Wordpress.com does not run ads. The free level has limits on space and you use the name yoursitename.workpress.com
Want a custom URLs you pay a fee. Want more space you pay a fee. There are conduct rules. Any free site will have rules or it will be full of spam ads
WordPress.com does run ads, but if you're a logged in user you seldom see them and you never see them on your own blog. Other people might see them on your blog, though. To get rid of them completely (on your own blog) you need to buy an upgrade.
You have a 3Gb limit on media storage, but you have unlimited bandwidth and posts and pages don't count towards your storage space - no limit on those. And if you only upload images that 3Gb can last for years provided you optimise your images for the web before uploading.
The most severe rule on WP.com is around adding your own advertising (which also covers image links to affiliate programs; text affiliate links are fine). Not allowed under any circumstances. Generally that, severe copyright violations and spammy content (which also falls under their advertising policy) will get you suspended, but not much else.
I use one site to purchase my domain name (emergencyroomproductions.net) and Wordpress.com's free option. You have to be a (IIRC) $12 or $13 redirect fee (yearly) so that when you type in the domain name it directs you to the Wordpress site. I think I pay $12 or so a year for the domain name too. i found that to be the most cost effective.
You're talking of the domain mapping upgrade. You can buy a domain directly through WP.com, or you can buy a domain elsewhere and then buy mapping to point it at your free site.
(If you buy your domain via WP.com you're also allowed to use it with a different host or transfer it to a different registrar. The domain is registered with ICANN in your name, as with any other registrar, so you own the domain completely and can use it with any host you choose. But if you use the domain with a WP.com blog then WordPress still owns the underlying WordPress.com domain, as @alexaherself pointed out, and can shut that down if you break the rules, meaning your custom domain will be pointing at nothing.)