Privacy

Privacy Policy

AdSlop pays you for active coding time. To do that it needs to know you're a real developer actually working — nothing more. This policy explains, in full, what we collect, why, for how long, and the rights EU/EEA law gives you over it.

1. Who controls your data

AdSlop is operated from Portugal (EU). We act as data controller for the personal data described in this policy. AdSlop is in the process of incorporating as a Portuguese Sociedade por Quotas (Lda.); this section will be updated with our registered company name, address, and NIPC once that registration completes. Until then, the fastest way to reach us about anything in this policy is privacy@adslop.dev.

2. What we collect

AdSlop is built on data minimisation: the extension processes activity locally and only ever sends a tiny, anonymous signal.

Never sent

Your code, file contents, or file names
Keystrokes or the characters you type
Git repository URLs, branches, or commit messages
Environment variables, secrets, or tokens

Only sent

A count of edit events per 30-second window (not what you typed)
Timing gaps between edits — the anti-fraud "is this a human" signal
The current language ID (e.g. typescript) for ad relevance
A one-way device fingerprint (a hash, never reversible to you)
Session timing metadata and your GitHub username/email, for sign-in

Account data. Your email (for sign-in and the notifications you opt into) and, if you set one up, your payout details — an IBAN or PayPal address — are stored to pay you and shown back to you only in masked form. Payout details are used for payouts and fraud prevention (duplicate-account detection uses a one-way hash), never for advertising.

Advertiser data.If you use AdSlop as an advertiser, we hold your billing details (via Stripe, see §4), campaign content, and team member contact information for the account you manage.

3. Why we process it (legal basis)

Contractual necessity

Account creation, session verification, earnings calculation, and payouts — we can’t run the service you signed up for without these.

Legitimate interest

Fraud and abuse prevention (trust scoring, device fingerprinting), ad serving, and product analytics — kept to the minimum needed and balanced against your rights.

Consent

Any non-essential (analytics/marketing) cookie. Nothing in this category loads until you actively accept it in the cookie banner — see §6.

Legal obligation

Retaining earnings and payout ledger records for the period Portuguese tax law requires (7 years).

4. Who we share data with

We don't sell your data, and we don't share anything with advertisers beyond what an ad impression needs (a trust score and a language ID — never your identity). We do use a small number of processors to run the service, each bound by a data processing agreement:

Stripe	Payment processing, advertiser billing, and developer payouts.
Resend	Transactional email delivery (payout notices, password resets, weekly summaries).
GitHub	OAuth sign-in — we receive your GitHub username, email, and account creation date, nothing else.

Some of these processors may transfer data outside the EEA. Where that happens, it is covered by the EU Standard Contractual Clauses or an equivalent adequacy mechanism.

5. How long we keep it

Session metadata (session_reports, device fingerprints)	24 months, then deleted.
Earnings & payout ledger entries	7 years (Portuguese tax law, IRC/IVA record-keeping), then deleted.
Deleted accounts	Identity, credentials, and payout details erased immediately on request; any remaining ledger rows are kept anonymised (pointing at no identifiable person) only for the retention period above.
Anonymised aggregate statistics	Kept indefinitely — cannot be linked back to an individual.
Cookie consent choice	6 months, then you’re asked again.

Deleting your account. One click in dashboard settings (Danger zone). Your identity, credentials, and payout details are erased immediately and the account can never earn again.

6. Cookies

AdSlop's web dashboard sets a small number of strictly necessarycookies — the signed HttpOnly session cookie that keeps you logged in, and a non-secret marker cookie that lets the page know you're signed in without an extra network round trip. These are exempt from consent under ePrivacy/GDPR because the service can't function without them, and we never use them for tracking or advertising.

Any other cookie category — analytics or marketing — is strictly opt-in: nothing in that category runs until you accept it in the cookie banner shown on your first visit. You can change your mind at any time: .

7. Your rights

Under the GDPR, you have the right to:

Access	Get a copy of the personal data we hold about you.
Rectification	Correct inaccurate or incomplete data — most of this you can already do yourself in dashboard settings.
Erasure	Request deletion of your data ("right to be forgotten") — one click in dashboard settings does this immediately, see §5.
Restriction	Ask us to limit how we use your data while a dispute about it is resolved.
Portability	Receive your data in a structured, machine-readable format, or have it transferred directly.
Objection	Object to processing based on legitimate interest, including profiling used for fraud scoring.
Withdraw consent	Revoke cookie consent at any time — see the link at the bottom of this page — with no effect on past processing.

To exercise any of these, email privacy@adslop.dev. If you believe we haven't handled your data lawfully, you also have the right to lodge a complaint with your local supervisory authority — in Portugal, the Comissão Nacional de Protecção de Dados (CNPD).

8. Children

AdSlop is not directed at, and is not knowingly used to collect data from, anyone under 16.

9. Changes to this policy

We'll update this page if what we collect or why changes, and update the date below when we do. Material changes affecting your rights will also be surfaced as a product notification.

Questions? Email privacy@adslop.dev. Have a question not covered here? Get in touch.

Last updated: 8 July 2026