Privacy Policy

1. Who we are

KeywordAxe ("the extension", "we") is an independently developed Chrome extension that adds keyboard shortcuts, bulk negative keyword management, and anomaly alerts to Google Ads. We are not affiliated with, endorsed by, or sponsored by Google.

2. Data we do not collect

The following data never leaves your browser (with one narrow exception: if you enable the optional Google Ads connection described in section 4, reporting data transits our relay server on its way from Google to your browser — it is never stored or logged there):

• Campaign names, ad group names, ad copy, or asset names
• Search terms, keywords, or any text content of your ads
• Spend figures, budget amounts, conversion counts, or revenue
• Google Ads account IDs (CIDs / OCIDs / MCC numbers)
• Your Google account email or any identifier linkable to you
• URLs of pages you visit other than the high-level Google Ads route (e.g. /aw/campaigns) when telemetry is enabled

Negative keywords you add through KeywordAxe and the rules you configure are stored locally in your browser via chrome.storage.local. They are never transmitted off-device.

3. Data we collect (only if you opt in)

Two independent toggles in Settings → Privacy control what, if anything, leaves your browser. Both are off by default.

3.1 Anonymous Usage Data ("telemetry")

When enabled, the extension sends anonymous events to a Cloudflare Worker we control at ka-telemetry.rktreddy.workers.dev. Each event contains only:

• Event name (e.g. shortcut_used, keywords_blocked, upgrade_clicked)
• Extension version (e.g. 1.0.13)
• Subscription tier (free / pro / agency)
• UI theme (dark / light)
• Coarse-grained Google Ads route name when relevant (e.g. campaigns, keywords — never query strings, never IDs)
• Event-specific metadata that contains no personal data: which shortcut key was pressed, how many keywords were bulk-blocked, anomaly severity bucket, etc.
• A timestamp

We do not set cookies, fingerprints, or persistent identifiers. We do not record your IP address. The Cloudflare Worker is configured to discard the IP at the edge.

3.2 Anonymous Error Reports

When enabled, uncaught exceptions inside the extension are sent to Sentry so we can fix bugs. Each report contains:

• The error message and JavaScript stack trace
• Extension version
• The high-level page route the error occurred on (e.g. service-worker, content-script)

Stack traces may include URL fragments from the Google Ads page that triggered the error. These can incidentally include account or campaign identifiers present in the URL. We do not use them, but you should treat error reporting as a separate opt-in for that reason. Error reports are rate-limited to 10 per minute per browser.

4. Google Ads API connection (optional)

You can optionally connect your Google Ads account (Settings → Google Ads Connection) so the extension can show accurate, API-backed reporting and alerts instead of reading numbers off the page. This is entirely optional — every feature keeps working without it.

• What we access: read-only reporting data (campaign metrics, search terms) for accounts you authorize via Google sign-in, using the official Google Ads API. We request the adwords OAuth scope. We never create, modify, or delete anything in your account.
• Where your tokens live: on your device only, in extension storage. Our relay server exchanges and refreshes tokens on your behalf (it holds the OAuth client secret) but does not store them.
• The relay: API requests pass through a KeywordAxe-controlled Cloudflare Worker (keywordaxe-api.rktreddy.workers.dev) that attaches our API credentials and forwards your query to Google. It is stateless: it does not store, log, or inspect tokens, requests, or responses, and only accepts read-only reporting queries.
• Where your data goes: reporting data is displayed in your browser and kept in local extension storage only. It is never sent to our telemetry, stored on our servers, shared, or sold.
• Disconnecting: the Disconnect button revokes the authorization with Google and deletes all tokens from your device. You can also revoke access at any time at myaccount.google.com/permissions.

4.1 Sharing, transfer, and disclosure of Google user data

We do not share, sell, transfer, or disclose Google user data to any third party. Specifically, Google user data obtained through the Google Ads API is never provided to advertisers, data brokers, analytics services, AI/ML model training, or any other external party. The sole processing outside your device is transit: API requests and responses pass through our relay, which runs on Cloudflare Workers (Cloudflare, Inc. is our infrastructure provider and acts only as a conduit). The relay does not store, log, or use this data, and Cloudflare does not access it. We would disclose data only if compelled by valid legal process, and no mechanism exists to do so retroactively because nothing is retained.

4.2 How we protect Google user data

• Encryption in transit: every connection — browser to relay, relay to Google — uses HTTPS/TLS. No data ever travels unencrypted.
• Token protection: OAuth tokens are stored only on your device via Chrome's extension storage, scoped to the extension. They are never written to our servers. Access tokens are kept in session storage and expire automatically.
• Credential separation: our API credentials (developer token, OAuth client secret) are stored as encrypted server-side secrets on Cloudflare, never shipped inside the extension or committed to source code.
• Least privilege by architecture: the relay is stateless (no database, no request/response logging), accepts only read-only reporting queries, restricts browser callers to the extension's origin, and rate-limits token requests to resist abuse.
• Revocation: disconnecting in Settings revokes the grant with Google and deletes all tokens from your device immediately; you can also revoke at myaccount.google.com/permissions at any time.

KeywordAxe's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Third parties

We do not sell, rent, or share data with advertisers, data brokers, or any third party other than the operational services listed above.

6. How to opt in or opt out

A few seconds after you first land on a Google Ads page, you may see a one-time prompt asking if you want to enable Anonymous Usage Data. It is shown once per install — clicking either "Enable" or "Not now" dismisses it permanently. You can always change your choice later via Settings:

1. Click the KeywordAxe icon in your browser toolbar.
2. Click the gear icon to open Settings.
3. Scroll to the Privacy section.
4. Toggle Anonymous Usage Data and Error Reporting independently.

The change applies immediately to all open Google Ads tabs — no reload required. If you switch a toggle off, queued events are discarded and no further events are sent until you switch it back on.

7. Data retention

• Telemetry events: retained in aggregate for 90 days, then deleted.
• Error reports: retained by Sentry per their default retention (90 days for the free tier we use).
• Local extension data (your blocked keywords, rules, settings): never leaves your browser; deleted when you uninstall.

8. Children

KeywordAxe is not directed at children under 13 and we do not knowingly collect data from them.

9. Changes to this policy

If we change what's collected, we will update this page and bump the date at the top. Material changes will also be called out in the extension's changelog and on the Chrome Web Store listing.

10. Contact

Questions, complaints, or data deletion requests: open an issue on GitHub or use the in-extension feedback link.