xads.world

Privacy Policy

Last updated: September 17, 2026

01 About xads.world

xads.world is a server-rendered workspace for securely connecting Facebook profiles, synchronizing permitted Meta assets, analysing advertising performance and performing user-confirmed advertising operations.

02 Data we collect

  • xads.world account name, email, password hash and login security records.
  • Facebook profile ID and name returned after Meta OAuth.
  • Encrypted Meta and Page access tokens, granted permissions and token expiration.
  • Available Business Portfolio, ad account and Facebook Page identifiers, names and metadata.
  • Campaigns, ad sets, ads, creatives, insights and Page comments returned for authorised assets.
  • User-confirmed operation history, synchronization jobs and technical security logs.

03 Meta permissions

The OAuth connection currently requests exactly the permissions listed below. The list is generated from the active application configuration.

ads_read

Read ad accounts, campaigns, ad sets, ads, creatives and performance insights.

ads_management

Perform advertising changes explicitly previewed and confirmed by the user.

business_management

List Business Portfolios and associated business assets available to the connected profile.

pages_show_list

List Facebook Pages available to the connected profile.

pages_read_engagement

Read Page metadata, engagement and content required by the Pages screen.

pages_read_user_content

Read user-generated comments shown in the read-only Page monitoring interface.

04 How data is used

  • Authenticate the xads.world user and protect the account.
  • Maintain the authorised Meta connection.
  • Display connected Meta profiles and accessible assets.
  • Synchronize advertising data after OAuth, on request and according to enabled schedules; read Page posts and comments while the manager has enabled monitoring.
  • Detect expired tokens and missing permissions.
  • Prevent abuse and investigate technical errors.

05 Storage and protection

Meta access tokens are encrypted at rest. Production traffic must use HTTPS. Access to connection data is restricted by authenticated sessions, ownership checks and server-side RBAC. Facebook passwords are entered only on Facebook and are never received by xads.world.

06 Retention and deletion

Data is retained while the account or connection is active and only as long as needed to provide the service. Disconnecting Facebook stops future synchronization and clears saved profile and Page access tokens. An authenticated user can permanently delete the xads.world account and associated data in the active application database immediately from the account settings. Signed Meta deletion and deauthorization requests stop the saved connection and queue deletion of the related Meta data. Status receipts are retained for a limited period without the Facebook profile ID after completion. Server logs and backups are managed separately by the hosting operator; contact us about their retention. The complete self-service process is described on the Data Deletion page.

07 Sharing

We do not sell or rent Meta platform data. Data is disclosed only to infrastructure providers required to operate the service, when legally required, or with the user’s explicit direction.

08 Contact

Privacy and deletion requests: [email protected].