I will take the opportunity to share what I have observed a few weeks ago regarding another extension in the Chrome Store: Popup Blocker (800,000+ users)[1] also leaks your browsing history.

For every site you visit, there is a POST to

    https://api2.poperblocker.com/view/update

which contains information about each visited page. Example of information sent in the POST (I randomly clicked on an entry in the front page of Hacker News):

    us=576
    ver=1.0
    sver=1
    nid=chrome
    h=e[...]6
    tid=1478271585985
    u=https%3A%2F%2Fthehftguy.wordpress.com%2F2016%2F11%2F01%2Fdocker-in-production-an-history-of-failure%2F&p=https%3A%2F%2Fnews.ycombinator.com%2F
    rd=https%3A%2F%2Fnews.ycombinator.com%2F
    ch=2

The information above is double-encoded using atob before being sent in a POST. The `h` value stays the same i each POSTs.

The privacy policy of the extension used to be complete nonsense, a copy-pasta of the text found on the front page of (probably unrelated) site `whatarecookies.com`.

Looks like they changed it though[2], it is now a large image of pure-text HTML[3], which appears to be borrowed a lot from (coincidence!) WOT's own Privacy Policy's page.[4] I will assume using an image may be to purposefully make it more difficult to find out the copy-pasta.

The review I had left a few weeks ago for the extension -- in which I informed of the above -- seems to be gone.

[1] https://chrome.google.com/webstore/detail/poper-blocker/bkkb...

[2] http://www.poperblocker.com/privacy.html

[3] http://www.poperblocker.com/privacy.png

[4] https://www.mywot.com/en/privacy/privacy_policy