Legal

Privacy Policy

Last updated: 2026-04-16

This Privacy Policy explains how SpreshApp ("we", "us", "our") collects, uses, shares, and protects information when you use our website and app (the "Service") and our Chrome extension (the "Extension").

Quick links

Scope

  • Service: our website and web app at https://spreshapp.com and related subdomains.
  • Extension: "Spreshapp - Download & Save Facebook Ads" (Chrome extension) that helps you save Facebook Ads Library ads to your SpreshApp account.

This policy does not cover third-party sites and services (e.g., Facebook/Meta, Google) that you may use alongside our Service.

Data we collect

1) Account and authentication data

If you sign in with Google, we receive basic profile information such as your name, email address, profile picture, and a Google identifier (subject to the scopes you consent to).

2) Content you save (Facebook Ads Library data)

When you save an ad, we process information needed to identify and store the ad, which may include:

  • Ad identifiers (e.g., "Library ID" / ad archive ID) and page identifiers
  • Ad metadata (e.g., start date, format)
  • Creative content (e.g., text, image/video URLs, preview image URLs)
  • Country you selected in Ads Library (when available)

This data is used to provide "saved ads" and related features in your dashboard.

3) Usage and device data

We may collect basic technical data when you access the Service, such as IP address, timestamps, request metadata, and diagnostic logs (e.g., error logs) to keep the Service secure and working.

4) Cookies and similar technologies

We use cookies for authentication and basic session functionality (for example, cookies named auth_token and user). We do not intentionally use cookies to build advertising profiles.

How we use data

  • Provide the Service: create accounts, authenticate users, and deliver features.
  • Save and display ads: store your saved ads and show them in your dashboard.
  • Security and fraud prevention: protect accounts and prevent abuse.
  • Support: respond to questions and troubleshoot issues.
  • Improve the Service: fix bugs and improve reliability and performance.

How we share data

We do not sell your personal data. We may share data with:

  • Service providers that help us run the Service (e.g., hosting, databases, and object storage). For example, saved ad media may be stored in cloud object storage (such as Cloudflare R2).
  • Authentication providers (e.g., Google) when you choose to sign in with them.
  • Legal and safety: if required by law or to protect rights, safety, and security.

If we use processors/sub-processors, we aim to restrict access to what's necessary to provide the Service.

Data retention

  • Account data: retained while your account is active and as needed to provide the Service.
  • Saved ads: retained until you delete them or delete your account (subject to backup and legal retention needs).
  • Logs: typically retained for a limited period for security and troubleshooting.

Security

We use reasonable technical and organizational measures to protect data. No method of transmission or storage is 100% secure, but we work to reduce risk and respond to incidents.

International transfers

Depending on where you live and where our providers operate, your data may be transferred and processed outside your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

Your privacy rights

EEA/UK users

You may have rights to access, correct, delete, restrict, object to processing, and port your data, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.

Other regions

Depending on your location, you may have similar rights under local laws. Contact us and we'll respond as required.

Chrome Extension privacy

What the Extension does

The Extension operates on supported ad-library and ad-transparency pages from Meta, TikTok, and Google. It adds in-page controls that let you save ad details into your SpreshApp account, download creatives locally, open an analysis side panel for the ads currently on the page, and follow a brand from supported Meta library pages.

Permissions and why we need them

storage
  • Why we need it: to store extension settings and local session/state such as user preferences, auth tokens, selected folders, page-image cache entries, and temporary analysis state.
  • What it allows: saving small amounts of data in Chrome's extension storage so the extension works consistently across browser restarts.
  • Privacy note: used for extension functionality/preferences; not used to build user profiles or track browsing.
activeTab
  • Why we need it: to let the popup or user-triggered extension actions interact with the currently active supported tab.
  • What it allows: temporary access to the currently active tab after a user gesture. This permission complements the host permissions below; the Extension also uses declared content-script matches on supported sites.
  • Privacy note: we do not read unrelated tabs or browsing history; this permission is used only for extension features on supported ad-library and app pages.
identity
  • Why we need it: to let the user sign in with Google from the extension (OAuth 2.0) so we can associate "saved ads" with the correct user account.
  • What it allows: using Chrome's chrome.identity APIs to start the OAuth flow and identify the signed-in user (scopes: openid, email, profile).
  • Privacy note: we use it only for authentication and account linking; we do not access the user's passwords, contacts, or Google Drive data.
downloads
  • Why we need it: to let you download ad creatives, including single images/videos and carousel ZIP files, directly to your device.
  • What it allows: starting downloads only when you choose a download action in the Extension.
  • Privacy note: we do not inspect your download history; the permission is used only to deliver files you explicitly request.
sidePanel
  • Why we need it: to show the in-browser analysis panel for the ads you choose to analyze.
  • What it allows: opening a Chrome side panel attached to the current tab when you trigger the analysis feature.
  • Privacy note: the side panel only displays extension output for the current user-requested analysis session.
Host permissions
  • Why we need it: the Extension must be able to run on supported Meta, TikTok, and Google ad pages, call our backend API, and upload media to our storage provider when you save content to your account.
  • Domains covered:
    • *://*.facebook.com/* (Meta Ads Library pages and related creative fetches)
    • https://ads.tiktok.com/* (TikTok Creative Center pages)
    • https://adstransparency.google.com/* and https://tpc.googlesyndication.com/* / https://*.googlevideo.com/* (Google Ads Transparency and supported video frames)
    • https://*.spreshapp.com/*, https://*.spresh.app/*, and http://localhost:1323/* / http://localhost:5173/* (our production and local development services)
    • https://*.r2.cloudflarestorage.com/* (upload destination for media you choose to save to your account)
  • Privacy note: access is limited to these domains rather than all sites, and is used only for the Extension features described in this section.

Extension data handling

  • Local storage: the Extension stores items like an API URL, auth token, selected folder, cached page-image references, temporary analysis state, an anonymous analytics identifier, and a small local flag indicating whether you already submitted the in-extension review prompt.
  • On-page access: on supported Meta, TikTok, and Google ad pages, the Extension reads page content and related network responses needed to identify the ad, its media, and related metadata for the feature you choose to use.
  • Transmission: when you save an ad, follow a brand, or request ad analysis/chat features, the relevant ad/page data and your authentication token are sent to our API to fulfill that specific request.
  • Media uploads: when you choose to save supported media into your SpreshApp account, the Extension may first upload the media or page image to our cloud storage using a short-lived upload URL issued by our API.
  • Product analytics: the Extension sends limited product-analytics events to our analytics provider so we can measure extension usage and improve the product. These events may include popup opens, login attempts, successful logins, save actions, save completions, quota/subscription modal displays, upgrade CTA clicks, and review-widget interactions. Depending on whether you are signed in, these events may be associated with either a local anonymous extension identifier or your account identifier. We do not use this telemetry to serve ads or sell your data, and it is not intended to track your browsing across unrelated websites.

To remove Extension data, you can sign out in the Extension popup and/or uninstall the Extension via Chrome's extension settings.

Children's privacy

The Service is not intended for children under 13 (or the age required by your jurisdiction). We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date above and, where appropriate, provide additional notice.

Facebook / Meta OAuth integration

If you choose to connect your Facebook / Meta Ads account to SpreshApp, we request access via Facebook's OAuth flow. We only request the following permissions (scopes):

ads_read
  • Why we need it: to read ad campaigns, ad sets, and creatives from your connected Meta Ads account so you can analyze and organize them inside SpreshApp.
  • What it allows: read-only access to your ad library data. We cannot create, edit, or delete ads or campaigns.
  • Privacy note: data retrieved is stored in your SpreshApp account and is not shared with third parties beyond what is described in this policy.
read_insights
  • Why we need it: to retrieve performance metrics (such as impressions, clicks, spend, and reach) for your ads so SpreshApp can surface analytics and help you identify winning creatives.
  • What it allows: read-only access to aggregated ad performance data. We cannot modify your ad account settings, billing, or targeting.
  • Privacy note: insights data is used solely to power in-app analytics features for your own account and is not sold or used for advertising purposes.

We do not request any permissions beyond the two scopes listed above. You can revoke access at any time via your Facebook Business Integrations settings. Revoking access will prevent SpreshApp from fetching updated data but will not automatically delete data already stored in your account.

Contact

For privacy questions or requests, contact us at support@spreshapp.com.

This page is provided for general informational purposes and does not constitute legal advice.