Skip to content

Effective Date:

Privacy Policy

How AdCrunch collects, uses, and protects your information.

AdCrunch Inc. (“AdCrunch,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use AdCrunch (“Service”), our website, and related services.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

We collect the following categories of information:

Account & Contact Information

  • Name, email address, company name, and billing details when you create an account or subscribe.

Ad Account Connection Data

  • OAuth authorization tokens and permissions from Meta, TikTok, X (Twitter), Snapchat, and other supported ad platforms.
  • We use read-only scopes whenever possible.
  • We do not store your ad platform usernames or passwords.

Ad Campaign Data

  • Campaign setup details (creatives, targeting, bidding strategies)
  • Performance metrics (impressions, clicks, spend, ROAS, CTR, CPL, conversions, audiences)
  • This data is accessed only through official platform APIs via your authorized OAuth connections.

Usage & Technical Data

  • MCP queries and interactions with AI agents
  • IP address, browser type, device information, and product analytics events (see “Product Analytics” below)
  • Session recordings of our website and of the AdCrunch console (see “Session Recordings” below)
  • Logs of MCP endpoint calls for security and service improvement

Product Analytics

  • We use PostHog for product analytics. PostHog receives analytics events from our website, from the AdCrunch console, from our sign-in service, and from the MCP server.
  • When you sign in, our sign-in service sends an event to PostHog. When you sign up, it sends one more event. Each event contains your user id, the sign-in method (Google or an email code), and the AdCrunch environment.
  • PostHog receives the id and the name of each organization. We link the analytics events that you make in an organization to that organization. The name of an organization can be the name of a person.
  • We do not anonymize these events. When you sign in, we link your analytics events to your account by your user id. The console also sends your email address to PostHog.

Session Recordings

  • PostHog records sessions on our website and in the AdCrunch console.
  • A recording shows the pages that you visit and what you do on them: your mouse movements, your clicks, and your scrolls. It can contain the text on the page, such as the names and the metrics of your campaigns in the console.
  • A recording also contains the log messages that the page writes in your browser, and the address and the timing of each network request that the page makes.
  • We mask the text that you type in form fields.
  • When you sign in, we link your session recordings to your account, as we do for your analytics events.

Support Widget

The Support widget lets you write to the AdCrunch team from our website and from the AdCrunch console. PostHog supplies the widget. One thread in the widget is a ticket. When you write to us in the Support widget, PostHog receives:

  • The email address that you type. The widget does not ask for your name. In the AdCrunch console, the widget does not ask for an email address, because PostHog already has the email address of your account.
  • The text of each message
  • The page where you wrote

Each ticket links to your analytics events and to your session recording. The AdCrunch team reads the tickets and replies to you in the widget or by email.

MCP Usage Data

When an AI agent that connects to AdCrunch calls a tool, we send one analytics event to PostHog. We send the same event when the Adgent, the chat agent of the AdCrunch console, calls a tool. A tool call event contains:

  • The name of the tool
  • The names of the arguments
  • The duration of the call
  • Whether the call failed, and the error code of a failed call

An AI agent that starts a session with a handshake sends the name and the version of its agent application. We send them to PostHog in one event.

Each MCP usage event also contains:

  • Your user id and your organization id
  • The OAuth client id of an external agent application
  • The user agent and the client type that the agent application sends in its request headers
  • Whether the agent is the Adgent or an external agent
  • The MCP protocol version
  • The AdCrunch environment and software version that handled the event

We never send argument values, tool results, or error messages to PostHog.

Capability Requests

  • A capability request is a task that an AI agent asked for and that no AdCrunch tool can do.
  • When an AI agent calls the request_capability tool, the text that the agent writes goes to PostHog. The text describes the task. The event also contains the data that each MCP usage event contains (see above).
  • The tool tells the agent not to include names, email addresses, or account ids in the text.
  • We do not store the text in our own database.

Ad Measurement

We advertise AdCrunch on Meta and on X. To measure the results of these ads, we send data to Meta and to X.

PostHog sends events to Meta through the Meta Conversions API. No Meta pixel loads on our pages. PostHog sends an event to Meta when you do one of these actions:

  • You view a page of our website, of our documentation, or of our sign-in service.
  • You create an organization.
  • You connect an ad account. The event contains the name of the ad platform.
  • You connect an AI agent. The event contains the name of the agent application.
  • You start a trial.
  • You pay for a subscription. The event contains the amount and the currency of the payment.

Each event to Meta also contains:

  • The name of the event, its time, and its event id
  • The address of the page. When you connect an AI agent, we remove the query from the address.
  • The Meta click id, when the address of the page contains one. Meta adds this id to the address when you click a Meta ad.
  • The values of the Meta cookies _fbp and _fbc, when you accepted them and you signed in (see “Cookies and Tracking Technologies” below)
  • The user agent of your browser
  • Your email address, when we know it
  • Your user id. Before you sign in, this is the random id that PostHog gives your browser.
  • Your approximate location: the city, the region, the postal code, and the country. PostHog gets this location from your IP address. We do not send your IP address to Meta.

We hash your email address, your user id, and each part of your location with SHA-256 before we send them to Meta.

The X pixel loads on our website through Cloudflare Zaraz. Your browser sends each request of the X pixel directly to X. Thus X receives:

  • The address of the page
  • The X click id, when the address of the page contains one. X adds this id to the address when you click an X ad.
  • The identifiers in the X cookies (see “Cookies and Tracking Technologies” below)
  • Your IP address and the user agent of your browser

AI Agent Interaction Data

  • Natural-language queries sent through the Service and the resulting responses (stored only as needed to deliver the Service)

We do not collect sensitive personal data (such as health, racial, or religious information) through the Service.

2. How We Use Your Information

We use the collected information to:

  • Provide and maintain the Service (including the MCP server that lets AI agents query your ad data)
  • Enable secure OAuth connections and normalized cross-platform reporting
  • Process your subscription and billing
  • Improve the Service through product analytics and product development
  • Measure the results of our own ads on Meta and on X
  • Communicate with you about account, updates, or support
  • Detect and prevent fraud, abuse, or security issues
  • Comply with legal obligations

We do not use your ad data or queries to train any large language models or for any purpose unrelated to providing the Service.

3. How We Share Your Information

We share information only in the following limited cases:

  • With Ad Platforms: To fulfill your OAuth connections and retrieve campaign data (strictly as authorized by you).
  • Service Providers: With trusted subprocessors (e.g., cloud hosting, payment processors, analytics tools, and the ad platforms Meta and X) who are contractually obligated to protect your data.
  • Product Analytics and Support: PostHog is our subprocessor for product analytics, for session recordings, and for the Support widget. It receives the analytics events, the session recordings, the tickets, the MCP usage data, and the capability requests that this policy describes. We use PostHog Cloud EU, which stores this data in the European Union.
  • Ad Measurement on Meta: Meta Platforms Ireland Limited receives the events that “Ad Measurement” above describes. The purpose is ad measurement. We hash your email address, your user id, and your location with SHA-256 before we send them. Meta uses this data under the Meta Privacy Policy.
  • Ad Measurement on X: X receives the data of the X pixel that “Ad Measurement” above describes, and the X cookies set in your browser. The purpose is ad measurement. X uses this data under the X Privacy Policy.
  • Legal Requirements: If required by law, subpoena, or government request.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets (with notice where required).

We never sell your personal information or ad campaign data to third parties for marketing or advertising purposes.

4. Data Security

We implement industry-standard security measures, including:

  • Encryption of data in transit (TLS) and at rest
  • Secure storage of OAuth tokens
  • Strict access controls and regular security audits
  • Anonymization where possible

However, no system is 100% secure. You are responsible for maintaining the security of your own ad platform accounts and credentials.

5. Data Retention

  • We retain your account information for as long as your account is active.
  • Ad campaign data is retained only as long as necessary to provide the Service (typically while your subscription is active).
  • You may request deletion of your data at any time (see “Your Rights” below).
  • PostHog keeps analytics events, MCP usage data, capability requests, and tickets for the retention period of our PostHog plan.
  • PostHog keeps session recordings for 30 days.

6. Your Rights and Choices

Depending on your location, you may have the following rights:

  • Access, correction, or deletion of your personal information
  • Opt-out of certain processing (including any automated decision-making)
  • Data portability
  • Withdrawal of consent (where applicable)

To exercise these rights, contact us at privacy@adcrunch.dev. We will respond within 30 days (or sooner where required by law).

California Residents (CCPA/CPRA): You have additional rights regarding the sale of personal information (we do not sell data) and can submit a verifiable consumer request.

EU/UK Residents (GDPR): We act as a data processor for your ad data. Our lawful basis for processing is performance of contract and legitimate interests.

Ad Measurement (GDPR): Our lawful basis for each ad measurement item is our legitimate interest in measuring the results of our own ads, except for the Meta cookies:

  • The events that PostHog sends to Meta: legitimate interests
  • The Meta cookies _fbp and _fbc, and their values in the events to Meta: your consent
  • The data of the X pixel and the X cookies: legitimate interests

7. Cookies and Tracking Technologies

We use essential cookies to operate the Service. We also use limited analytics cookies from PostHog to understand usage patterns. When you sign in, we link the analytics events to your account. The Support widget keeps an identifier in the local storage of your browser. This identifier gives your browser access to its tickets. You can manage preferences via your browser settings.

Our website asks for your consent before it sets the advertising cookies of Meta. A bar at the bottom of the page has two buttons, “Accept” and “Refuse”. If you do not answer, we set no advertising cookie of Meta.

  • adcrunch_consent on .adcrunch.dev keeps your answer, “accept” or “refuse”, for 6 months. After 6 months, the bar asks again.
  • _fbp on .adcrunch.dev, only after you click “Accept”. It keeps a random identifier of your browser for 90 days.
  • _fbc on .adcrunch.dev, only after you click “Accept” and only when you come to our website from a Meta ad. It keeps the Meta click id for 90 days.

_fbp and _fbc are first-party cookies. A library from Meta in our code sets them, and each visit after “Accept” starts their 90 days again. Your browser does not send them to Meta. When you sign in and your answer is “accept”, we read them, and PostHog sends their values to Meta with the events that “Ad Measurement” above describes.

To withdraw your consent, click “Cookie settings” at the bottom of each page of our website, then click “Refuse”. “Refuse” deletes _fbp and _fbc.

The X pixel sets advertising cookies on our website. X uses them to measure our ads:

  • _twpid and _twsid on .adcrunch.dev, on each visit. Each keeps an identifier for about 390 days.
  • _twclid on .adcrunch.dev, when you come to our website from an X ad. It keeps the X click id for about 390 days.

The X pixel also lets X set its own cookies on the domains of X, such as t.co and twitter.com. X controls the names and the lifetimes of those cookies.

8. International Data Transfers

If you are outside the United States, your data may be transferred to and processed in the United States or other countries. We use appropriate safeguards (such as Standard Contractual Clauses) to protect your information.

9. Children’s Privacy

The Service is not intended for anyone under the age of 18. We do not knowingly collect data from children.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice in the Service. Your continued use after changes constitutes acceptance of the updated policy.

11. Contact Us

For any questions about this Privacy Policy, please contact us at: