Privacy Policy — Poach

Last updated: 2026-09-07

Poach is a Chrome extension that captures ads from the public Facebook Ad Library and saves them to your own Notion workspace and/or your local disk. This policy explains exactly what the extension does and does not do with data. It is written to match the actual behavior of the code, not a template.

The short version

Poach does not send captured ads, screenshots, or Notion content to its licensing/fulfillment service. The extension has no analytics, tracking, or telemetry.
The licensing/fulfillment service receives the order id, claim capability, license key, activation credential, random installation id, Stripe webhook/session/payment/charge/customer identifiers, and payment, refund, and dispute status needed to fulfill and enforce a purchase.
Stripe, not Poach, handles card details on Stripe-hosted Checkout.
Captures go to your own disk or, when requested, directly to your own Notion workspace. Licensing state and checkout recovery data remain in local storage until you clear the relevant extension or website data.

What data the extension handles

1. Your Notion integration token

What it is: A token you create in your own Notion account and paste into the extension's settings, authorizing the extension to write to your Notion workspace.
Where it is stored: In Chrome's extension storage (chrome.storage) on your device.
Where it is sent: Only to https://api.notion.com, and only to perform the actions you trigger (create a database, save a captured ad, upload a screenshot). It is never sent to the developer or to any other party.

2. Captured ad data

What it is: Information about ads you choose to capture from the Facebook Ad Library — headline, body text, call-to-action, landing page URL, advertiser name, dates, and the ad's image or video, plus an optional screenshot of the ad card. This is public information displayed in the Facebook Ad Library.
Where it goes: To destinations you control:
- Saved to your own Notion workspace (only if you have configured a Notion token and database), and/or
- Downloaded as files to your own local disk via Chrome's downloads feature.
It is never sent to the developer.

3. POACH license and device identifiers

The paid build stores the POACH key, a cryptographically generated stable installation_id, the opaque activation_credential, validity state, and the last successful validation time in Chrome extension storage on your device. The key and installation identifier are sent to https://api.usepoach.com/v1/licenses/activate. The key and opaque credential are sent to /validate and /deactivate. Keys and credentials are not placed in URLs or logs.

The licensing/fulfillment service receives the order id, claim capability, license key, activation credential, installation id, and the Stripe webhook, Checkout session, PaymentIntent, charge, and customer identifiers plus payment, refund, and dispute status required for fulfillment and enforcement. It does not receive captured ads, screenshots, Notion content, or Notion tokens. Stripe handles card details.

For Checkout fulfillment, Poach sends the opaque local order id to Stripe as client_reference_id and as metadata[poach_order_id] so webhook events can be correlated to the order. Poach stores the correlated Stripe provider IDs and payment, refund, and dispute status, not card data. Stripe handles card details on its hosted Checkout.

4. Settings you enter

Your niche taxonomy options and selected Notion database id are stored in Chrome's extension storage on your device. The Notion token is sent only to api.notion.com for requested Notion actions.

5. Website checkout recovery

When a checkout starts, the landing page stores the returned order id and opaque claim capability in website localStorage so the return page can retry a claim. This recovery capability persists until the site's data is cleared. It remains on the device after a cancelled checkout and is not placed in a URL or log.

Website analytics

The landing page uses Google Analytics 4 to measure visits, referral sources, and website interactions. Google receives browser/device information and analytics identifiers and may store cookies in your browser. Google processes network information, including your IP address, to provide the service. Advertising personalization and Google signals are disabled in our tag configuration.

The tag does not load on checkout return visits, visits with a stored pending license claim, or this privacy page. Page URLs sent by our configuration exclude fragments and query parameters other than campaign UTM tags; referrer URLs exclude query parameters and fragments. We do not send captured ads, Notion content, license keys, or checkout recovery capabilities to Google Analytics.

Website analytics connects to www.googletagmanager.com, *.google-analytics.com, and *.analytics.google.com. See Google's privacy policy. You can block analytics using browser privacy controls or Google's opt-out add-on.

What the extension does NOT do

It does not collect, transmit, or sell personal information beyond the licensing and payment identifiers described above.
It does not run analytics, fingerprinting, or behavioral tracking.
It does not send captured ads, screenshots, Notion content, or Notion tokens to the licensing/fulfillment service.
It does not read your browsing history or unrelated tab URLs, titles, or favicons.

Extension and payment network destinations

Destination	Why	When
`https://api.notion.com`	Save captured ads, create/list databases, upload screenshots to your Notion	Only when you save to Notion, or run the setup wizard
`https://api.usepoach.com`	Create Checkout sessions, claim licenses, and activate, validate, deactivate, and enforce licenses	Only for checkout or licensing
Stripe-hosted Checkout	Process payment details	Only when you choose a paid CTA
`https://www.facebook.com/ads/library/*`	The page you are capturing from	While you browse the Ad Library
Facebook CDN (e.g. `scontent.*`)	Download the ad's image/video to your disk via Chrome's downloads feature	Only when you capture an ad's media

Permissions and why they are needed

storage - to remember your settings, Notion token, license key, activation credential, installation id, and database id locally.
downloads - to save captured ad images, videos, and screenshots to your local disk. Chrome's downloads feature fetches the media directly.
host: https://www.facebook.com/ads/library/* - to run the capture UI on the Ad Library page and to screenshot that tab.
host: https://api.notion.com/* - to talk to your Notion workspace.
host: https://api.usepoach.com/* - to run checkout and licensing requests. The free build has no Poach API host entry or paid call path.
<all_urls> - retained because chrome.tabs.captureVisibleTab requires broad host permission for the screenshot card. The extension uses it only for the visible Facebook Ad Library tab and does not read unrelated tabs.

Data retention and deletion

The licensing/fulfillment service retains the identifiers and payment status needed to issue, enforce, refund, and dispute licenses. Stripe retains payment records under its own policies. Website checkout recovery data persists in localStorage until site data is cleared. Extension state is removed when the extension is uninstalled or its site data is cleared. Data saved to your own Notion or disk remains under your control.

Contact

Questions about this policy: contact@usepoach.com