This policy explains what Clickbreaker records, why, how long we keep it, and who else processes it. It covers two different groups of people: our customers, who are Google Ads advertisers, and the visitors who click on their ads.
Clickbreaker is operated by Clickbreaker LLC, 1209 Mountain Road Pl NE, Ste H, Albuquerque, NM 87110, USA. For anything in this policy, write to legal@clickbreaker.app.
Clickbreaker counts how fast clicks arrive on a Google Ads campaign and pauses that campaign when the advertiser's own limit is reached. Counting happens through a tracking template installed on the advertiser's Google Ads account. When someone clicks an ad, the click passes through our address, t.clickbreaker.app, and is sent straight on to the advertiser's landing page.
For each click, we record only this:
| Campaign ID | Supplied by Google. Tells us which campaign to count and, if needed, to pause. |
|---|---|
| Ad group ID | Supplied by Google. Tells us where inside the campaign the click came from. |
| Google click ID | Supplied by Google. Used so the same click is never counted twice. |
| A one-way fingerprint | A SHA-256 hash we compute at the moment of the click. It cannot be reversed into the data it was made from, and we do not store that data. |
| Time of the click | Used to measure how fast clicks arrive. |
We do not store your IP address, your browser's user agent or your language settings. Your IP address is used for one purpose only: a rate-limiting key that exists for 60 seconds and is then deleted automatically. It is never written to our database and never used to identify you.
The redirect sets no cookie and reads no cookie. We do not follow visitors from one website to another, and we build no advertising or behavioural profile.
We send you to the landing page address that Google puts in the request, exactly as it is. We add nothing to it and remove nothing from it.
Advertisers who choose our Firewall plan install an additional script on their own pages. That script reads technical characteristics of the browser — such as canvas and WebGL rendering, installed fonts and pointer movement — to tell an automated tool from a person. Where the law requires it, that advertiser is responsible for obtaining your consent before the script runs, through their own consent banner. This never applies to our other plans, which place nothing on any website.
To provide the service we hold the account holder's email address, the identifiers of the Google Ads accounts and campaigns they connect, the settings they choose, and the history of pauses and resumes on their account. When a customer connects their Google Ads account, we store the resulting access credentials encrypted with AES-256-GCM. A customer can revoke that access at any time from their Google account, which immediately stops our access.
We use the Google Ads API solely to read the campaigns of accounts our customers have connected, to install the tracking template, and to pause and resume campaigns on their instruction. We never change budgets, bids or ad content.
Deletion runs automatically every day. It is not a manual process.
We use the following providers, and nothing is sold, rented or shared with anyone else:
| Vercel | Hosting of the website, the redirect and the dashboard. |
|---|---|
| Supabase | Database, hosted in Frankfurt, European Union. |
| Upstash | The real-time click counter. |
| Postmark | Sending the emails that tell a customer their campaign was paused or resumed. |
| Cloudflare | Domain name resolution. |
| The Google Ads API, used on the customer's instruction. |
Depending on where you live, you may have the right to ask what we hold about you, to have it corrected or deleted, to object to its processing, or to receive a copy. Write to legal@clickbreaker.app and we will answer within one month.
One honest limitation, for visitors rather than customers: because we set no cookie and store no identifier that lets us recognise you, we usually cannot find a click and link it back to you. That is a consequence of collecting as little as possible, not an attempt to avoid the question.
Marketing emails: we send very few, and every one of them carries an unsubscribe link. You can also write to legal@clickbreaker.app and we will remove you. Emails that tell a customer their campaign was paused or resumed are part of the service itself, not marketing, and stop when the account is closed.
Advertising tracking: there is nothing to opt out of. We set no cookie, we store no identifier that follows you from one website to another, and we build no advertising or behavioural profile. The industry opt-out tools, such as those run by the NAI and the DAA, cover technologies we do not use.
Our database is hosted in Frankfurt, in the European Union. Some of the providers listed above are established in the United States, so part of the processing takes place there. Where personal data of people in the European Economic Area or the United Kingdom is transferred outside those areas, we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one applies to the provider concerned.
All traffic to our addresses runs over HTTPS, and we accept nothing else. The credentials that let us act on a customer's Google Ads account are encrypted with AES-256-GCM before they are stored, with key rotation. The fingerprint we compute for a click is a one-way hash: it cannot be turned back into the data it was made from. Access to production systems is limited to the people who operate the service.
Clickbreaker is a business tool. It is not directed at children and we do not knowingly collect information from them.
If we change what we collect or how long we keep it, we will update this page and change the date at the top. Customers are told by email when the change affects them.
This policy is written in English. If we publish a translation and the two versions differ, the English version is the one that applies.
Clickbreaker LLC, 1209 Mountain Road Pl NE, Ste H, Albuquerque, NM 87110, USA — legal@clickbreaker.app
Clickbreaker