A more private way to measure ad conversions