Legal

Privacy Policy

Effective August 17, 2026

Adport is a paid-media control plane maintained by Yannick Westermann Labs. It can be used as self-hosted open-source software or through the managed Adport Cloud service. This policy explains both modes and, in particular, how Adport Cloud accesses, uses, stores, protects, retains, and shares Google user data.

Website and Cloud account data

Adport.dev does not use advertising cookies or tracking pixels. Our hosting providers may process standard request data, including IP address, user agent, requested URL, and request time, to deliver and secure the site. If you create an Adport Cloud account, we process your email address, display name, organization membership and role, security settings, connection status, API-key metadata, and service audit events to authenticate you and operate the service. API-key secrets are shown once and stored only as keyed cryptographic digests.

Google user data

Adport Cloud requests only the Google Ads OAuth scope https://www.googleapis.com/auth/adwords. Google Ads offers one OAuth scope for its read and management functionality, so there is no narrower Google Ads scope that can provide Adport's user-facing reporting, preview, create, update, and remove features. Adport does not request access to Gmail, Google Drive, Google Calendar, Google Photos, contacts, general Google Account profile data, or other unrelated Google services.

Raw and derived data Adport accesses

Raw Google Ads data may include OAuth access and refresh tokens; accessible customer, manager, and account identifiers; account names, status, currency, and time zone; campaigns and campaign budgets; bidding settings; ad groups; ads, assets, and responsive-ad text; keywords and other targeting criteria; conversion and attribution fields; change history; and performance fields such as impressions, clicks, cost, conversions, conversion value, and return on ad spend.

Adport derives only the data needed for its visible features: normalized reports and performance metrics, account and campaign summaries, proposed-change previews, budget deltas, policy findings, short-lived pending-operation records, and audit events. Aggregated metrics remain associated with the applicable advertising account or campaign unless the user exports or directs them elsewhere. Adport does not create or sell an anonymized advertising-data product.

How Adport uses Google user data

Adport uses raw and derived Google user data only to provide or improve user-facing Adport features requested by the user: connect and list accessible accounts; retrieve, normalize, and display reports; inspect advertising configuration and performance; identify findings for the user's review; preview proposed changes; and, only after Adport's mandatory preview-and-exact-approval step, create, update, pause, enable, or remove Google Ads resources. It also uses connection metadata, pending operations, and audit events to secure the service, enforce tenant policy, troubleshoot user-visible failures, and show the user what Adport did.

Adport does not use Google user data for targeted, personalized, interest-based, or retargeted advertising; data brokerage or information resale; lending or creditworthiness; surveillance; unrelated profiling; or automated decisions about individuals. Adport does not sell Google user data.

AI and machine-learning restrictions

Adport does not use raw, aggregated, anonymized, or derived Google user data to develop, improve, or train general-purpose or shared artificial-intelligence or machine-learning models. Adport does not transfer Google user data to third-party AI providers for their model training. If a user deliberately invokes Adport from an AI or MCP client, the requested result may be sent to that user-selected client solely to answer the user's request; Google OAuth tokens and provider secrets are never included. The user is responsible for choosing a client whose data controls match the user's requirements.

Adport's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Sharing and transfer of Google user data

Adport Cloud transfers Google user data only as necessary to provide or improve the prominent user-facing features described above, with the user's consent or direction:

• to Google OAuth and Google Ads API endpoints to authenticate and perform the user's requested reads or changes;
• to contracted cloud infrastructure providers, including the managed database and authentication service used by Adport Cloud, solely to host, secure, and operate Adport on our behalf;
• to the user's selected MCP client, AI client, or other integration when the user asks that client to retrieve or act on Adport data; and
• when required by law, or when necessary to investigate fraud, abuse, or a security threat.

Adport does not transfer Google user data to advertising networks, data brokers, information resellers, lenders, or unrelated third parties. Service providers may process data only for contracted service operations and are not authorized by Adport to sell it, use it for advertising, or train shared AI models.

Storage and protection

Adport Cloud stores Google refresh tokens in a tenant-isolated credential vault encrypted at the application layer with authenticated encryption and tenant/provider-bound additional data. OAuth state uses a one-time, expiring, hashed state value and PKCE. Access tokens are obtained when needed and are not stored as durable database records. Tenant data is protected by organization membership checks, role-based authorization, database row-level security, least-privilege grants, rate limits, short-lived sessions, and audit logging. Provider credentials, OAuth client secrets, database administrative keys, and encryption keys are never sent to the browser or included in API responses. Production traffic must use TLS, and operational access is limited to authorized personnel who need it to operate or secure the service.

Retention, revocation, and deletion

Google refresh tokens are retained until the user disconnects Google Ads, deletes the organization, or asks us to delete the data. On Google disconnect, Adport first asks Google to revoke the token and removes the encrypted credential only after revocation succeeds, so a failed revocation can be retried. OAuth transactions expire after 10 minutes and are deleted no later than approximately 24 hours after expiry. Rate-limit records are deleted after approximately one hour.

Pending operations, audit events, and related tenant records use a 90-day default retention period. An organization owner or administrator may configure a period from 1 to 3,650 days; a daily database retention job deletes records beyond that period. Live Google Ads report results are returned to the requesting user or client and are not durably stored by Adport Cloud by default.

An organization owner can delete the organization's Adport Cloud data from the dashboard. This removes the active tenant record and cascades deletion to memberships, settings, connection metadata, encrypted credentials, API-key digests, pending operations, and audit events. If the user has no remaining organization membership, the Adport Cloud login account is also deleted. Infrastructure backups, if enabled for disaster recovery, are isolated from normal use, expire under the hosting provider's backup schedule, and are not restored except for disaster recovery.

Deleting Adport Cloud data does not delete campaigns or records that remain in Google Ads. Users can also revoke access from their Google Account permissions or Google Ads security settings. For help with a deletion or revocation request, contact us at the address below.

Self-hosted Adport

In self-hosted mode, credentials, advertising data, reports, pending operations, findings, and audit records remain on infrastructure controlled by the user. The installation communicates directly with the selected advertising platform and does not send this information to Adport Cloud unless the user separately configures a remote destination. The user controls local security, retention, backups, and deletion.

Other advertising platforms

When a user connects Meta, TikTok, Apple Ads, Microsoft Advertising, or Reddit Ads, Adport accesses only the data and permissions needed to perform the user's requested reporting and account-management features. Adport does not sell that data or use it for unrelated advertising, profiling, lending, surveillance, or shared model training. For manually supplied cloud credentials, removing the encrypted Adport copy does not necessarily revoke the credential at the provider; the dashboard tells the user when separate provider-side revocation is required.

International processing

Adport's cloud infrastructure and connected advertising platforms may process information in countries other than the user's country. Applicable provider terms and contractual safeguards govern those transfers.

Changes

We may update this policy as Adport develops or its data practices change. We will keep this page current and will request renewed consent when required before using Google user data for a materially different purpose.

Contact

Questions, privacy requests, and deletion requests can be sent to ynnickw20@gmail.com.