Security and data at Cinderblock
Cinderblock is the click-fraud protection we run for our Google Ads clients. This page explains, in plain words, what it collects, what it never collects, where data goes, and how we keep it safe. The full legal text is in our Privacy Policy.
Our promises
- We never sell data and never use it to build advertising profiles.
- We never read what people type into forms. We only check how a form was filled (for example, how fast), to spot fake leads.
- Each client sees only their own data. Agency staff see only the clients they work on.
- Google stays safe. Google's own visits (Googlebot, AdsBot and ad reviewers) are never scored, blocked or shown a different page, so our protection never puts an ad account at risk.
- Every visitor sees the same website. We never hide or change a page for anyone.
What is collected about website visitors
- IP address and its approximate country, city and network (for example, whether it is a data centre or a VPN).
- Browser and device type, screen size, language, time zone, the page visited and the page before it.
- Google Ads click details from the page address (click ID, campaign, ad group, keyword).
- How the visit behaved: time on page and counts of mouse moves, scrolls and taps. Key presses are only counted; which keys and what was typed are never recorded.
- Where allowed, a device code stored only as a one-way hash (for UK and EU visitors only after consent).
The tracking script sets no cookies. On websites that ask for consent first, it sends nothing until the visitor accepts.
Where data goes
| Where | What | When |
|---|---|---|
| Our portal (our own server, Verpex hosting) | The visit records above | Always; deleted after 90 days or sooner |
| IP location service (ip-api.com) | The IP address only | Always; results kept 7 days |
| The client's own Google Ads account | IP addresses of fake visitors, as IP exclusions | Always (never Google's own addresses) |
| The client's own Google Analytics 4 | Read: GA4's own visit totals. Mark: GA4's visitor code and a fraud score for a fake visit, nothing personal | Only if the client links it; UK and EU visitors only with advertising consent |
| The client's own Cloudflare account | IP addresses of blocked visitors | Only if the client links it |
| The client's own email or CRM | Weekly totals (no IP addresses) and fake-lead alerts (no typed data) | Only if the client turns them on |
How we keep it safe
- Encrypted connections (HTTPS) everywhere; passwords stored only as secure hashes.
- 2-step login for portal users, limits on login attempts, and a log of who changed what.
- New users choose their own password through a one-time link; passwords are never sent by email.
- Keys for outside services (Google, Cloudflare) are stored on our server and never shown again after they are saved.
- Daily backups kept outside the public web folder, deleted after 14 days.
Your choices
- Clients choose which extras are on (Google Analytics, Cloudflare, alerts), how long visit data is kept, and can ask us for a copy or deletion at any time.
- Website visitors can contact the website owner, or us at info@clickyfyre.com, to ask what is held about them or to have it deleted.
Last updated: 1 October 2026. Questions: info@clickyfyre.com.