Extension Summary
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
- The user logs-in using a form within the extension. They supply their Reticle account email and password, and if successful, Reticle stores a JWT access token and refresh token in the extension's local storage. There is no means of registering for a Reticle account through the extension.
- The extension sends a request to the Reticle API and receives the user’s Reticle “advertisers.” An advertiser is a grouping of Reticle campaigns. For each campaign, the user is shown its name, whether there are updated placements available for it, and the date its placements were last updated.
- The user selects which Reticle campaigns they want to update placements for. The extension then sends the IDs of the selected campaigns to the Reticle API, and the API responds with a collection of relevant ad groups to update along with lists of YouTube placements.
- The extension interacts with the DV360 web console, clicking on buttons and interacting with forms to insert the list of placements. It also displays an overlay informing the user of its progress, what ad group it's currently working on, and any error alerts.
- For each ad group, the extension sends back to us a boolean value for whether the operation was successful or not. On our system, we store that information along with a timestamp for when the value was received and the ID of the user who sent it.
Data We Collect
Login/Authentication information for Reticle (note: there is no way to register or create an account using the extension)
- Reticle account email
- Reticle password
- Reticle account access token
- Reticle account refresh token
Server Logs
- Login
- Logout
- Refresh access token
- Requesting advertisers and campaigns
- Requesting placement lists for campaigns
- Requesting advertisers and campaigns
- Sending results of placement operations
Operation logs
- Reticle account access token
- Ad Group ID
- True/False value for whether the operation was successful
- Operation completion time in seconds
- Timestamp for when the log was received by our system
- Reticle account ID for who sent the log
- Lifetime revenue value for the Ad Group
How We Use the Data
Login/Authentication information with Reticle
- Username, password, and access tokens are used to ensure a user has an account with us and is authorized to use our services.
- Refresh tokens are used so the user is recognized and doesn't have to login each time they use the extension.
Server Logs
- Used to maintain records of who logged in and who used our services for security and troubleshooting purposes.
Operation Logs
- Used to maintain records of which users used our services for security, troubleshooting, and performance analytics purposes.
- Used to alert our developers and clients of errors that require manual intervention.
- Used to benchmark and improve our product’s performance.
All data collected is used exclusively for our extension's single intended purpose (updating DV360 YouTube ad groups with Reticle placements).
Data We Share
We do not share any data unless necessary for security purposes (e.g. investigating abuse) or to comply with applicable laws.
How We Handle Data
Data is sent and received over a secure connection (HTTPS).
Personal/sensitive data is stored at rest using bcrypt encryption.
We will remove any user data from our systems within thirty (30) days of a request to do so.
Permissions and Why We Request Them
"alarms"
- The extension uses an alarm to check for stalled progress. If the extension is still updating placements for the same ad group that it was the last time the alarm was triggered then we can consider the operation stalled and raise an error.
"scripting"
- A content script needs to be injected into each DV360 page so that placements can be inserted via programmatic interaction with the DOM.
"storage"
- The storage API is used to persistently store access and refresh tokens so that a user can be authenticated with our API across sessions. It's also used to temporarily store data received from our API (such as the ad group IDs to be updated and the list of placements per Reticle segment) so that it can be shared between the service worker and the content script.
"unlimitedStorage"
- The extension needs to store data (Reticle advertisers and campaigns, DV360 ad group IDs, Reticle segment IDs, and lists of placements per Reticle segment) that can be at maximum 30MB in size.
"webNavigation"
- The service worker needs to wait for a page to be fully loaded before injecting the content script.
- The service worker needs to navigate to the relevant DV360 URLs in order to update placements.
- The service worker needs to navigate to the Reticle dashboard if the user selects the option to view their operation logs.
"power"
- Because the extension can potentially take some time to perform its single intended purpose, it requests that a user's computer remains active (i.e. screen stays on, computer doesn't go to sleep) so that it can successfully run.
Host Permissions and Why We Request Them
"https://displayvideo.google.com/ng_nav/*"
- The extension updates placements by interacting with the DV360 web console's DOM, so it requires permission to navigate to and inject content scripts into these pages.
