Privacy policy
Updated
Short version: this website doesn't track you. The free plugin doesn't phone home; Pro only checks its licence and updates with hushfort.com.
This website (hushfort.com)
No tracking cookies, no ad pixels. We don't use Google Analytics, advertising networks, social media pixels or session recording.
Analytics. We may use Cloudflare Web Analytics to count page views. It doesn't use cookies or local storage and doesn't build profiles of visitors. It records things like the page visited, the referring site, the browser type and the country, in aggregate.
Server logs. Like any web server, ours keeps short-lived access logs (IP address, time, page requested, browser). We use them only to keep the site running and secure, and we don't combine them with any other data.
Email. If you write to [email protected], we receive your email address and whatever you include in your message. We use it only to answer you, and we don't add you to a mailing list.
The Hushfort Security plugin
The free plugin sends no data to us. There is no telemetry and no usage reporting.
Hushfort Pro (the paid add-on) contacts hushfort.com about once a day to check its
licence and to look for updates. It sends only your site's domain, the licence key and the
plugin version. It sends no visitor, user, form or log data.
No third-party services. Spam, form, comment and signup checks run entirely on your own server. There is no reCAPTCHA and no external anti-spam API.
The only other outbound requests:
- Google's and Bing's public lists of crawler IP addresses, used to tell real search bots from fake ones. No personal data is sent with these requests.
- Cloudflare's API, only if you enter your own Cloudflare API key, and only to switch your zone's security level during emergency mode.
What the plugin stores on your site. To do its job, Hushfort keeps logs of failed
logins, blocked requests and quarantined messages in your own WordPress database. Email
addresses in these logs are stored hashed and shown masked (for example a***@gmail.com).
Logs are kept for a limited time (14 days by default, adjustable). The plugin connects to
WordPress's built-in "Export Personal Data" and "Erase Personal Data" tools, so you can answer
your own visitors' requests.
You are the controller of that data on your site. We never see it.
Your rights
You can ask us what personal data we hold about you (in practice, only support emails), and ask us to correct or delete it. Write to [email protected].
Changes
If this policy changes, we'll update the date at the top of this page.