A privacy-safe approach to managing ad frequency