Privacy Policy

About Signal

Signal is a private web application for analyzing paid advertising performance. It is operated by its owner for personal use with advertising accounts the owner manages. It is not a public service and is not offered to other users. This policy explains what data Signal accesses, how it is used, where it is stored, and who it is shared with.

Signing in

Signing in to Signal uses Google sign-in through Supabase Auth. This gives Signal the signed-in user's Google account identity (such as their email address), which Supabase stores as the user's account record and uses to keep them signed in with session cookies. Signal is intended for use by its single owner, and its private pages and data require signing in. Signal does not use advertising or analytics cookies, and the public pages of this site (the homepage and this policy) do not require signing in.

Planned Google Ads integration

Signal does not access Google Ads yet. A read-only Google Ads integration is planned; this section describes how it will work once it is released, and this policy will be updated if that changes.

Signal will connect to Google Ads through Google OAuth. The owner will authorize access with their own Google account, granting the Google Ads API scope https://www.googleapis.com/auth/adwords — the only scope the Google Ads API offers. That scope would technically allow changes to the account; Signal will not use it that way. Signal will only call two read-only Google Ads API operations: listing the accounts the user can access, and running reporting queries (Google Ads Query Language SELECT statements). It will never create, edit, pause or remove campaigns, budgets, conversion settings, billing, users or any other part of the account.

Through those queries, Signal will read:

• account details: customer id, account name, currency, time zone, and whether it is a manager or test account;
• campaign structure: names, ids, statuses and settings of campaigns (including channel type, bidding strategy type, dates and budget amount), ad groups and ads (including ad type and final URLs);
• conversion setup: conversion action names and settings, and conversion goals;
• daily performance: cost, impressions, clicks, conversions and conversion value, per campaign, ad group and ad.

Signal will not request or read Google Ads billing information, account user lists, or audience or customer lists. Google Ads data will be used, stored and shared only as described in the rest of this policy.

Meta Ads data

Signal reads Meta Ads data: ad account details, campaigns, ad sets, ads and creatives (including ad text, headlines, call-to-action and destination URLs, and links to images and videos), and daily performance metrics and conversion events. Signal only reads this data; it never creates or changes anything in the Meta ad account.

How the data is used

Advertising data is used only to provide Signal's own features to the owner:

• dashboards, trends and period comparisons of campaign performance;
• drill-down from accounts to campaigns, ad sets and ads, and analysis of creatives;
• findings and recommendations about where optimization may be needed, and tracking of decisions and their outcomes;

Signal does not sell advertising data, does not use it for advertising, and does not use it for any purpose other than the analysis shown in the app.

AI services

Signal does not currently use any AI service. AI analysis is not available in the app, and Signal does not send advertising data, account information, campaign names, metrics or any other data to OpenRouter or to any other AI provider.

Previously, Signal could send analytical summaries (campaign, ad set and ad names, metrics and recommendations) to OpenRouter to generate written analyses and explanations of recommendations; some previously generated explanations may remain stored in Signal's database and can still be displayed. If an AI service is used again, this policy will be updated before that happens.

Where data is stored and how it is protected

• Synced advertising data, analysis results, recommendations and decisions are stored in a database hosted by Supabase. Database access requires a signed-in user; anonymous access is denied by row-level security.
• The application is hosted on Vercel. Data travels between the browser, Signal and these services over HTTPS.
• All calls to Meta — and, once released, to Google Ads — are made from Signal's server, never from the browser.

Credentials and tokens

The Meta access token Signal uses is stored only as a server-side environment variable in Signal's hosting configuration. It is not stored in the database, never sent to the browser, and Signal does not write it to its logs or error messages.

When the Google Ads integration is released, its Google OAuth client secret and refresh token will be handled the same way, and the short-lived Google access token obtained from the refresh token will be kept only in server memory until shortly before it expires. Access to Google Ads will be revocable at any time from the Google account's security settings (third-party connections); after that, Signal will no longer be able to read the account.

Sharing with third parties

Signal does not sell or rent data, and does not share it with anyone other than the service providers it needs in order to work:

• Supabase — database and sign-in;
• Vercel — application hosting;
• Meta — the advertising platform Signal reads from;
• Google — sign-in, and, once the planned integration is released, Google Ads.

Retention and deletion

Synced data is updated on each sync and stays in Signal's database until the owner removes it; Signal does not delete it automatically after a fixed period. Signal does not have a self-service deletion feature. Once the Google Ads integration is released, revoking its access will stop future syncing but will not by itself remove data already stored. To ask about or request deletion of stored data, contact the owner using the details below.

Contact

Questions about this policy, or requests about data in Signal, can be sent to dana.ephrat@gmail.com.

Changes to this policy

If Signal's handling of data changes, this page will be updated and the date at the top will change. Return to the homepage.