AI chat platforms directly from the StayFocusd."

The second, several bullets later on the same page, reads:

"🔒 Privacy protection: StayFocusd does not collect personal data from the web pages you visit."

The listing's permission rationale, addressing the "Read and change all your data on the websites you visit" prompt that Chrome shows at install time, repeats the second framing. Sensor Tower writes that the permission is required so the extension can block sites, & makes a third privacy assurance on the same page:

We will never collect personal data from the web page content that you are browsing.

The listing does not reconcile this with the "Gen AI Analytics" bullet, which by its own text tracks what AI chat platforms a user visits & how they use them.

AI Chat Scraper Wall of Shame disclosure

On May 11, 2026, James Arnott published the AI Chat Scraper Wall of Shame on amibeingpwned.com, a classification of browser extensions whose code paths exfiltrate browsing data or AI chat transcripts. StayFocusd appears in row 4 of his table, with 700,000 users, ownership attributed to SensorTower, a status of "Capability," & obfuscation marked "LZ-String (light)."

Arnott defines the "Capability" classification:

"The exfiltration infrastructure is there (remote endpoint, code path, the lot) but didn't fire in our observation window. We attribute this to server-side gating."

He distinguishes this from "Confirmed" entries such as Stylish, Similarweb, & WhatRuns, where exfiltration of AI chat content was observed directly in the sandbox.

Remote-config gate flipped between tests

Arnott notes that the remote-config switch governing the AI chat exfiltration code path was off when he first tested StayFocusd, & on by the time he published. In his entry for the extension, he writes:

"We saw StayFocusd set up their infrastructure for AI chat scraping. When we tested it before there was only a remote config which they could enable at any point, but it wasn't enabled. It has since been enabled."

Remote configuration of this kind, in Arnott's words, lets an extension "fetch instructions from a server at runtime, changing behavior after install without an update" & is "a convenient way to dodge sandbox detection."

URL exfiltration & the US-centric PII filter

Independently of the AI chat gate, Arnott documents that StayFocusd already exfiltrates the URLs a user visits, subject to a filter that he describes as failing for any user outside the United States:

"They exfiltrate almost every URL you visit and have the infrastructure to scrape your AI chats. They do have exceptions: a whitelist of adult sites, US health sites, and some regex for US-focused sensitive data in query parameters, such as social security numbers and zipcodes. This protection is US-centric and breaks for everyone else. UK users get no such filtering."

For non-US users, the consequence is that the regex matching United States Social Security numbers & ZIP codes does not cover the equivalents in other jurisdictions (United Kingdom National Insurance numbers, Canadian postal codes, European personal identifiers), so query strings containing such identifiers are not stripped before exfiltration.

LZ-String obfuscation

Arnott records that some of the exfiltrated payload is wrapped in LZ-String compression. He does not treat this as a technical safeguard:

"Some of this data is obfuscated via LZ-String, which could be considered 'compression'. It's far less extensive than Stylish."

His methodology, stated on the same page, is a sandboxed pipeline of dynamic & static analysis followed by manual verification: he records outbound network requests while reproducing user behavior in an isolated browser. Arnott published a companion video on YouTube under the channel amibeingpwned, titled "StayFocusd, is this productivity tool acting like Spyware?," demonstrating the network traffic.

StayFree, the SensorTower-owned sibling

The Wall of Shame's row 7 records StayFree, a smaller productivity extension with 200,000 users, also owned by SensorTower, also classified "Capability," & also obfuscated with LZ-String (light). Arnott described the relationship between the two extensions in one sentence:

StayFree essentially has the same features as StayFocusd, same remote activated capability to scrape AI chats and collect URLs, with limited PII exceptions.

Secure Annex identification

Five months before Arnott's disclosure, on December 28, 2025, John Tuckner of Secure Annex published an analysis of "prompt poaching," a term he coined for browser extensions that silently capture user prompts to & responses from chatbots such as ChatGPT, Claude, & DeepSeek. Tuckner's post focused primarily on Similarweb, but it named StayFocusd by hand as a second example & attributed it to the same publisher:

"We've also discovered past versions of the extension Stayfocusd, a featured productivity extension run by the a similar web analytics company, Sensor Tower, containing behaviorally similar code which has recently been updated to be only slightly less invasive containing metadata about conversations but not the conversations themselves."

Tuckner's identification of StayFocusd in December 2025 & Arnott's separate, sandbox-verified classification of the extension in May 2026 are two independent disclosures, made five months apart by different researchers. Tuckner did not publish a verbatim StayFocusd code sample; the JavaScript excerpts in his post correspond to Similarweb's code path, not to StayFocusd. Arnott observed StayFocusd's exfiltration infrastructure & remote-config gate without an active AI chat payload firing during his observation window.

Publisher background

Sensor Tower is a mobile- & digital-intelligence company. BuzzFeed News described its commercial customer base as follows:

Sensor Tower sells data and analysis about apps and the wider mobile ecosystem to developers, venture capitalists, publishers, and others to track the popularity, usage trends, and revenue of apps.

The current StayFocusd marketing site identifies its operator as "ST Pulse, a Sensor Tower company."

2020 BuzzFeed News disclosure

In a March 9, 2020 investigation, Craig Silverman of BuzzFeed News reported that Sensor Tower had owned at least twenty mobile applications that fed data to its analytics products. The disclosure concerned mobile applications, not browser extensions, & predates the current StayFocusd controversy by more than five years; the publisher named on the StayFocusd Chrome Web Store listing is the same Sensor Tower.

Silverman wrote:

"Sensor Tower, a popular analytics platform for tech developers and investors, has been secretly collecting data from millions of people who have installed popular VPN and ad-blocking apps for Android and iOS, a BuzzFeed News investigation has found. These apps, which don't disclose their connection to the company or reveal that they feed user data to Sensor Tower's products, have more than 35 million downloads. Since 2015, Sensor Tower has owned at least 20 Android and iOS apps."

Four of the apps named in the report were Free and Unlimited VPN, Luna VPN, Mobile Data, & Adblock Focus. Silverman documented that the apps prompted users to install a root certificate, describing it this way:

A root certificate is a small file that lets its issuer access all traffic and data passing through a phone.

After being contacted by BuzzFeed News, Apple removed Adblock Focus & Google removed Mobile Data. An Apple spokesperson told BuzzFeed News:

A dozen of the Sensor Tower apps were previously removed from the iOS App Store due to violations.

Asked why the ownership of the apps had not been disclosed, Sensor Tower's then-head of mobile insights Randy Nelson told BuzzFeed News the company had not done so for "competitive reasons." Nelson added in his response:

The vast majority of these apps listed are now defunct (inactive) and a few are in the process of sunsetting.

Nelson said the apps did not collect "sensitive user data such as passwords, usernames, etc."

Chrome Web Store status

As of May 15, 2026, the Chrome Web Store listing for StayFocusd shows version 4.5.13 & retains two badges. The "Featured" badge is described on hover as "Follows recommended practices for Chrome extensions." The "Established Publisher" badge is described on hover as "The publisher has a good record with no history of violations." Google's announcement of the two badges, published April 20, 2022, says the Featured badge is awarded to extensions where Chrome staff have "manually evaluate[d] each extension" for adherence to best practices, "respecting the privacy of end-users," & a clear listing page; the Established Publisher badge requires that "the publisher's identity has been verified" & that "the publisher has established a consistent positive track record."

Neither badge has been removed from the StayFocusd listing following Tuckner's December 28, 2025 identification or Arnott's May 11, 2026 classification.

Consumer guidance

Users who have installed StayFocusd & wish to remove it can do so from the Chrome chrome://extensions page. Because the extension's documented infrastructure is server-gated rather than always-on, the absence of observed AI chat exfiltration on a given device at a given time does not establish that no exfiltration has occurred or will occur; Arnott's own classification of the extension changed between his pre-publication testing & publication once Sensor Tower flipped the remote-config flag. The presence of the Chrome Web Store "Featured" & "Established Publisher" badges, on the documented record, did not prevent the behavior described by Arnott from being shipped to 700,000 users.

Readers outside the United States are specifically not covered by the PII whitelist Arnott documented in StayFocusd's URL-exfiltration code; the regex for Social Security numbers & ZIP codes does not match equivalents in other jurisdictions.

See also

• Browser extension AI chat exfiltration
• Sensor Tower
• Similarweb
• WhatRuns
• Stylish (Chrome extension)