Extenshiextenshi.io/blog
Back to articles
website blockersextension reviewsprivacyproductivitybrowser extensions

Website blocker extensions reviewed: BlockSite, StayFocusd, Freedom & Forest privacy compared

I compared four popular website blocker extensions on permissions and data sharing. Here's which focus tools keep your browsing private and which don't.

Maxim Kosterin
9 min read
A hairline doorway on paper white, its opening sealed by a soft orange watercolor wash, with a short path of stepping stones leading up to it and stopping.
A hairline doorway on paper white, its opening sealed by a soft orange watercolor wash, with a short path of stepping stones leading up to it and stopping.

You installed a website blocker to spend less time being watched by the internet. So there's a bitter irony in the fact that, to do its job, a blocker needs one of the most powerful permissions an extension can hold: the ability to see and act on every page you open.

Think about it. To stop you from loading Twitter at 2pm, the extension has to watch every URL you navigate to and step in when one matches your blocklist. That's "read and change all your data on all the websites you visit" — the exact permission that makes malware dangerous. The difference between a helpful focus tool and a privacy leak isn't the permission. It's what the extension does with it. So I pulled four of the most-installed blockers — BlockSite, StayFocusd, Freedom, and Forest — and lined them up on that one axis.

Quick verdict

  • StayFocusd — local-first, no account, no data collection claimed. Per its Chrome Web Store privacy listing, it doesn't collect personal data from the pages you visit. One caveat below worth a 30-second check.
  • Forest — also local, gamified focus, no account required. The developer discloses it will not collect or use your data. Roughly 800,000 users.
  • Freedom — cloud-synced and account-based, so more of your setup leaves your machine. Its privacy policy says it doesn't sell or rent your information.
  • BlockSite — the most-installed of the four, and the one whose own privacy policy discloses the most data leaving your browser. Per BlockSite's policy, it shares browsing and activity data with affiliates for "market intelligence" — with an opt-out you have to find yourself.

Short version: the more a blocker syncs or monetizes, the more of your browsing leaves your machine. And here, unlike a tab manager, the permission is broad enough that "what leaves" can mean everything.

What these extensions actually do

All four solve the same problem — you, distracted — with different philosophies. StayFocusd is the classic: set a daily time budget for time-wasting sites, and once you burn through it, the door slams shut until tomorrow. No login, no dashboard, just a nuclear option for people who don't trust their own willpower.

Forest turns focus into a game. Start a session and a virtual tree grows; leave to check Instagram and the tree dies. It's cutesy, but the guilt works. Freedom is the heavyweight — it blocks across your phone, laptop, and browser at once from a synced schedule, which is why it needs an account. BlockSite sits in the middle on features (blocklists, scheduled focus, a "work mode") but, as we'll see, leans hardest into data.

The feature split is real, but for a security review the line that matters is the same one from my tab manager comparison: account vs. no account, and local vs. cloud. That single design choice drives almost everything about the privacy profile.

Security analysis: the permission all four share

Here's the uncomfortable part. Every one of these extensions requests host access to all the sites you visit — Chrome phrases it as "read and change all your data on all the websites you visit." A blocker genuinely needs it: without the ability to run on any page, it can't catch the page you're trying not to load.

I broke down exactly what that grants in my piece on the <all_urls> host permission, but the short version is that it's the widest content-level access in the extension model. It doesn't just see URLs — it can read page content and inject scripts on every site. Several of these also request the tabs permission, which exposes the titles and URLs of your open tabs on top of that.

So none of these four are "over-asking" for a blocker — the permission fits the function. That's the trap, actually. Because the request is legitimate, your browser's install prompt looks identical whether the extension quietly blocks sites or quietly logs them. The permission tells you nothing. The vendor's behavior is the whole story.

Where your data goes: the real difference

BlockSite is the honest cautionary tale, because it tells on itself. According to BlockSite LP's own privacy policy, the extension discloses "Browsing Data, Activity Data and AI Data" to affiliates "to enable the service and for market intelligence purposes." Its help center explains you can opt out — but the toggle is buried: for the browser extension you deselect a "Block Adult Sites" checkbox in the options, and the policy notes some features stop working once you do. None of this is hidden malware; it's disclosed, opt-out-able behavior. But "an extension with all-sites access that ships your browsing data to affiliates by default" is exactly the pattern I'd want you to notice before installing.

StayFocusd and Forest are the counterexamples. StayFocusd's Chrome Web Store privacy section states it doesn't collect personal data from the pages you visit — the permission exists only to block. Forest's developer, Seekrtech, discloses that it won't collect or use your data. Neither requires an account, so there's no email or IP tied to your blocklist in the first place.

One StayFocusd caveat worth 30 seconds of your time: its current store listing carries two lines that pull in opposite directions — one promising it doesn't collect page data, another mentioning "Gen AI Analytics" that tracks usage of AI chat platforms. That's the kind of mixed signal you should read for yourself on the listing before trusting a blanket "it's private" from anyone, me included.

Freedom is the account trade-off, like Toby or Workona were in the tab-manager world. Cross-device blocking means your schedule and blocklist live on Freedom's servers behind a login. Its policy commits to not selling or renting your information, which is the right promise to make — but you are, by design, trusting a server with your focus data in exchange for syncing it everywhere.

Privacy score breakdown: how I'd rank them

I'm not going to invent a fake "9.2/10." Instead, here's the axis Extenshi's scanner actually weighs, and where each lands.

Data residency. StayFocusd and Forest win cleanly — local, no account, nothing leaves unless you export it. Freedom scores lower because sync is the product. BlockSite scores lowest of the four, by its own disclosure, since data sharing is on by default.

Permission breadth. It's a wash: all four hold the same broad all-sites access because a blocker needs it. No extra credit, no red flag — just a reminder that the permission can't distinguish them for you.

Account exposure. StayFocusd and Forest need no login, so there's no identity data to leak. Freedom and BlockSite tie data to an account or an affiliate pipeline.

Track record and upkeep. None of the four show the scariest signals — no recent ownership flip, no sudden permission grab. One practical note: check the "last updated" date on any blocker's listing before you install. An unmaintained extension holding all-sites access is a future liability even if it's clean today, which I dug into in my post on abandoned extensions.

Alternatives and how to pick

If none of the four fit, a couple more are worth a look. LeechBlock NG is open-source and local-first, which is about the strongest privacy posture a blocker can have. Cold Turkey does its heavy lifting as a desktop app rather than a browser extension, which sidesteps the all-sites permission entirely — a legitimately different model if you want the block to survive you uninstalling the extension.

My decision tree is short. Want a dead-simple, no-account daily limit that never phones home? StayFocusd. Want the same privacy posture with a bit of gamified motivation? Forest. Need one blocklist enforced across your phone and every computer, and you're fine trading focus data for that sync? Freedom — go in knowing it lives in their cloud. And BlockSite? It's genuinely capable, but if you install it, go straight to settings and turn off the data sharing first.

Whatever you pick, do the same 30-second check I do: open the Chrome Web Store page, read the "privacy practices" section, and confirm the last update was recent. With a blocker, you're handing over your entire browsing surface — so it's worth 30 seconds to see who's on the other end.

How Extenshi helps

You shouldn't have to reverse-engineer a privacy policy to find out that your focus tool is a data pipeline. Extenshi scans extensions for exactly this — what they request, whether they reach past what a blocker needs, and whether the listing has the quiet red flags (data sharing defaults, ownership churn, dormant code) that turn a useful tool into a liability. Drop any of these blockers into the catalog and you'll see the permission and data-flow breakdown in plain language, not legalese.

See the full security report for your website blocker → catalog.extenshi.io

Already running a stack of extensions and not sure which ones quietly read every page you open? Scan your extensions and find out before your next focus session.

Sources

This article is based on publicly available information and the cited vendors' own privacy policies and store listings. Extenshi does not independently verify all claims made by third parties. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].

Related Articles