Every claim on this page can be checked by reading the plugin, which is ordinary PHP and JavaScript sitting on your own server. It is written that way on purpose: a security page nobody can verify is a security page nobody should believe.
Last updated 2026-08-19
On your server, in your WordPress database, in tables belonging to this plugin. No traffic is routed through us, nothing is proxied, and there is no copy of your visitors anywhere else. What is recorded is:
Uninstalling removes all of it. Until then, housekeeping settings control how long anything is kept.
A page on your site loads without contacting anybody. Not us, not a CDN, not an analytics service — the device-recognition library is served from your own site along with everything else the plugin needs. Away from page loads there are three outbound requests and no others:
Until version 6.54.0 the device-recognition library was loaded from a public CDN, which meant that company saw the address of every visitor to your site on every page view. It is served from your own site now. If you are on an older version, updating is worth doing today.
Reading a Google Ads account needs two credentials that cannot live inside a plugin: an OAuth client secret, and a developer token that Google’s terms treat as confidential. A plugin is a zip file anybody can download and read, and a leaked developer token is suspended for every customer at once, not just whoever leaked it. So those secrets stay on one server and the plugin asks that server.
What stays on your own hosting is your own authorisation to your own account, encrypted where it sits. The access you grant is read-only: campaign names, click identifiers, and what you were charged. It cannot change a campaign, a budget or a bid, and it never adds an exclusion on your behalf.
A visitor cannot log in before being recorded, so the address that records a visit has to accept requests from the whole internet. That makes it the only part of the plugin an attacker can reach, on every site running it — and so everything it writes has a ceiling: a maximum size for the whole request, maximum lengths on every field inside it, and limits on how much any one visitor can record.
The ceilings exist so that the plugin protecting your site cannot become the way it is taken down. A genuine request is a few kilobytes; the limits sit far above that and far below anything that could fill a database.
You choose, in Settings, and old records are removed on a schedule. There is one deliberate exception: people you have blocked are kept indefinitely, including their fingerprint. Deleting a blocked visitor would quietly unblock them, which is the opposite of what deleting them appears to do.
There is also a control that erases everything the plugin has recorded, in one action, without uninstalling it.
Your licence key, your site address, your plugin version, and a monthly visit count — the four fields the licence check sends, and nothing else. We cannot see your visitors, your campaigns, your traffic or your database, and there is no mechanism inside the plugin by which we could ask for them.
Payment is handled by Paddle, who are the seller of record. Card details go to them and never reach us.