Privacy Policy

1. Who we are

This privacy policy applies to the Chrome extension Facebook Ads Library Scraper Pro (also referred to as AdSpy), published by ScaleForge. The extension's home page and documentation are hosted at getscaleforge.com/extension/adspy. For privacy questions, contact [email protected].

2. What the extension does

AdSpy helps media buyers, agencies, dropshippers, and marketers collect and analyze publicly available advertisements from Facebook's Ad Library (facebook.com/ads/library). The extension runs only on that URL and on Facebook's CDN (fbcdn.net) where ad media is hosted. It extracts ad text, library IDs, start dates, platforms, call-to-action buttons, creative video and image URLs, and landing-page links — all of which Facebook publishes openly for anyone to see.

3. Data we collect

3.1 Account data (when you sign in)

Signing in is required to enable cloud sync, Hunter mode, and Watchlist features. We authenticate through Google Firebase Authentication and store:

• Your email address (used as your account identifier)
• A Firebase user ID (auto-generated; never shared externally)
• Your display name and avatar URL (only if you sign in with Google; optional for email sign-up)
• Your current plan (free, business, or agency) and trial status
• A registration timestamp and the extension version used at sign-up

We do not collect or store your password. Email/password authentication is handled entirely by Firebase Authentication — Firebase hashes your password and we never see the plaintext value.

3.2 Ad data you choose to collect

When you click "Scan Page" on a Facebook Ad Library URL, the extension reads the publicly rendered ad cards and extracts:

• Library ID, start date, platforms (Facebook, Instagram, Messenger, Threads)
• Advertiser page name and profile link
• Ad text, call-to-action, destination link, link headline/description
• Creative video URLs, image URLs, video posters

This data stays on your computer by default. It is uploaded to the ScaleForge API only when you explicitly click:

• Hunt — adds a single creative to your Hunter collection
• Add to Watchlist — tracks an advertiser for periodic re-scans
• Sync to Cloud — uploads a batch of scanned ads

3.3 Usage and event telemetry

To improve the product and monitor reliability, the extension records anonymous event records in your Firebase user document (users/{uid}/events). These events describe your own usage (not other users' data):

• Feature usage (e.g. scan_started, scan_completed, tab_switched, export_clicked)
• Quota hits and upgrade-prompt interactions
• Error telemetry (unhandled exceptions, scan failures) with sanitised stack traces
• A session identifier (generated by crypto.randomUUID(); lives until you close the browser)
• Your plan at the time of the event

Events do not contain the content of the ads you scrape, your email, your tokens, or any credentials. They are tied to your Firebase user ID and are only visible to ScaleForge engineers for debugging and aggregate analytics.

3.4 Local browser data (Chrome storage)

The extension uses chrome.storage.local to cache:

• A ScaleForge API token (short-lived; exchanged from your Firebase ID token)
• Onboarding progress (which steps you have completed)
• UI preferences (language, last active tab, selected role)
• Daily quota counters for free-plan video/photo downloads
• A cache of your most recent scan to speed up Hunter mode

This data lives on your computer. Uninstalling the extension removes all of it.

4. What we do NOT collect

5. Chrome permissions (why we need each one)

sidePanel

Required to display the extension's main interface (scanner, watchlist, hunter) in Chrome's built-in side panel.

activeTab

Required so the extension can read the currently open Facebook Ad Library tab when you click "Scan Page". Access is granted only on explicit user gesture and ends when the tab closes or is navigated elsewhere.

downloads

Required to save CSV/JSON exports and ad videos/images to your local Downloads folder. No file is downloaded without an explicit click.

storage

Used for chrome.storage.local (local settings, API token, onboarding state) and chrome.storage.session (cached scan results during a single browser session).

identity

Used for Google Sign-In via chrome.identity.launchWebAuthFlow. We request only your email and basic profile (name, avatar) scopes. We do not read your Gmail, Drive, Calendar, or other Google services.

alarms

Used to schedule daily auto-scans for watchlist items. Scans run silently in a background tab that is created and immediately closed by the extension — your active tab is never hijacked.

notifications

Used to alert you when an auto-scan fails (so you know to retry) or when a daily scan completes with new results. Notifications are only about your own activity — we never push promotional content.

Host permissions (*.facebook.com, *.fbcdn.net)

Required to read the public Ad Library DOM and to download the creative media referenced by those ads. The extension does not inject code or read data on any other host.

6. Third parties we share data with

We do not sell your data. We share the minimum necessary with:

• Google Firebase (Authentication, Firestore) — stores your account, plan, events, and scanned ad metadata. Firebase is a Google product under Google's privacy policy (policies.google.com/privacy).
• ScaleForge API (getscaleforge.com) — receives the creatives you explicitly hunt or sync, so you can process them further on the ScaleForge web dashboard. The API validates your ScaleForge JWT on every request and stores only the data you send it.
• RapidAPI (Facebook Scraper) — an optional backend used only when you run an API-based search from the extension. We send only your query parameters (keywords, country, status). We do not send your email, token, or any personal data. See RapidAPI's policy.

7. Remotely hosted code

The extension ships with all of its executable code bundled inside the package uploaded to the Chrome Web Store. It does not download, inject, or execute any remote scripts at runtime. Firebase and ScaleForge SDKs are statically linked at build time.

8. Data security

• All network calls use HTTPS / TLS.
• Your ScaleForge API token is short-lived and rotated from your Firebase ID token on demand.
• Passwords are never stored by this extension — Firebase Authentication handles them.
• Firestore Security Rules enforce that your data can be read only by you.

9. Your rights

You can exercise the following rights at any time:

• Access — all of your account data is visible within the extension UI. Ask us for an export of your Firestore document by emailing [email protected].
• Delete — remove the extension from Chrome to wipe all local data. Email us to delete your Firebase account and Firestore documents.
• Sign out — use the "Logout" button in the help panel to clear your session token.
• Port — export any collected ad data as CSV or JSON directly from the extension.
• Object / Restrict — you can stop using the extension at any time; continued processing stops immediately.

10. GDPR (EU users)

If you are in the European Economic Area, you have the rights described in Articles 15–22 of the GDPR (access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority). Our lawful basis for processing account data is the performance of a contract (providing you the service you signed up for); our basis for event telemetry is our legitimate interest in maintaining and improving the product.

11. CCPA (California users)

We do not sell personal information. California residents have the right to know, delete, and opt out as described in the California Consumer Privacy Act. Email [email protected] to exercise these rights.

12. Children

The extension is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has used the service, contact us and we will delete the account.

13. Changes to this policy

Material changes will be announced by updating the "Last updated" date at the top of this page and, where practical, inside the extension's release notes.

14. Meta / Facebook

This extension is an independent tool and is not endorsed, sponsored, or affiliated with Meta Platforms, Inc. "Facebook" and "Meta" are trademarks of Meta Platforms. The extension only interacts with publicly available information that Meta itself publishes in its Ad Library transparency tool.