Privacy Policy

Last updated: July 11, 2026. Operated by ShellyApps (Israel).

AllAdsBlock is built to protect your privacy, not exploit it. We do not run analytics on you, we do not sell data, and the extension does not transmit your browsing history to us. This policy explains exactly what happens with your data.

1. Data stored on your device only

The following never leaves your browser except via Chrome's own optional settings-sync:

Blocking statistics — counts of ads, trackers, pop-ups, and threats blocked (per site and in total), shown in the popup.
Per-page threat log — a rolling in-memory list of security events detected on the current page (threat category and timestamp only). Cleared on every page navigation. Never written to disk or transmitted.
Cookie hygiene (Stealth Mode) — if you enable it, cookies for sites you no longer have open are removed and cookie lifetimes can be capped. This happens locally via the browser's cookie storage; nothing is transmitted.
Your allowlist — sites you've paused protection on.
License / promo state — whether you're on Free, Pro, or Ultimate and your key (stored in Chrome storage.sync).
Your settings — the on/off state of every feature you toggle (Stealth Mode options, annoyance filters, and so on), stored in chrome.storage.sync.
Custom filter lists & rules — the list URLs you choose to subscribe to, any rules you write yourself, and your per-site controls (e.g. blocking scripts, fonts, or media on a given site). Stored locally.
Tracker preferences — your per-tracker choices (allow / block / cookies-only) and, if you turn on "learn & block repeat trackers", the third-party domain names observed across the sites you visit. Domain names only — stored locally, never transmitted.
Filtering log (Ultimate) — while you have the filtering-log page open, a temporary in-memory list of requests and how they were handled (URL, type, verdict, and the matching rule). Held in memory only, never written to disk or transmitted, and discarded when the extension restarts.

2. Information sent off your device

Payments & license validation — LemonSqueezy. Purchases are processed by our reseller LemonSqueezy (a Merchant of Record). When you activate a paid license, your license key is sent to LemonSqueezy's API to confirm it's valid. We never see or store your card details. See LemonSqueezy's privacy policy at lemonsqueezy.com/privacy.
Malware/phishing threat feed. The extension periodically downloads a public malware-domain list from URLhaus (abuse.ch). This is a standard one-way download — no information about you or the sites you visit is sent.
Filter lists & subscriptions. To keep ad- and tracker-blocking rules current, the extension periodically downloads public filter lists — one enabled by default, plus any lists you subscribe to by URL — refreshed about once a day. Each request goes directly to that list's server, which may log your IP address as part of normal server logging; no information about you or the sites you visit is sent.
Family/promo keys are verified entirely on your device (offline) and contact no server.

That is the complete list of network connections the extension makes. There is no analytics, advertising, or tracking SDK of any kind.

3. Ultimate plan — on-device security features

The Ultimate plan includes active security protections that analyse page content and browser APIs locally. All processing happens exclusively on your device. The data each feature accesses, and what it does with it:

Clipboard hijack protection. Reads clipboard text only during your own copy events (i.e. when you press Ctrl+C / Cmd+C). The content is checked against a crypto-wallet address pattern. If a substitution is detected, the original selection is restored. Clipboard content is never stored or transmitted.
Formjacking / Magecart detection. Reads the action attribute of <form> elements to check whether they submit to a different domain. No form values or user input are ever read.
Hidden autofill-field detection. Checks whether password or payment-card input fields are positioned off-screen or invisible — a known data-harvesting technique. Input values are never read.
Tab-napping protection. Monitors the page <title> element for changes while the browser tab is not in focus, to detect impersonation attempts.
DNS rebinding protection. Intercepts outgoing fetch and XMLHttpRequest calls made by the page and blocks any that target private IP ranges (192.168.x.x, 10.x.x.x, 127.x.x.x, localhost). The URL of blocked requests is not stored or transmitted.
WebRTC local IP leak prevention. Intercepts WebRTC ICE candidate events and suppresses candidates that would expose your local network IP address. No connection data is stored or transmitted.
Notification spam auto-deny. Overrides the browser Notification permission prompt so that permission requests from websites are automatically denied without prompting you. No data is stored or transmitted.
Keylogger hook detection. Monitors for JavaScript attempts to override HTMLInputElement.prototype.value — a technique used by credential-stealing scripts. Detects the override attempt only; keyboard input is never read or recorded.
Tab-napping & tech-support scam detection. Reads visible text content of large fixed-position overlays to identify known tech-support scam phrases. Page text is checked locally and never transmitted.
Anti-fingerprinting. Adds imperceptible noise to canvas rendering and masks browser plugin lists to make fingerprinting less reliable. No data is collected.

4. Stealth Mode & privacy filtering (Pro / Ultimate)

Pro and Ultimate add network-level privacy controls. These modify or block requests as your browser makes them — entirely on your device, with nothing reported to us. Paused (allowlisted) sites are never affected.

Header protection (Stealth Mode, Pro). When you enable it, the extension strips or adds HTTP headers on the requests your browser sends: it can remove the Referer, third-party Authorization and Cookie/Set-Cookie, and X-Client-Data headers, and add a DNT: 1 (Do Not Track) or Sec-GPC: 1 (Global Privacy Control) signal, or send a generic User-Agent. These changes are applied by the browser's declarative-rules engine; header contents are not read by us or sent anywhere.
Cookie controls (Stealth Mode, Pro). Optional self-destructing cookies and a cookie max-age cap use the browser's cookie API to delete cookies on your device — for example, removing cookies for sites you no longer have open. The extension reads cookie metadata (domain, name, expiry) only to decide what to delete; cookie values are never stored or transmitted.
Global Privacy Control / Do Not Track. When enabled, these add a standard privacy signal to the requests your browser sends to websites, asking them not to sell or share your data. This is the one case where the extension adds information to your outgoing requests — by design, to assert your stated preference.
Link clean-up. Rewrites tracking-redirect links (e.g. google.com/url?…) to their real destination directly in the page. Done locally; nothing is sent.
Third-party cookie blocking, annoyance & social-widget hiding, and custom filter lists all act on requests or page elements locally; the data they touch never leaves your device. Subscribed filter lists are downloaded as described in section 2.

5. What we do not collect

We do not collect your browsing history, URLs you visit, page contents, form values, keyboard input, clipboard contents, or any personally identifying information. Every security check described above runs locally in your browser and the results stay on your device.

6. Permissions

The extension requests broad host access (<all_urls>) because ad, tracker, and threat blocking must work on every site you visit. Each permission is used only to provide the features described above — never to record or transmit your browsing activity:

declarativeNetRequest / declarativeNetRequestFeedback — apply blocking, redirect and header rules, and (for the filtering log) report which rule matched a request, on your device.
webRequest — observe requests to count what's blocked and build the on-device filtering log. Observation only; the extension cannot read request or response bodies.
cookies — delete cookies on your device for the optional self-destructing-cookie and cookie-expiry features.
privacy — toggle the browser's WebRTC IP-handling setting to prevent local-IP leaks.
scripting / tabs — run on-page protections and show per-tab statistics.
contextMenus — add the right-click "block element" and "open assistant" entries.
storage — save your settings, rules and license locally (and via Chrome's optional sync).
alarms — schedule the daily filter-list and threat-feed refreshes.

7. Children

AllAdsBlock is not directed to children under 13 and does not knowingly collect data from them.

8. Changes

We may update this policy; material changes will be reflected here with a new date. Significant changes will also be noted in the extension's release notes.

9. Contact

Questions about privacy: ambarshely@gmail.com.

← Back to home · Terms · Refunds