I was big fan of original Flattr, that's why i was excited for 2.0 too. However that "extension" setup is something that still keeps me in evaluation phase, rather than 100% in. I inspected extension (not 100% of it, but a bit of code, storage, xhr calls). Some findings:<p>* They use whitelist (visible in source) of sites, thus they do not record activity on all sites, but just the ones in whitelist.<p>* You can individually block sites from being tracked even if they are in whitelist (by click on the icon). This gets respected.<p>* They store a lot of data "locally". Things like timestamps, cursor activity, time spent on the page etc. This does not get sent to flattr, but sits in local storage.<p>* Once "site/page" qualifies for a flattr, path with title is sent to flattr. No other information (i.e. - no query string, no mouse activity etc.).<p>* They record things, that they should blacklist. For example - common cms paths (wp-admin/<i>) is reported, but should not be. In some sites they report paths that should be blacklisted (like in twitter they report /settings/</i> ).<p>* In youtube.com icon for extension looks disabled (like nothing is being recorded), however they still store data in local db (browsing history, videos viewed). Nothing is sent to flattr though. This should be updated. Either show in icon that you record data, or do not record anything.<p>All in all extension does not look malicious at the moment. But it's not perfect either. And i'm not sure that there will be a point where i will feel 100% confident with it. Most likely i will try to use it, but will continue to inspect regularly to see if its still solid.<p>Edited: fixed some typos.