That’s true. On the other hand, the extension gains a much larger attack surface since it has access to a lot more data (every site you visit vs. only the site that serves the JS code). At the end of the day, people wouldn’t use your site if they didn’t trust your site, especially if they use it for privacy and integrity reasons, so for most users I think JS is the better option. I suppose there’s no reason you can’t offer both though.

Is their JS code open source? If so, I don’t see any real differences between an extension and JS code. Unless extensions have less privileges or something. The user will have to either trust the code or inspect it themselves regardless if it’s an extension or JS code.

Update: Yamtrack is great, thanks for the suggestion! I haven’t gotten the webhook to work yet though but I haven’t had much time to troubleshoot.

I might give Yamtrack a try, thank you!

By the number of stars on their git repository. I would never, ever, install an extension that’s not open source.