How the data moves

A privacy policy that says "we make four requests" is worth more if you can see what the four requests are.

The shape of it

The obvious design — ask the server about a video when you open it — tells the server every video you watch. That rules it out.

So ratings ship in bulk and the lookup happens locally: a base bundle, a small daily overlay for what changed, and a bloom filter to answer "is it in the set at all" first. Popular videos cost no request.

That leaves a long tail of rarely-rated videos, too many to ship to everyone. Those are fetched in buckets keyed by a hash prefix, so a request names a group, not a video.

GET /a/manifest.json

The only mutable document: the current version of each artifact, where to fetch it, and the long-tail geometry. Everything it points to is content-addressed and cached immutably. Refreshed on a daily alarm, jittered across twelve hours so a hundred thousand clients do not arrive at once.

GET the base, overlay and filter

Binary, identical for every user, addressed by content hash. The base is a minimal perfect hash over video ids with a quantised rating each, refetched only when its version changes. The overlay is the daily delta.

The URL comes from the manifest and its shape is checked against a closed set of known forms first — otherwise whoever served the manifest could point a privileged client anywhere, which is a request-forgery primitive for free.

GET /t/<version>/<prefix>

One long-tail bucket. The prefix is 12 to 24 bits of a hash of the video id, so the bucket holds a crowd and the request does not name the video.

It comes from the background page, so it does not carry YouTube's origin, and responses are cached.

POST /v

The only request carrying anything you did.

{ "uid": "<32 hex characters>",
  "votes": [ { "v": "<video id>", "s": 4, "t": 1756200000000 } ] }

The entire body. No URL, referrer, session, device, locale or watch position; adding one would be a change to this page as much as to the code. Ratings go up in batches, and the identifier is stored only as a salted hash with the salt held server-side.

The server

Written in C, no dynamic allocation after startup, request path held to a fixed instruction budget CI enforces. More austerity than a rating service needs, and the reason is money: it has to survive on one small box.

Privacy policy

Last updated 26 August 2026. Applies to version 1.0.0 and later.

Written from the code. Every claim names the file behind it; if the two disagree, the code is what runs and this page is the bug.

1. The short version

Your ratings live on your machine. Each also goes to our server — video id, star value, time — under a random number tied to no account, email or identity we keep.

One server, ours. No third party at all, Return YouTube Dislike included. No analytics, telemetry, error reporting or usage counters.

2. What stays on your machine

In IndexedDB and storage.local, under the extension's own origin:

• Your rating of each video — id, stars, timestamp, community average at the time. lib/store.js.
• Your settings, and whether you have seen the first-run notice.
• The random identifier from section 4, under the key uid.
• The downloaded ratings data: base artifact, daily overlay, bloom filter.
• Cached long-tail rows, in memory only.

No export, no sync, no server-side backup. Uninstalling takes the lot.

3. Everything that leaves your machine

Four requests exist in the source and no others, all to the single origin set at build time.

• GET /a/manifest.json — event-page.js:470. Reveals that some installation asked for the current data version.
• GET base, overlay, bloom filter — event-page.js:443. Content-addressed, identical for every user.
• GET /t/<version>/<hex> — event-page.js:1111. A hash prefix, never the video id. Section 5.
• POST /v — event-page.js:645. Your ratings. The only one carrying anything you did.

That last body, in full:

{ "uid": "<32 hex characters>",
  "votes": [ { "v": "<video id>", "s": 4, "t": 1756200000000 } ] }

No page URL, referrer, user agent we add, session, device, locale, channel or watch position. Ratings post in batches, so arrival time says little about when you watched.

Outside our control: any HTTP request discloses your IP to us and to your network provider.

You can check the third-party claim yourself. The only other URL in the source is the SVG XML namespace, never requested. No XMLHttpRequest, sendBeacon, WebSocket, EventSource or remote scripts. Where it uses RYD's numbers it reads what their extension already drew on the page.

4. The identifier

Sixteen random bytes from crypto.getRandomValues, taken before the first rating goes out. lib/store.js.

• Not derived from anything about you, your hardware, your browser or your account.
• Not your YouTube or Google id — the extension never reads your account identity and asks for no permission that would let it.
• It exists so a new rating replaces an old one instead of counting twice.
• The server keeps only a salted hash of it. The client never has the salt; a salt the client holds is not a secret.

Clear storage or reinstall and you get a new identifier with no link to the old. Ratings already sent stay in the averages and can no longer be traced to you.

5. Looking up a video usually tells us nothing

Popular videos cost no request — their ratings are already on your machine.

Rare videos are fetched a bucket at a time, keyed by 12 to 24 bits of a hash prefix (lib/tail.js), never the id. A 12-bit prefix covers roughly a four-thousandth of the id space.

Calling that anonymous would be overselling it: the request says you are watching one of the videos in a bucket, and a narrower geometry means a smaller bucket. It comes from the background page, so it does not carry YouTube's origin, and buckets are cached so a video does not announce itself twice.

6. What a star does to your YouTube account

The notice shown before your first rating:

Rating 4 or 5 stars presses YouTube's Like button, which adds the video to your public Liked Videos playlist and feeds your recommendations. Rating 1 or 2 stars presses Dislike. Rating 3 presses nothing. Your star rating is always saved and shared with the community either way.

Liked Videos is public by default, so this can make a rating visible on YouTube's side. Nothing this extension publishes does that.

It works by clicking the real button, exactly as you would. The extension holds no YouTube credentials and sends nothing to YouTube.

Don't touch my YouTube account in the options switches it off entirely; your stars still count and still reach everyone else. A stricter setting makes only 5 like and only 1 dislike. Neither is retroactive.

7. Permissions

• storage — the ratings and settings in section 2.
• alarms — the daily data refresh while the background page sleeps.
• *://www.youtube.com/* — to draw the widget and read the like and dislike counts already shown.
• The API origin, for section 3.

It deliberately skips webNavigation, which would be convenient but triggers an "access your browsing history" prompt and grants more than this needs. It watches for navigation from inside the YouTube page instead.

No access to any site but YouTube and its own API. It cannot read your history, bookmarks, cookies, other tabs, or any other website.

8. What we do not collect

Spelled out, because "we only collect what we need" is not checkable and this is. No name, email, account id, password, payment details, contacts, location, advertising id, device fingerprint, browsing history, search queries, page content, keystrokes or screenshots. No watch history beyond the videos you rate. No analytics or crash telemetry.

9. Sharing, retention, choices

What gets published is the aggregate: the average and how many people it came from. Individual ratings and the identifier are never published, sold, rented or shared. There are no advertisers, analytics vendors or data brokers, because there is no code that could reach one.

A submitted rating stays in the aggregate for as long as the service runs; the salted hash means the server cannot connect it back to you.

Your choices: rate nothing and nothing is sent, since watching transmits nothing. Turn off the account presses and keep rating. Remove a rating. Or clear storage and uninstall, which erases section 2 and cuts the identifier permanently.

Not aimed at children, and collects nothing that would identify one.

10. Contact and changes

Questions: support@returnyoutubestars.com, the same address as the support contact on Mozilla Add-ons.

If what leaves your machine changes, section 3 changes, so that is the section to reread.