boroboros crosslist Chrome extension security report

boroboros crosslist connects your account on our storefronts — boroboros, clothetal, or betaflops — to your own Grailed, Depop, and Poshmark seller accounts, so you can cross-post and manage your listings from one place — using the marketplace sessions you are already logged into in your browser. You never enter your marketplace password into the extension or into our sites. YOUR DATA, IN PLAIN TERMS • Every marketplace action runs inside your browser, on the accounts you are already logged into. Your marketplace login cookies never leave your browser — they are never sent to boroboros or to anyone else. • Sent to boroboros only: the listing content you choose to crosspost, the resulting listing IDs, and your marketplace username and account ID (to link the account you verified). • The extension contains no analytics, tracking, or telemetry of any kind. Full policy: https://boroboros.com/privacy/extension/ WHAT IT DOES • Cross-post a listing to Grailed, Depop, or Poshmark in one step — photos, title, description, price, category, condition, and shipping. • Keep listings in sync: edit price or details, or delete a listing on the marketplace when you remove it from our site. • Run the marketplaces' own seller tools on a listing, one click per listing: send an offer to everyone who liked/favorited it, and — on Grailed — "Bump to Top" and "Repost" (delete + re-list with followers). • Share a listing to a community you pick on Reddit in one click — you compose the post on our site, and it is submitted from your own logged-in session. • The extension only runs what our site sends it, while our site is open in your browser — whether you clicked it, or a setting you turned on in our app queued it for you (Auto-export for new items and edits; auto-bump / auto-relist for eligible exported listings — all off by default, always within the marketplace's own per-listing limits). • See at a glance in the popup whether your marketplace accounts are connected. • Verify a linked account when you first connect it: with your approval, a brief, reversible change is made to your own public profile and immediately undone — on Depop, a short one-time code is placed in your bio and removed once checked; on Poshmark, the same kind of code is placed in your "About me" text and removed once checked (if it doesn't fit, your text is set aside and put back automatically); on Grailed, Vacation Mode is briefly set to a specific return date, then turned back off (any vacation you already had is restored). This proves the account is yours without ever sharing your login. HOW IT WORKS The extension acts only on your own accounts, in your own browser. When an action is sent from one of our sites (boroboros.com, clothetal.com, betaflops.com), the extension performs the same API calls the marketplace's own website would make from your logged-in session, then reports the result back to boroboros. The extension only ever runs an operation our web app sends it, and only while our site is open in your browser — whether you clicked it, or a setting you turned on in our app queued it for you: Auto-export (a listing you create or edit on our site is queued for that marketplace instead of waiting for a per-item click) and auto-bump / auto-relist (the Bump / Repost tools above re-run on your own eligible listings, roughly every six hours). Both are off by default, act only on your own listings, and stay within the marketplace's own per-listing limits. The extension has no scheduler of its own: there is no bulk messaging, and nothing runs when boroboros isn't open. WHAT YOU NEED • An account on boroboros (boroboros.com), clothetal (clothetal.com), or betaflops (betaflops.com) • Your own seller account on the marketplaces you post to, logged in to the same Chrome profile boroboros crosslist is an independent tool and is not affiliated with, endorsed by, or sponsored by Grailed, Depop, Poshmark, or Reddit. All marketplace names are trademarks of their respective owners.