Privacy Policy
Last updated: 2 September 2026WPManager is a self-hosted control panel for managing WordPress sites. This policy describes what the installation at wpmanager.online stores, why, and who can see it. It is written for the people who use this installation.
Who runs this installation
This installation is operated privately. Contact for any privacy question, including data deletion: support@wpmanager.online.
What is stored
Account data
- Email address, first and last name.
- A password hash (bcrypt). Plain passwords are never stored.
- If you sign in with Google: your Google account identifier, email address and name.
- Sign-in timestamps.
Data about the sites you add
- Site addresses, names, categories and notes you enter.
- Credentials you supply for your own sites: WordPress application passwords and WPManager plugin API keys.
- Measurements taken from those sites: availability, response time, post counts, database and uploads sizes, plugin and PHP versions.
- Post content and file-hosting links, when you run a scan, so dead links can be found and repaired.
- API keys for the file-hosting services you choose to connect.
Google data, if you connect it
- Search Console (
webmasters.readonly): impressions, clicks, positions and queries for the properties you already own. - Analytics (
analytics.readonly): traffic reports for the properties you already own. - Gmail (
gmail.modify), only if you connect a mailbox: messages are read to pull in abuse and takedown notices, and marked as read once processed. Nothing is sent, deleted or forwarded on your behalf.
Access tokens are stored so the connection survives restarts. You can disconnect at any time in the panel, and revoke access from your Google account permissions.
Limited Use. WPManager's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data is used only to display the reports and notices you asked for inside your own panel. It is never sold, never used for advertising or profiling, never used to train machine-learning models, and never transferred to anyone except where you direct it or the law requires it.
What is not collected
- No advertising or tracking cookies, no third-party analytics on this panel.
- No payment card details — payments, where they exist, are handled by the provider.
- No data about visitors to the WordPress sites you manage beyond the aggregate figures Google reports to you.
Cookies
A single session cookie keeps you signed in. It is required for the panel to work and carries no advertising identifiers.
Where data lives and who can reach it
Everything is stored in a PostgreSQL database on the server that runs this installation, reachable only over an encrypted connection. Administrators of the installation can technically access stored records; no data is shared with any third party for their own purposes.
How long it is kept
Data is kept while your account exists. Deleting a site removes its records; deleting the account removes the account data. Ask at the address above to have everything erased — it will be done within 30 days.
Your choices
- Ask for a copy of your data, or for it to be corrected or deleted.
- Disconnect Google, file hosters or any site at any time.
- Revoke this application's Google access from your Google account settings.
Changes
If this policy changes, the date at the top changes with it. Material changes will be announced in the panel.