Privacy Policy
EFFECTIVE: AUGUST 23, 2026
AdReckon ("we", "us") provides Google Ads reporting through the Model Context
Protocol. This policy describes what data we collect, how we use it, and your choices.
It applies to the service at api.adreckon.com.
Information we collect
When you connect your Google account, we receive and store:
- Google account identity: your Google account ID, email address, and name, used to identify your AdReckon account.
- Google Ads authorization: an OAuth refresh token granting access to the Google Ads accounts you can access. It is stored encrypted (AES-256-GCM) on our servers and is never exposed to you, to AI assistants, or to any third party.
- Google Ads reporting data: campaign structure (account, campaign, ad group, ad, keyword names and settings) and performance metrics (impressions, clicks, cost, conversions, and similar), synced nightly and stored in our database to answer your queries.
- How you reached us: if you arrived from one of our own ads or from a link on another site, we record which one — see below.
Cookies and how you reached us
We set three first-party cookies on our public pages, and no third-party ones. There is no Google Analytics, no advertising pixel, and no tracker belonging to anyone else on this site.
ar_click— the click identifier Google adds to the address when you arrive from one of our own ads.ar_src— where the visit came from: the campaign tags in the address, or otherwise the website that linked to us. If you came directly, nothing is stored.ar_vid— a random number with no meaning outside our site, so that a visit and a later sign-up can be recognised as the same browser.
All three last 90 days and are used for exactly one purpose: to tell us which of our own advertising actually brings people here, including by reporting a sign-up or a payment back to Google Ads against the click that led to it. We record the page visited and the site that linked to us; we do not store your IP address or browser fingerprint alongside them, and we do not use any of this to build a profile of you, to advertise to you elsewhere, or to share anything with a third party. Blocking or clearing these cookies costs you nothing — the service works identically without them.
How we use it
Exclusively to provide the service to you: answering the queries you (or an AI assistant acting on your instruction) make about your own advertising data, and — when you or your AI assistant instruct it — making campaign changes in your accounts (pausing/enabling campaigns, adjusting budgets, adding negative keywords). Every change is recorded in an audit log available to you on request. We do not sell, rent, or share your data with third parties. We do not use it for advertising. We do not train AI or machine-learning models on it.
Google user data (Limited Use disclosure)
AdReckon's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Ads data is accessed and modified solely to provide the user-facing reporting and campaign management features you request, and is not transferred except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with prior notice to you.
Storage and security
Data is stored on servers we control. OAuth refresh tokens are encrypted at rest; access tokens for the AdReckon API are stored only as cryptographic hashes; transport is TLS everywhere. Reporting data and campaign management are scoped per user: each connected user can only query or modify accounts their own Google grant can access.
Retention and deletion
We retain your data while your account is connected. You can disconnect in two places: in the dashboard under Accounts & logins — per ad account, or the whole Google login, in which case we also revoke the refresh token at Google — or directly at myaccount.google.com/permissions, which invalidates our stored token immediately. Disconnecting stops all access and all syncing; reporting data already synced is kept so that reconnecting is instant. To have your identity, credentials, and synced reporting data deleted, email [email protected] and we will delete them within 30 days.
Changes
We will post any changes to this policy on this page with an updated effective date.