EAN Snap detects EAN/GTIN barcodes on product pages so Amazon FBA sourcers can analyse deals faster. Everything happens locally in your browser. The extension has no telemetry, no analytics, and sends none of your browsing data to us or to anyone else. The source code (main.js, content.js, background.js) ships unminified and can be read by anyone who unzips the package.
storage. There is no network permission, no tabs, no cookies, no webRequest. Without these, exfiltrating data or spying on other tabs is technically impossible.sendBeacon, no analytics POST, no remote endpoint. Every outbound URL in the code is opened by your own click (Amazon, SellerAmp, ProfitGo, Google Shopping) or is a same-origin call to the site you are already on. The one exception is the Pro license check with ExtPay (extensionpay.com), which sends only a pseudonymous install identifier — never page content.chrome.storage.local, on your device.Because the extension hooks network calls to find barcodes, some readers assume the worst. Here is what the code actually does.
“It sniffs network traffic to steal my suppliers and margins.”
It does read responses to find barcodes, but only from the same domain you are already visiting, and it extracts EAN/GTIN digits only — never prices or margins. As of v1.3.7 it also skips any login, account, checkout or payment URL outright. And nothing it reads is ever sent anywhere — there is no network permission to do so.
“It parasites / steals SellerAmp and ProfitGo sessions.”
It integrates with them. The SellerAmp button uses SellerAmp’s own public hook; the ProfitGo panel loads ProfitGo’s own official page using your own logged-in session, inside your own browser. A local postMessage cannot take another person’s session on another machine — that is impossible by design. If those tools are not installed, the buttons simply open their websites.
“The content-script bridge is wide open.”
The bridge rejects messages that do not come from the page’s own window. As of v1.3.7 it also enforces a strict allow-list of message types and limits storage access to the extension’s own oa_v24* keys. The worst a page could ever reach is your local preferences — no passwords, no cookies, no tokens, and no access to other tabs (the tabs permission is not requested).
“It hides from Google Translate to stay stealthy.”
It ignores the DOM changes that Google Translate makes (it rewrites every text node). Without that filter, the detector would re-scan in an infinite loop and slow your browser down. It is a standard performance guard — the opposite of hiding.
Unzip the extension package and search the code for any data transmission. If you find a single line that exfiltrates anything, report it and it will be fixed publicly. Independent review is welcome.
Security questions or reports: contact.ean.snap@gmail.com
EAN Snap © 2026. See also our Privacy Policy.