Privacy Policy

Last updated: 2026-08-08 · Extension: Evida (Chrome) · Contact: support@useevida.com

---

Summary

Evida is a Chrome extension that surfaces recent edits in Meta Ads Manager (who changed what and when). Your change data stays on your device — there is no Evida database of your ad activity, and no analytics or telemetry.

The extension makes network requests to exactly four places, all of them in service of a feature you turned on:

1. Meta Graph API — reads your ad accounts, activity log, and (optionally) insights.
2. Slack — posts alert messages, but only to a webhook URL you paste in Settings yourself.
3. Evida OAuth Worker — only if you choose "Log in with Meta"; exchanges and refreshes the OAuth token.
4. Evida billing endpoints (same Worker) — when you click an upgrade or "manage billing" button in Settings, and, once paid plans are switched on for your install, when a paid feature needs to check your plan. See Billing.

Nothing else leaves your browser.

What data the extension handles

Data	Where it comes from	Where it's stored	Why
Meta User Access Token	You paste it in Settings	chrome.storage.local on your device	Required to call Meta Graph API on your behalf
User ID & name	Fetched from /me endpoint once after you paste a token	chrome.storage.local	Powers the "Only my edits" filter
Ad account list	Fetched from /me/adaccounts	chrome.storage.local (cached for session)	Populates the account dropdown
Activity log entries	Fetched from /{account}/activities	In memory for the popup; a local 7-day / 2000-entry cache may be stored in chrome.storage.local for alert previews	Rendered as the change feed and alert dry-run previews
Settings	You choose them	chrome.storage.local	User preferences (theme, refresh interval, active hours, filters)

All storage is local (chrome.storage.local). The extension does not use chrome.storage.sync — nothing is mirrored to your Google account or other devices.

What is transmitted, and what it contains

• To Meta Graph API — your access token (in an Authorization header) and the account and date range you are viewing. Meta already has this data; we are reading your own log back.
• To your Slack webhook — for each alert that fires: the rule name, the changed object's name and type, who made the change, the before/after values (including budget amounts), and a deep link back to Ads Manager. Sent only if you configured a webhook, and only to that URL. Slack's own privacy policy governs it once delivered.
• To Evida's OAuth Worker — during "Log in with Meta": the OAuth authorization code, and later the token to be refreshed. The Meta App Secret cannot be embedded in a browser extension, so this exchange must happen server-side. Tokens are relayed, not stored.
• To Evida's billing endpoints — your Meta access token, in an Authorization header, so the Worker can confirm with Meta who you are. The extension does not claim an identity itself; the Worker derives it.

Billing

Paid plans are not enforced in this version: every feature is available, and the extension never looks your plan up unless you ask it to do something billing-related. When paid plans are switched on, the only thing sent to https://oauth.useevida.com/api/tier is your Meta access token, which the Worker uses solely to ask Meta who you are. The lookup happens lazily — the first time a paid feature needs to know your plan — and is cached for 6 hours. It never fires on popup or options-page load. Payment details are handled by Stripe on Stripe's own pages; the extension never sees a card number.

What we do NOT do

• We do not collect analytics, telemetry, crash reports, or usage metrics from the extension.
• We do not send anything on extension startup, popup open, or page load beyond the Meta Graph API calls that produce the change feed you asked for.
• We do not store activity data on Evida servers.
• We do not transmit your token, activity data, or any other information except as listed in "What is transmitted" above.
• We do not read or modify pages outside adsmanager.facebook.com, business.facebook.com/adsmanager/*, and www.facebook.com/adsmanager/*. The content script is scoped to those Ads Manager paths.
• We do not sell, rent, share, or transfer any personal information.
• We do not use the data for credit-worthiness, advertising, or any purpose unrelated to showing you your own ad account change log.

Website analytics

This website (useevida.com — not the extension) uses Cloudflare Web Analytics, a privacy-first, cookieless measurement tool: no cookies, no cross-site tracking, no fingerprinting, and no personal profiles — only aggregate page-view counts. If you join the waitlist, we store the email you submit for the sole purpose of contacting you about Evida access; nothing else is attached to it.

Third parties

The extension can contact Meta Graph API (https://graph.facebook.com), Evida OAuth Worker (https://oauth.useevida.com) when you choose "Log in with Meta", and Slack incoming webhooks only when you explicitly configure a webhook URL. Meta's handling of Graph API requests is governed by their own Meta Platform Terms and Meta Privacy Policy.

Permissions explained

The extension requests the following Chrome permissions, each with a narrow purpose:

• storage — save your token and settings on your device.
• alarms — run the optional background refresh at the interval you configure (2 / 5 / 15 / 30 / 60 min). You can disable this entirely with "Manual refresh only".
• notifications — show optional Chrome alerts for critical changes.
• identity — run the optional Meta OAuth login flow.
• host_permissions — scoped to graph.facebook.com, /adsmanager/* paths on Meta's domains, Slack webhook delivery, and Evida's OAuth Worker. These also let the extension find your open Ads Manager tabs to refresh the inline badges; it cannot see tabs on any other site.

Data retention & deletion

All extension data lives in chrome.storage.local on your device. To delete everything:

1. Go to chrome://extensions.
2. Click Remove on "Evida".

Chrome will purge all extension storage. There is nothing stored elsewhere to delete.

To revoke your Meta access token independently, go to Meta's app settings and remove the app you generated the token with (typically "Graph API Explorer" or your own Facebook App).

Security

• The token is kept in chrome.storage.local, which is isolated from web pages and other extensions.
• API requests use the Authorization: Bearer <token> header — the token is never placed in request URLs, where it could leak into DevTools recordings, proxy logs, or screen shares.
• The extension does not inject inline <script> into Meta's pages; it only appends small <span class="mab-ago"> badge nodes next to campaign rows.
• No remote code is loaded. All JavaScript ships inside the extension package.

Data deletion

Because Evida stores data locally on your device, deleting your data is instant and does not require contacting us. You have two options:

1. Disconnect from Meta and wipe local storage. Open the extension → Settings → Disconnect. This clears your access token and all cached campaign edits from chrome.storage.local.
2. Uninstall the extension. Right-click the Evida icon in Chrome → Remove from Chrome. Chrome automatically purges the extension's storage on uninstall.

You can also revoke Evida's access token directly in your Meta Business Settings at any time — Evida loses all API access immediately.

If you authorized Evida via "Login with Meta" and want us to confirm deletion of any residual logs (short-lived token prefix hashes kept for rate-limit and abuse prevention, up to 30 days), email support@useevida.com from the email tied to your Meta account. We respond within 30 days per GDPR.

Children

The extension is intended for professional marketers managing their own (or their employer's / client's) Meta ad accounts. It is not directed at children under 13 and does not knowingly collect any information from them.

Changes to this policy

If the policy materially changes, the new version will be posted at the same URL and the "Last updated" date at the top will be revised. Material changes would typically coincide with a major version bump of the extension (e.g., 2.0.0).

Contact

Questions, concerns, or data requests:

support@useevida.com

---

This policy covers version 1.12.1 of Evida. If you are reading a stored copy, check the latest version on the project page.