Privacy Policy

• Team account details. The name, email address, and a securely hashed password of each authorized user we create for signing in to the dashboard.
• Advertising performance data. Aggregated reporting metrics pulled from our own ad accounts — such as campaign names, impressions, clicks, spend, conversions, and dates. This is campaign-level performance data; it does not include the personal information of the people who saw or clicked our ads.
• Platform access tokens. The OAuth refresh token (Google) and system user token (Meta) that let the Service read our reporting data. These are stored encrypted and are never shown in the interface.
• A sign-in session cookie. Set after you log in, solely to keep you authenticated. We do not use advertising or third-party tracking cookies.

We use the information above only to:

• authenticate authorized team members and secure the dashboard;
• retrieve and display our advertising performance across properties and platforms; and
• generate short, plain-language summaries of our own aggregated metrics to help us read the results.

We do not sell any data, use it for advertising or ad targeting, or build profiles of individuals.

Blue Karma Ads Dashboard accesses Google Ads reporting data through the Google Ads API using read-only access to accounts we own or manage. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we:

• use the data only to provide and improve this internal reporting dashboard;
• do not transfer or sell the data to third parties for advertising or any other purpose;
• do not use the data for advertising; and
• do not allow humans to read the data, except where required for security, to comply with applicable law, or as part of operating the Service for our own accounts with the account owner’s authorization.

You can review or revoke the Service’s access to a Google Account at any time at myaccount.google.com/permissions.

We read reporting insights for our own Meta ad accounts using a system user token with read-only permissions (ads_read). As with Google, this data is used solely to display our advertising performance and is not shared or sold.

The Service is self-hosted on infrastructure we control. Reporting data is stored in our own PostgreSQL database. We apply reasonable safeguards, including encryption in transit (HTTPS), encryption of stored platform tokens (AES-256-GCM), password hashing (bcrypt), and access limited to authorized team members. No method of storage or transmission is perfectly secure, but we work to protect information appropriately.

We do not sell or rent information, and we do not share it with third parties for their own purposes. Data is exchanged only with the advertising platforms whose reporting we read (Google and Meta) in order to operate the Service.

We keep advertising metrics for as long as they are useful for historical reporting, and team account records for as long as a person remains an authorized user. You may request deletion of your account or of stored data by contacting us.

Because this is an internal tool, access is managed by Blue Karma Secrets. Authorized users may request access to, correction of, or deletion of their account information, and may revoke the Service’s platform access as described above.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above.

For any questions about this policy or your data, contact us at privacy@bluekarmasecrets.com.