Data and privacy
What the plugin keeps on your site, what it sends elsewhere, and when. Status of version 0.4.1, as of 2026-11-12.
Nothing is sent to us
The plugin sends no data to its author: no telemetry, no usage statistics, no license check. It only contacts your own site and the services you configure.
What stays on your site
| Data | Why | Kept for |
|---|---|---|
| Registered AI applications and access tokens | Authenticate agents. Tokens are stored as hashes, never in clear text. | Until revoked or expired, then deleted after 30 days |
| Call log: date, application, account, tool, parameter summary, result | Show you what agents did. Sensitive parameter values are left out. | 30 days |
| Change log, with previous values | Allow undoing a changed setting or file | 30 days |
| Google and GTmetrix keys, Search Console connection | Call these services for you. They are never returned to agents. | Until you remove them |
| Backups: full database and site files | Restore or move the site. Unencrypted. | Until you delete them; kept if you uninstall the plugin |
What is sent to third-party services
Only when an agent or an administrator asks for it, and only if the service is configured.
| Service | What is sent | When |
|---|---|---|
| Google PageSpeed Insights and Chrome UX Report | The address of the tested page and your API key | Performance test requested |
| GTmetrix | The address of the tested page and your API key; each test uses your credits | GTmetrix test requested |
| Google Search Console | Data requests for your property, with your Google connection | Search Console data requested |
| IndexNow | The addresses of pages to recrawl and the site’s public IndexNow key | Submission requested |
| wordpress.org | The name of a plugin | Plugin description, installation or update |
What the AI application sees
The results of the tools the agent calls: content, settings, pages, reports. This information leaves your site for the AI application you connected, under its own terms. Only connect applications you trust, with an account whose rights match the task.
This site
The pages of mcp.wordpress-custom.com and wordpress-custom.com are static pages hosted by Cloudflare Pages, with no cookie, no tracker and no audience measurement tool. Cloudflare processes the technical data needed to route requests.