Legal

Privacy policy

This policy explains what Silent Threads collects when you use this website, the licensing service and the WordPress plugin, why we collect it, and what you can do about it.

What we collect

• Account and license details: your email address, your site addresses, your license keys and plan, and when they were created.
• Plugin check-ins: the plugin, WordPress and PHP versions your site runs, when it last checked in, and the IP address it checked in from.
• Billing records: the payments and refunds recorded against your license.
• Messages: what you send through the contact form, support tickets and live chat.
• Attacker IP addresses for the plugin's attack map: looked up to find their country, then discarded. They are not stored or logged.
• Security logs: records of activations, sign-ins and similar events on our service, kept to detect abuse.

The plugin never sends your posts, files or passwords. The only visitor data it sends is the IP address of requests it identified as attacks.

Why we collect it

To issue and validate licenses, deliver signed updates and feeds, send license and sign-in emails, answer support requests, keep billing records and protect the service against abuse.

Network protection (opt-in attack sharing)

If you turn on “Help protect other sites” in the plugin (off by default), your site reports attacking IP addresses to us hourly, but only IPs your own site already blocked, never IPs from a private network, loopback, or your own trusted-IP list. Each report contains the IP address, which of our rule IDs it triggered, a hit count, and first and last-seen timestamps. We do not receive page content, visitor identities, or anything from a request that wasn't itself flagged as an attack.

We use these reports only to build a shared blocklist. An IP reported by several different sites is treated as a real, active threat and added to a list that every paid-plan site can use to block it before it attacks them too. We never list IPs on the strength of a single site's reports, and we maintain an allowlist (search-engine crawlers, CDN edge ranges and manually reviewed exceptions) so legitimate traffic is never listed by mistake.

Raw reports are deleted after 30 days. Only the aggregated blocklist state (the IP, its status and when it was last seen) is kept beyond that, never the per-site detail of who reported it. Turning the setting off stops new reports immediately; reports already sent are deleted on the normal 30-day schedule.

To show where attacks came from, the plugin sends attacker IP addresses to our server for a country lookup. These are not stored.

Public threat map

The globe on our home page is built from the same opt-in reports, reduced so that no site or visitor can be identified:

• Each IP address is converted to a country on our server and never published. The map shows countries only.
• It covers the last 24 hours, delayed by at least 15 minutes, and is refreshed every 5 minutes.
• A country is shown only if at least 5 events were reported by at least 2 different sites.
• While fewer than 5 sites share data, no numbers are shown and the globe is labelled as an illustration.
• No site address, license, rule ID or IP address is ever included.

Country lookups (for this map and for the plugin's attack map) use the DB-IP Lite database, which runs on our own server; IP addresses are not sent to DB-IP.

Contact form

When you send us a message, we store your name, email address, subject and message, the page you sent it from, and when you agreed to us storing them, so we can reply and keep the conversation together. Messages are kept for 24 months and then deleted automatically. You can ask us to delete them sooner.

Website analytics

We count how the website is used with our own cookie-less analytics, hosted on our own server. No third-party analytics or advertising tools are used. When you view a page or click a button, your browser sends the page path, the name of the button or event, and where the visit came from (the referring website or a campaign tag in the link). We add one to a daily counter for that combination. That counter is all we keep.

• No cookies, no device or visitor identifier, no fingerprinting.
• Your IP address is not stored. It is used only, in memory, to limit how many events one connection can send.
• Site search sends only the length of what you typed, never the text.
• If your browser sends Do Not Track or Global Privacy Control, nothing is counted.
• To remember where your visit started, for counting sign-ups by landing page, your browser keeps that page and campaign tag in session storage, which is cleared when you close the tab.

Website chat assistant

The chat button on this website opens an AI assistant that answers questions from the text of our public pages. It is labelled as an AI in the chat, and a person on our team can take over at any time.

• What goes to the AI provider: your question and the passages of our public website text that match it, sent to Anthropic’s API to write the answer. Before sending, we remove anything that looks like an email address, a long number (such as a card or phone number) or a key or password. Nothing from your account, license or site is sent, and neither is your name or email address.
• Not used to identify you: the chat uses no cookies. Your browser keeps a random conversation ID in local storage so the conversation survives moving between pages; we store only a scrambled (hashed) version of it, and it isn’t linked to analytics or to anything else about you.
• Talking to a person: if you ask for a person, we ask for your name, email address and a one-line summary, with your agreement, and use them only to reply about that conversation. The conversation becomes a live chat or a support ticket and is kept like our other support messages.
• Retention: chat transcripts are kept for 90 days so we can check and improve the answers, then deleted automatically.

Please don’t type passwords, license keys or payment details into the chat. We’ll never ask for them there.

Email lists

If you ask for the WordPress security checklist or for release-note emails, we store your email address, which list you joined, the exact consent sentence you agreed to, the time and the page you signed up on. Nothing is sent beyond one confirmation email until you click the link in it (double opt-in). Every email has an unsubscribe link, and unsubscribing takes effect immediately. We use your address only for the list you joined, and send it through the same email service as our other emails.

Free website security checker

When you scan a site with the security checker, we store the domain you entered, the findings, the grade and the time of the scan, so the result link keeps working. We don’t store the pages we fetched, and we don’t store your IP address (it is only held in memory briefly to apply rate limits). Results are deleted automatically after 90 days, unless the operator sets a different period. Result pages show only what anyone could see by visiting the site; the more detailed findings are only shown through the emailed owner link.

If you ask us to email a report, we store your email address, the domain and grade of that report, the exact consent sentence you agreed to and the time. Nothing is sent beyond one confirmation email until you open the link in it (double opt-in). Requests that are never confirmed are deleted after 7 days. Every email has an unsubscribe link. To have past results for your domain removed, contact us.

Cookies

See the cookie policy. In short: no analytics or advertising cookies, and the marketing pages set no cookies at all.

Who else handles it

Our hosting provider stores the service's data, and an email delivery service sends license and sign-in emails. We don't sell your data or use it for advertising.

How long we keep it

Attack reports are deleted after 30 days. Analytics are kept only as daily counters. Email-list records are kept until you unsubscribe, plus a record of that unsubscribe so we don't email you again. Account, license and billing records are kept while your license exists and for as long as we need them for accounting.

Your choices

You can turn attack sharing off in the plugin at any time. To see, correct or delete your data, contact us from the email address on your account.

Changes

If we change this policy, we'll update this page.