AdShy Privacy Policy

Effective date: October 1, 2026 · Applies to the AdShy extension for Chrome and Firefox and the server adshy.asistbot.ru

Service operator: Vyacheslav Rodkin, individual developer. Contact: zzulyss@gmail.com.

1. What the extension does

AdShy detects and hides advertising blocks on web pages. A content script analyses the page inside your browser. Blocks with an explicit ad label ("Advertisement", "Sponsored", "Promoted", etc.; multilingual labels and known advertising slots are recognised locally) are hidden locally without contacting the server. Only if you have accepted the first-run consent screen, blocks with ad signals that have no stored answer in the browser are sent to the server. If you decline (or have not decided yet), nothing is sent to the server and only local detection runs.

Availability: in some countries or networks, AI checks may be unavailable because our server or the AI provider can't be reached. On-device hiding of labelled ads always works, even offline. When the server cannot be reached, nothing is sent and unrecognised blocks stay visible.

1. Consent

When the extension is first installed it opens a consent screen and does not register or send anything until you press "Accept". The screen states what is sent (site origin, cleaned excerpts of up to 600 characters of suspected ad blocks, link domain and element type, an anonymous installation ID), that it goes to the AdShy server and on to OpenRouter and an AI model provider, and links to this policy. "Decline" keeps the extension in local-only mode. You can withdraw or give consent at any time in the toolbar popup; withdrawing deletes the server token and the queue of unsent marks from the browser. Your account record on the server can be deleted on request (section 10).

2a. Firefox data-collection permissions

Firefox: In the Firefox version of AdShy, AI checks additionally require Firefox's built-in data-collection permissions. When you press "Accept" (or "Turn on" in the toolbar popup), Firefox asks you to allow access to websites and to the AdShy server and to share: website content (the cleaned text of suspected ad blocks, section 3.2), browsing activity (the origin of the page where a suspected ad was found), personally identifying information (block text may contain names or addresses, which are not masked) and technical and interaction data (the random installation ID, extension version and your "ad / not an ad" marks, sections 3.1 and 3.3). These permissions are optional: if you do not grant them, nothing is sent and AdShy works locally only. AdShy contacts its server only when both your consent in the extension and these Firefox permissions are in place. You can revoke them at any time in about:addons → AdShy → Permissions and data; pressing "Turn off" in the popup also removes them. In Firefox, the data described in section 8 is kept in the extension's local storage (browser.storage.local).

1. Data sent to the server (only after consent)

3.1. Installation registration

After you accept the consent screen the extension sends a random installation ID (UUID, created locally) with the extension version number. The server creates an account record and returns a signed token, which is stored in the extension and sent with requests.

3.2. Block check (up to 20 blocks per request)

• the installation ID and the token;

• the page origin only — scheme, domain and port (e.g. https://example.com), without path, query or page title. This is web browsing information: the server learns the domain of every site on which a suspected ad block was found (it does not receive a list of all pages you visit);

• for each block: up to 600 characters of its text after cleaning — the visible text and, for images, the alt/title attributes; links are replaced with domain names, e-mail addresses with [email], and long numbers (including phone numbers with spaces, parentheses or separators) with [number]. Names, postal addresses and other free text are not masked.

• the domain the block links to;

• the element type (article, div, aside, iframe, …) and technical ad signals (e.g. sponsored, banner, promo, iframe).

3.3. Your marks

When you click "Yes", "Not an ad" or use the context menu item "AdShy: hide as ad", the server receives the key (hash) of the checked block and your decision (ad / not an ad). Context-menu marking first checks the block as in 3.2 to obtain that key. Votes count towards a shared verdict only when they come from different accounts and different networks.

1. What is not sent

• full page HTML, full page URLs (path and query), page titles, cookies;

• form and input contents, passwords; blocks inside forms, input fields, chats and messages are not analysed;

• pages that look private are not analysed at all, and the same list is enforced again by the server (if a request for such a site ever reaches it, it is rejected without being classified, charged or forwarded): banks and other financial sites (for example Chase, Citi/Citibank, Bank of America, Wells Fargo, Capital One, Barclays, HSBC, Santander, American Express, Schwab, Fidelity, Vanguard, Commonwealth Bank, Westpac, ANZ, NAB, RBC, Scotiabank, BMO, DBS, OCBC, UOB, Maybank, ICBC, Itaú, Bradesco, Mercado Pago, and any host with a bank/banking label); PayPal and Stripe checkout/billing hosts and checkout./pay./payments. subdomains; health portals (MyChart and patient/patientportal/health hosts); webmail and messengers (Gmail, Proton Mail, Outlook, Yahoo/AOL/iCloud/Fastmail/Zoho mail, Yandex and Mail.ru mailboxes, Telegram Web, WhatsApp Web, Discord); sign-in hosts (login., auth., accounts., signin., passport., id., oauth., webmail., inbox.); pages with a password or payment-card field or embedded Stripe/PayPal frames; paths containing checkout, payment, billing, login, account, settings, messages, inbox, chat, patient, password, webmail; sites on your exclusion list (client side).

These rules are a best-effort list, not a guarantee: they do not cover every bank, medical or other private site in the world. Add such sites to the exclusion list in the extension settings.

1. IP address

The server receives your IP address as part of any network connection. The service does not store IP addresses in plain form:

• for rate limiting it computes an HMAC-SHA256 keyed hash of the IP address (for IPv6, of the /64 network prefix), truncated to 32 hex characters, used as a counter key that is deleted after 2 minutes (per-minute limit), 2 hours and 2 days (registration limits); registration is also limited per network with a similar hash of the IPv4 /24 (IPv6 /48) network, kept for the same 2 hours / 2 days;

• to count votes from distinct networks it stores an HMAC-SHA256 keyed hash of "block key + IP address" for 7 days after the last vote on that block.

These hashes use a server-held secret key and separate purposes for request limits, registration, subnets and voting. We do not link the hashes to other data. No web-server access logs are kept for adshy.asistbot.ru; web-server error logs may briefly contain IP addresses of failed connections.

1. Server-side retention

Data — Retention

AI answer cache: key = SHA-256 of (origin, normalised text, link domain, element type, signals, model); value = a numeric score only. The block text itself is not stored. — 7 days

Check "receipt" (user ID + block key), needed to accept your mark — 7 days

Votes per block (user ID → decision; IP hash → decision) and totals — 7 days after the last vote

Account record: random user ID, installation ID, plan, daily quota, subscription status and expiry, creation and last-seen times, extension version; installation ID → user ID mapping — until deleted on your request

Daily usage counter — 2 days

Aggregate AI usage statistics per day (number of calls and checks, token counts and cost reported by the AI provider; no text, no user ID, no IP address) — 35 days

Technical service logs (events without block text and without IP addresses; per-call token counts and cost; for skipped private sites only a coarse category such as "financial", never the site address) — container log rotation

Checks that fail on our side (for example provider errors or timeouts) are not counted against your daily limit.

The debug mode that logs block text is disabled in production.

1. Sub-processors and third parties

To provide the service the data in section 3 passes through the following parties, each of which processes it only to classify advertising blocks:

• The AdShy server — a virtual server rented by the operator from a hosting provider; it receives all data in section 3 and stores what is listed in section 6.

• OpenRouter, Inc. — an API gateway (openrouter.ai/privacy). It receives the block data for classification and passes it to the model provider.

• The AI model provider — the company that runs the AI language model reached via OpenRouter and returns the classification verdict. The model and its provider may change; the current provider is listed on request at zzulyss@gmail.com.

What is forwarded to OpenRouter and the model provider: the block data from 3.2 (origin, cleaned text, link domain, element type, signals) — without the token, the installation ID and your IP address. OpenRouter and the model provider process requests under their own terms and privacy policies and may retain them as those policies state. AdShy is not affiliated with Mozilla, Google, OpenRouter or any AI model vendor. We do not sell data, do not use it for advertising, credit scoring or any purpose unrelated to ad filtering, and do not share it with anyone else except where required by law. The operator does not read the text of requests: it is not written to the database or to logs.

1. Data in your browser

chrome.storage.local holds: settings and the exclusion list, the installation ID, the token, the daily-limit state, your personal rules (block hashes, structural position signals and the cleaned block description as in 3.2), AI answers (up to 1 hour), your consent choice and its time, and a queue of unsent marks (up to 500). Personal rules are kept for 365 days; at most 3000 entries are stored. This data does not leave the browser except as described in section 3 and is removed when you uninstall the extension or press "Reset my rules".

1. Analytics and advertising

The extension and the website use no analytics, ad networks, trackers or third-party scripts.

1. Deleting your data

• Uninstall the extension — this removes all data in the browser.

• To delete your account record on the server, e-mail zzulyss@gmail.com with your account ID (shown in the extension settings window). Without the ID we cannot tell which data is yours. We delete the record within 30 days. Other server-side data expires automatically as listed in section 6.

Depending on where you live (for example under the EU/UK GDPR, the California CCPA/CPRA or the Australian Privacy Act), you may have the right to access, correct or delete your data, to object to or restrict processing, and to complain to your local data protection authority. Write to zzulyss@gmail.com; we answer within 30 days. We do not sell personal information and do not share it for cross-context behavioural advertising.

1. Chrome Web Store

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

1. Local backups

Protected backups of the repository, configuration and database are made daily on the same server. Backups are not sent to third parties. Automatic deletion is disabled until retention is approved; account deletion requests include backup handling.

1. Changes

A new version is published on this page with a new effective date. Material changes will be announced in the extension description.