Pixboard Against the Five Tests

Pixboard is my answer to surveillance advertising. Before I run its ads anywhere new, including this site, it has to answer to the same five tests as everything else.

Pixboard is an ad network I built at pixboard.ad. Advertisers buy a small pixel block on a board, and from there the ad can rotate into a slim column on partner sites. Publishers carry that column and earn a share. The pitch, as the home page here puts it: advertising without surveillance. No tracking, no auction, no third-party script in the reader's browser.

It has three kinds of people to answer to: the advertisers who pay, the publishers who carry the ads, and the readers who see them. I checked each test against all three, using Pixboard's public pages and its code.

One thing to say up front: as far as I can find, every site carrying the column today is one of mine. This is a measurement of how it's built, not of a network at scale.

Test 1: Leaving is easy

A customer can export everything they put in, in a format another tool can read, without asking anyone.

Publishers: passes. There's no script to paste. A publisher's own server fetches the ads and renders them in the publisher's own HTML, so leaving is deleting that column. Nothing else is left behind. When I first checked, nothing public said what happens to a balance under the $25 payout threshold when a publisher leaves. Now the publishers page says it: below $25 you can ask for a payout any time, with no minimum, and anything you've earned is still yours.

Advertisers: passes. What an advertiser puts in is their artwork, a link and a line of copy, and they already have all of that. When I first checked, their numbers (looks, clicks, click rate) were only on a dashboard, and getting a copy meant emailing privacy@pixboard.ad. Now the account page has a download: a spreadsheet file of every ad's looks, clicks, click rate, budget and spend, with no visitor data in it. One cost of leaving remains. Purchases are final, so looks you paid for and haven't used yet stay behind if you go.

Test 2: Pricing is legible

The price page says what one unit costs and what a unit is.

Board blocks: passes. Every board shows its prices by position: $24 for the prime spot in the middle, $16 where 95 to 100% of visitors see it, $8 to $16 for 50 to 95%, $3 to $8 for 17 to 50%, and free under 17%. A unit is one 40 x 40 block, and a bought block is permanent. Nothing renews.

Network ads: passes. The unit is unusually honest. A "look" counts only when a reader holds the ad open for about a second, not every time it's drawn on a page. Looks sell at $100 per 1,000, $400 for 5,000, or $1,200 for 20,000. When I first checked, that price only appeared after you'd bought a block. It's now on the public advertise page, drawn from the same settings checkout charges from, so the page and the bill can't drift apart.

Publishers: passes. The publishers page now says 65% and $25 outright, where it used to say only "a share".

A promise the code didn't keep, now fixed. The advertise page used to say that the moment your block is live, your ad starts rotating into the sidebar of every partner site, with no extra setup. In the code, only my own house ads and ads with a paid pack of looks go into the network. A block on its own stays on its board. The page now says that plainly: "The block is the home; the pack is the reach." The headline used to read "Place your ad once. It runs across the network." Now it reads "Place your ad once. Add a look pack, and it runs across the network." I found the same kind of over-promise on VoltJS's hosting pages, and the fix is the same: the page has to say what the product does.

Test 3: Privacy is the default

There's a public list of every piece of data the product collects, and why.

While reading: the strong part. The reader-facing code was audited line by line in October. A reader gets no cookie, no local storage and no fingerprinting, and their browser never talks to Pixboard while they read. The publisher's server fetches the ads and even the images, so Pixboard never sees a reader's address, browser or the page they're on. Even the "report this ad" button sends only a one-way hash, not an address. For an ad unit, that's rare.

Clicks are the exception, and now they're disclosed. A click goes through pixboard.ad on its way to the advertiser. Pixboard records the time, the reader's IP address, their browser, and the page they came from, and keeps that for a year to count clicks and catch fraud. When I first checked, the privacy page left out the page they came from, and the publishers page said "no tracking of your readers" without naming the click log. Both are fixed. The privacy page lists all four, and the publishers page names the click log in the same answer that says there's no tracking while reading.

Advertisers: passes. The privacy page lists what's stored about advertisers and every company that touches it: Stripe for payments, Anthropic for checking images and writing copy, DigitalOcean for storing artwork, an email provider, and Google Safe Browsing for checking links.

Passes for disclosure. The list is now complete. The referring page is still recorded, and I'd still ask whether click counting and fraud checks need it, because not recording something protects readers better than disclosing it.

Test 4: Accountability is independent

The party being judged doesn't hold sole control of the evidence it's judged by.

Not met. Pixboard counts the looks, bills the advertiser from that count, and pays the publisher from the same count. It also decides which clicks are real and which are bots. Since my first check those filters have gotten stricter: known crawler addresses and any single address clicking more than six times in an hour no longer count. That's good for advertisers, and it's still Pixboard's call alone. Pixboard holds the evidence for every number that involves money.

There's a twist that makes it harder. To protect readers, a click reaches the advertiser with no referrer, so the advertiser can't see Pixboard visitors in their own analytics either. That was the right call for privacy, but it removed the one check an advertiser could run on their own. Pixboard has now fixed that without giving up the privacy: every click arrives at the advertiser's site marked ref=pixboard. That names Pixboard, not the reader, so an advertiser can count Pixboard visitors in their own records and compare.

That makes clicks checkable. It doesn't make looks checkable, and looks are what network ads are billed by. Publishers are still paid from Pixboard's own count, too. So this test is closer, and still not met.

Test 5: The principles live in the structure

A future owner can't quietly remove them. The charter holds them, not the founder's good intentions.

Not met. Pixboard is a brand of my company, phpMyDEV, LLC. Its privacy promises live in its code and its pages. Nothing in its terms or ownership stops a future owner from adding a tracking script. It's the same answer as VoltJS, and the same work is ahead: the charter that holds the principles doesn't exist yet.

Where that leaves it

  • Test 1, leaving: passes for publishers and advertisers. Unused looks still can't be refunded.
  • Test 2, pricing: passes for blocks, network ads and publishers, and the advertise page now says what a block does on its own.
  • Test 3, privacy: strong while reading, and the click record is now fully disclosed.
  • Test 4, accountability: not met, but clicks can now be checked from the advertiser's side.
  • Test 5, structure: not met.

The core idea holds up. Ads that render without tracking anyone while they read are possible, and Pixboard does it. When I first ran these tests, most of what failed was the paperwork around it: a price that wasn't public, a page that promised more than the code did, a privacy list missing one item. Those were the cheapest fixes, and all three are done. So are the next three.

What has changed, and what still has to:

  1. The advertise page says what a block does on its own, and what a pack of looks adds. Done.
  2. Look prices go on a public page. Done.
  3. The click record is listed in full, and the publishers page names the click log. Done. The referring page is still recorded.
  4. Advertisers can download their own numbers without asking. Done.
  5. A publisher who leaves under $25 gets paid what they earned. Done, on request.
  6. Destination links carry a marker, so advertisers can check the click count against their own records. Done.

What's left is the harder work: a way for someone other than Pixboard to check the look count, and a charter that holds these principles past me. When those change, this page will say so.

-- Richard Whitney. Write to me if this lands with you, or if you think I've got it wrong. More case studies.