About
About Fray
Fray helps stop scam ads that target people and fraud ads that target businesses. Ad blockers contribute reports, brands identify their advertising accounts, and we investigate and file the evidence.
We've been running Fray in our own ad blocker since early 2025. We're inviting other ad blockers to contribute reports and help us investigate more scam and fraud ads.
Who runs and funds it
Fray is run by Marcode Ltd, a brand-protection company in London.
Marcode sells a fraud detection platform to brands running affiliate programmes, covering affiliate hijacking, brand bidding and ad hijacking, and that paying work is what funds Fray. That is why Fray costs partners and brands nothing: the analysts and the infrastructure are already paid for.
Alec Bertram, Marcode's co-founder, is responsible for what Fray publishes and how it operates. You can reach him at [email protected].
Marcode Ltd is a private limited company, registered at Companies House under number 15046325 and incorporated on 3 August 2023. Registered office: Office 420, 30 Great Guildford Street, London, England, SE1 0HS.
What the data is used for
No user data is ever collected. The ad data Fray receives is used only to identify scams, malvertising, and fraud. It is provided to ad networks, to the affected brand, and to law enforcement where applicable.
An ad report includes available ad content, the displayed domain and advertiser details. It can still be linked: the ad’s click links keep the ad platform’s own parameters, including a precise click timestamp, which the platform can match to its own records. By default a report carries none of Google’s lookup values. Search keywords are stripped from the creative and URL while the remaining ad evidence is retained. An ad blocker can choose to include your search query with its reports, but only if it tells you before you take part. If it does, the ad is sent as shown, with your keywords left in. By default, the browser reports only after finding an account absent from a watched brand’s closed authorization list. An ad blocker can instead use an optional mode, again only if it tells you first: the browser sends Google’s lookup values in place of advertiser details, and we look up the advertiser. Those values are tied to your Google session, carry a precise timestamp and can link reports to a Google page or request. In that mode ads are sent before their account is checked, so some turn out to be authorized. Accepted reports are stored for investigation for up to 90 days. How the ad's click URL is handled.
Fray and Marcode's commercial business share the same analysts and systems. There is no ring-fence between them.
Security
Fray-specific SOC 2 scope is awaiting confirmation. Contact [email protected] for current security information.
The protocol and its sanitization rules, the report schema, the watchlist, the relay and the token issuers are public, and each issuer publishes its signing keys.
Data governance
Accepted reports are stored for analyst review and investigation, under the retention periods below.
| Data class | Contents | Retention |
|---|---|---|
| Sighting envelope (raw) | Displayed domain, available creative and click URL (click-URL handling); sanitized ad HTML; advertiser details, including the platform’s targeting reason codes (categories such as age or location interests, not their values), or, in an optional mode the ad blocker must disclose, Google’s session-bound lookup token and per-ad batch codes in their place; serving platform; watchlist version; hour-bucketed observation (the click links keep their precise click timestamp); one blind-signed token. The relay adds the client’s country and device type, such as Android mobile or Windows desktop. | 90 days |
| Aggregates and case material | Quorum counters keyed on (brand, creative hash, country, UTC day); published case material built from sanitized sightings and, where reproduction succeeded, Fray-operated machines' impressions | Indefinite |
| Spent-set | SHA-256 of each burned token message: no payload, no linkage | 70 days |
| Never collected | Extension account IDs, cookies and browsing URLs are excluded from reports. Search queries are excluded unless your ad blocker has told you it sends them. Google’s lookup values are excluded unless your ad blocker has told you it uses the optional mode that sends them. The relay receives the client connection; the gateway receives the relay connection. Reports can still be correlated: the ad platform can match the click parameters kept in the click URL and ad HTML to its own records. Privacy contract and operating boundaries. | — |
- Jurisdiction
- United Kingdom.
- Subprocessors
- Heroku hosts the website and inbound service in its Europe region. Cloudflare hosts the OHTTP relay and the public watchlist registry. Each partner runs its own token issuer. The complete subprocessor disclosure is being prepared.
- Partner revocation
- A partner that leaves can revoke its stream: raw envelopes from that partner's issuer are deleted, ahead of the normal 90-day expiry. Aggregates and published case material persist.
- Deletion
- Raw envelopes expire automatically after 90 days and spent-token records after 70 days, using time-to-live expiry.
Vulnerability disclosure
Report security findings to [email protected]. We do not pursue good-faith researchers. Our security.txt is available on all our domains.
Transparency report
We will report quarterly on filings, platform actions, filings where the platform took no action, disputes and resolution times, watchlist size and partner count. We exclude figures that would help scammers evade detection. Quarterly figures have not yet been published.