Privacy Policy

Spyer.io — Meta Ad Library Spy & Shopify Product Importer · Last updated 18 August 2026

This extension helps online sellers research products from two public sources you choose: ads in the Meta Ad Library, and the public catalog of a Shopify store you are visiting. This policy explains exactly what data it touches, where that data goes, and what is kept.

1. Data stored on your computer

Everything you save lives in chrome.storage.local on your own machine:

• Ads you explicitly click Save on: the Meta Ad Library ID, the ad URL, the advertiser name, the ad text, the image URLs of the ad creatives, the date the ad started running, and the landing page it links to.
• The draft product generated from each ad, plus any edits you make to it.
• Stores you asked the extension to read, and — if you turn on tracking for a store — a short history of its public catalog so the extension can show you what changed between reads.
• Your settings: currency, default product status, supplier marketplace, the extension's API key, and your monthly extract count.

This data is never uploaded anywhere except in the single case described in section 3. Removing the extension from Chrome deletes all of it.

2. What the extension does on the pages you visit

The extension has permission to run on any https page. This is necessary because Shopify stores run on each merchant's own domain — there is no URL pattern that identifies them in advance. What it actually does with that permission is deliberately narrow:

• On every page, a small script checks three things in the page markup to decide whether the site is a Shopify store. If it is not, the script stops immediately: nothing is read, nothing is sent, nothing is stored.
• If it is a Shopify store, the extension shows a single dismissible button reading “Inspect this store”. Nothing leaves your computer unless you click it.
• On facebook.com/ads/library pages only, a second script adds a Save button and a row of signals to each ad card, reading that card's public content.

3. Data sent to our server

Only when you click Extract on a saved ad, the extension sends the following to api.spyer.io, which is operated by us:

• The ad's library ID, ad URL, advertiser name and ad text
• The image URLs of the ad creatives
• The currency you selected
• The extension's API key, used only to count your monthly usage

All of this is public information published by advertisers in Meta's Ad Library. Our server downloads up to two of the creative images and passes the ad text and those images to OpenRouter, which forwards them to the AI model that reads out the product name, price, and variants. Nothing else about you, your browser, or the other sites you visit is sent.

Separately, when you click Save on an ad, the extension sends us the image address of that advertiser's Facebook Page profile picture, together with your API key. Meta serves those pictures from links that stop working after a few days, so we copy the picture to our own storage and give the extension back a permanent address for it; without this, the picture beside each store in your list turns blank after a while. Nothing else about the ad is sent at this point — not the ad text, not the creatives, not the landing page.

4. Reading a Shopify store

When you click “Inspect this store”, or open a store from the extension's panel, the extension requests three public pages from that store: its home page, /products.json, and /collections/all?sort_by=best-selling. These are the same pages your browser already loads when you shop there, and they are published by the merchant for anyone to read.

These requests go directly from your browser to that store. They do not pass through our server, and we never learn which stores you looked at. If you turn on tracking for a store, the same three requests are repeated every few hours so the extension can show you what changed; turning tracking off stops them.

5. What our server keeps

• Your API key, with its creation date and how many extracts it has used this month. The key is a random string generated on your computer. It is not linked to your name, email, or any account — we have no accounts and no login.
• Your IP address, with a per-day counter, used for one purpose: limiting how many API keys can be registered from one network per day, so the free quota cannot be drained by automated abuse. It is not used to identify, profile, or track you.
• Advertisers' Facebook Page profile pictures, copied from Meta's servers so they keep working after Meta's own links expire. These are pictures the advertiser published on their public Page. Each picture is stored under a name derived from the picture itself, so the same picture saved by two different people is stored once and is not linked to either of them, to your API key, or to which ads you saved. There is nothing in this store that says who saved what.

Your ad text and the ad creatives are not stored. They exist only in memory for the few seconds an Extract request takes, and are discarded when the response is returned. Server logs may briefly contain a truncated image URL when an image fails to download; they contain no ad text and no product data.

6. Data we never collect

The extension does not collect your name, email address, postal address, phone number, payment or financial information, health information, passwords or authentication credentials, personal communications, or your browsing history.

7. Sharing and selling

We do not sell, rent, or trade any data, and we do not transfer it to third parties for advertising or any other purpose unrelated to running this extension. The only third parties involved are the service providers that make it work:

• OpenRouter and the AI model provider it routes to, which process the ad text and images to produce the product data;
• Railway, which hosts the server;
• Cloudflare, whose R2 storage holds the Page profile pictures described in section 5.

8. Your controls

• Delete any saved ad from the side panel at any time.
• Generate a fresh API key from Settings; the old one stops working immediately.
• Uninstall the extension to erase everything it stored on your computer.
• Email us at support@spyer.io to have the record of an API key deleted from the server.

9. Limited Use

Our use of information received from Google APIs, and of all user data handled by this extension, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide and improve the extension's stated single purpose, is never sold, is never used for advertising or credit-scoring purposes, and is not read by humans except as needed for security, to comply with the law, or with your explicit consent.

10. Children

This extension is a tool for online sellers and is not directed at children under 13.

11. Changes

If this policy changes, the updated version will be posted at this URL with a new "last updated" date. Material changes will also be noted in the extension's Chrome Web Store listing.

12. Contact

Questions about this policy or about data handled by the extension: support@spyer.io