Policies
Data and privacy
A technical description of what data is touched, where, and for how long. Everything here is a property of the system rather than an intention.
This website
The page you are reading makes not one request to a server that is not ours.
- There is no third-party analytics and no tracking pixel. None.
- There is no external CDN: the stylesheet and the two scripts this site uses are served from this same origin.
- Fonts are hosted here and subset to the characters actually used. A network that sells privacy cannot load fonts from a third party.
- The only cookies are functional: the language you chose and the session security pair. There is no advertising or analytics cookie.
The ad-serving path
What happens when the tag requests an ad on a publisher's page.
- A full IP address never leaves the geolocation component. It is truncated to the first 24 bits for IPv4 and the first 48 for IPv6 immediately after the lookup, and an automated test walks the serving package and fails if any other file reads a full address.
- The identifier used for frequency capping is a salted hash of a truncated IP prefix, a hash of the browser string and the language, with the salt rotated daily. It is not a person, it collides between users behind the same network, and it is meant to.
- Geolocation is resolved from a local database inside the process itself, cross-checked against the CDN's headers. No external geolocation service is called.
- Targeting is decided on the content of the page — its URL, its title and its headings — and not on an accumulated profile of whoever is reading it.
The complete list of what the tag sends on each request is published in the documentation, parameter by parameter. There is not one that is missing from that table.
Account data
What is held about an advertiser or publisher with an account, which is a different category from everything above.
- An email address and a hashed password. Passwords are never stored in plaintext or in any reversible form.
- The tax forms a publisher must supply before the first payout, with the identifying details those forms require.
- The result of the sanctions check on the payee name and destination address, kept immutably: a compliance record that could be deleted would be worth nothing.
- An audit log of administrative actions on the account, also append-only.
Consent signals
How consent reaches the ad-serving path, and what we do and do not do with it.
When a consent management platform is installed on the publisher's page, the tag forwards the consent signals it finds there. We do not run a consent flow of our own, and we do not override the publisher's.
The identifier used for frequency capping is derived and rotated daily rather than stored persistently, so it cannot be used to follow anyone from one day to the next.