Privacy Policy

Who this applies to

Three different groups of people touch Adimite, and they are treated differently:

• Visitors who see an ad on a website that uses Adimite. They have no relationship with us and never chose us. Almost nothing is collected about them.
• Account holders — publishers who show ads and advertisers who buy them. They signed up, and we hold what is needed to run their account and pay or bill them.
• Visitors to adimite.com itself, who are not signed in. Nothing is stored about them at all.

If you saw an ad on someone's site

This is the part most ad networks make complicated. Ours is short, because the ad is a static card rendered by a single script — there is no tracking layer underneath it.

Nothing is set on your device

The ad script sets no cookies, writes nothing to local storage, and does no device fingerprinting. There is no tracking pixel, no third-party ad exchange, and no cross-site identifier. Nothing about you follows you to the next site, because nothing about you was stored in the first place.

What is recorded, and why

When an ad is shown or clicked, one row is written so the advertiser can be charged and the publisher paid. It contains which ad, which site, whether it was an impression or a click, what it cost, the time, and two hashes.

Those hashes are the only thing derived from you. Your IP address and user agent string are each combined with a secret salt and run through SHA-256, and only the hash is stored — the originals are never written to the database. They exist so the same address cannot claim 31 paid impressions a minute from one zone, or click one ad fifty times. We only ever compare and count them; there is no feature that reads them back, because they cannot be read back.

We do not know your name, your email, your location beyond what an unread IP implies, or anything you did before or after. Ads are not targeted to you — a campaign is chosen by a weighted lottery among everything eligible for that site, and your identity is not an input.

Clicking an ad

A click passes through adimite.com so the click can be recorded, then redirects to the advertiser. We hand the advertiser nothing about you. Once you land on their site you are on their terms and their privacy policy, not ours.

If you have an Adimite account

Signing up stores what the product needs to function:

• Your account — email address, the name you chose, and a bcrypt hash of your password. The password itself is never stored and cannot be recovered from the hash.
• Your sites, if you are a publisher — the name and URL you registered, and the zone ID we generated for each.
• Your campaigns, if you are an advertiser — the name, headline, body copy, any image you upload, the destination URL, the category, your rates and your budget.
• Your money — wallet and earnings balances, the ledger of top-ups, campaign funding, refunds, transfers and payouts, and payout records.
• Delivery records — the ad events described above, which belong to your campaigns and your sites and are what your dashboard statistics are computed from.

Administrator actions taken on an account — suspending it, adjusting a balance, releasing a payout — are written to an audit log with the administrator's identity, so that decisions about your money are attributable.

If you use the optional AI copywriter, the product description you type is sent to Anthropic to generate ad copy. Nothing else from your account is sent, and the feature is only present when the deployment has been configured with an API key.

Cookies

Adimite sets exactly one cookie, on adimite.com only, and only once you sign in. It holds a signed session token so you stay logged in. It is HttpOnly (unreadable by JavaScript), SameSite=Lax, marked Secure in production, and expires after 30 days. Signing out deletes it.

There are no analytics cookies, no advertising cookies and no third-party scripts on this site, so there is nothing to consent to and no banner to dismiss. Publishers embedding our tag do not need to add Adimite to a cookie banner, because the tag sets nothing.

Payments and payouts

Card payments and bank payouts are handled by Stripe. Card numbers, bank details and identity documents go to Stripe directly and never touch our servers — we could not show them to you if you asked. What we store is the reference to your Stripe account and whether Stripe has told us payouts are enabled for it.

Stripe collects and verifies identity information in its own right in order to meet financial regulations. That processing is governed by Stripe's privacy policy.

Who else processes your data

Adimite is a small operation built on infrastructure providers. Data is processed by, and only by:

• Vercel — hosting, and blob storage for uploaded ad images.
• Neon — the Postgres database everything above is stored in.
• Stripe — payments and payouts, as described above.
• Resend — transactional email, where configured. Used to send account email, not marketing.
• Anthropic — the optional AI copywriter, and only the product description an advertiser types into it.

We do not sell personal data, we do not share it with data brokers, and we do not run advertising or analytics trackers of any kind. These providers may store data outside your country.

How long we keep things

• Account data — for as long as the account exists.
• Ad events — kept as the record behind money that has already moved. Dashboards show a rolling 30 days, but the rows themselves are retained so billing and earnings can be reconciled and disputes answered. Deleting a campaign hides it and stops it serving; its historical events are kept for the same reason.
• Financial records — the ledger and payout history are retained as long as required for tax and accounting purposes.
• Fraud counters — the short-lived per-IP-hash counters that enforce rate limits expire within hours and are swept away.

Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to processing, or to complain to a data protection authority. To exercise any of these, write to jason@jaygriggs.com from the address on your account.

Adimite is operated from Australia. If you are unhappy with how we have handled a privacy request, you can complain to the Office of the Australian Information Commissioner. If you are in the EU, the UK, or another region with its own regulator, you may complain to yours instead.

One honest limit on deletion: we can remove your account and your content, but the financial records of money that actually moved— what an advertiser was charged, what a publisher was paid — are kept, because deleting them would leave the network unable to account for real payments. Those records are tied to an account id, not to a person's identity, once the account is gone.

If you saw an ad and want the hashed record of it removed, we would need the original IP and user agent to compute the hash and find the row. That is more personal data than we would otherwise hold, so in most cases the honest answer is that the record is already effectively anonymous.

Security, and its current limits

Passwords are hashed with bcrypt. Sessions are signed tokens in an HttpOnly cookie. IPs and user agents are salted-hashed rather than stored. The site sends a strict Content Security Policy, and uploads are checked by inspecting the file's actual bytes rather than trusting what the browser claims — SVG uploads are refused outright, because an SVG can carry script.

Two limitations worth stating plainly rather than burying, because they are real today:

• Sessions cannot be revoked before they expire. The session token is stateless with a 30-day life, so changing your password does not sign out a session that is already open elsewhere.
• Email addresses are not verified. Signing up does not require confirming the address, so an address on an account is not proof of control of it.

No system is perfectly secure, and we cannot guarantee absolute security. See the status list on the home page for what else is and is not built yet.

Children

Adimite is not intended for children. Accounts are for people old enough to enter a binding contract, and we do not knowingly collect personal data from children. If you believe a child has provided us data, write to jason@jaygriggs.com and we will remove it.

Changes

If this policy changes materially we will update the date at the top and, for account holders, say so by email. Continuing to use Adimite after a change means the updated policy applies to you.

This policy is operated by Jason Griggs trading as Adimite. Questions and requests go to jason@jaygriggs.com.