ShopTools AI interacts with store pages to find promo fields and compare displayed totals. Before installing, match that task to its permissions: page access extends beyond a single code-check button.
Page access is a capability, not just a purpose
The reviewed browser package declares tabs, storage and activeTab. Its content script is configured for ordinary HTTP and HTTPS pages, not just ShopTools pages or the moment after you click the toolbar icon.
The script identifies store context and can interact with page elements. A checkout contains more than prices. Explaining why access is useful does not establish that other page data is technically inaccessible.
A promo code does not require your password, SMS verification code, card security code or passport. Do not share them with the assistant or support. Not asking for a card is not a complete account of data handling.
Local storage is only part of the picture
The browser stores preferences such as country and widget state, along with temporary state for an unfinished attempt. This helps associate a result after a page reload with the same store.
Temporary state has an expiry. That is not a retention period for all ShopTools data, nor a promise that removing the extension deletes server records.
- Technical events may include the store domain, page path, installation identifiers and click identifiers.
- Test diagnostics may send the outcome, measured difference, currency, code hash and the technical selector used to read the total.
- AI search text and the store domain are sent to ShopTools servers. When the provider is enabled, the query, domain and candidate offers are also sent to DeepSeek.
Search text is data too, so leave order details out of it. A persistent installation identifier should not be described as fully anonymous merely because it has no person's name attached.
Country detection and affiliate visits are separate flows
The extension offers manual country selection. User-enabled network detection derives an approximate country from the IP address without GPS. This describes one feature, not every network request made by the product.
If the check confirms a lower total and leaves the code applied, an affiliate visit is optional and is not needed to retain the code. Following that link also involves the affiliate network and the store.
Checks you can make before and after installation
- Start from the installation link on shoptools.online. Check the name, developer and policy in the browser store listing. Avoid lookalike archives sent in unsolicited messages.
- Read shoptools.online/privacy.html for your platform. The mobile app, Safari version and browser extension need not handle data identically.
- Find the browser controls for site access, disabling and removal. Turning off the widget alone does not revoke extension permissions.
- Disable the extension if it unexpectedly changes settings, repeats redirects or interferes with unrelated fields. Report the domain and steps without order, address or payment details.
A browser store listing is not a safety guarantee. Updates, changing websites and dependencies call for renewed scrutiny, particularly when new permissions are requested.
An additional checklist for technical reviewers
An audit needs the actual package and observed network traffic on a test page. Product copy and this checklist are not a security certification or a legal compliance assessment.
- Compare permissions, host_permissions and content_scripts. A narrow API permission does not cancel broad content-script access.
- Test field detection beside email, phone and payment controls, and check that it does not click order or payment buttons.
- Inspect request payloads when opening the popup, searching and testing. Look specifically for full URLs, page text, secrets and unnecessary identifiers.
- Check that temporary records belong to the intended store and are cleared after completion or expiry. Examine server logs and retention separately.
- Include wrong-field selection, tampered API responses, unsafe redirects, remote code and dependencies in the threat model. One safeguard does not establish end-to-end safety.
By the ShopTools AI editorial team.
Some ShopTools links are affiliate links. ShopTools may earn a commission on a qualifying purchase confirmed by the retailer; a click alone does not guarantee a commission.
Prepared with AI assistance. Product descriptions were checked against ShopTools code and interface; this is not a report of tests at every store.