WP Signal is an independent service and is not affiliated with or endorsed by the WordPress project.
Sign up free

Privacy Policy

Last updated: February 2026

WPSignal.io (“WPSignal”, “we”, “our”, or “us”) operates the wpsignal.io service. This policy describes how we collect, use, and protect your information.

Information We Collect

Account information. When you sign up, we collect your email address and a hashed password. We do not store plaintext passwords.

API credentials. We generate and store API keys and site secrets on your behalf. Site secrets are used exclusively for HMAC-signed publish authentication.

Event data. We relay events published by your WordPress site to subscribed browser connections in real time. We do not persist event payloads beyond the relay operation.

Usage logs. We collect server logs including request timestamps, IP addresses, and error traces for security and debugging. Logs are retained for up to 30 days.

How We Use Your Information

  • To authenticate your account and API requests
  • To provide the realtime event relay service
  • To detect abuse and enforce rate limits
  • To send transactional communications (e.g. account notices, security alerts)

We do not sell, rent, or share your personal information with third parties for marketing purposes. The events emitted from your website (using the WordSocket plugin) are encrypted, so even if we wanted to, we could never read your information.

Data Storage

Your account data is stored in a SQLite database on our server infrastructure. Data is stored in the European Union or United States, depending on the deployment region.

Cookies and Local Storage

The WPSignal dashboard stores your session token in browser localStorage. No third-party tracking cookies are set.

Third-Party Services

WPSignal does not integrate third-party analytics, advertising, or tracking services.

Data Retention

Account data is retained for as long as your account exists. You may delete your account and associated data by contacting us. Anonymized aggregate statistics may be retained indefinitely.

Security

We use HMAC-SHA256 for publish authentication, Argon2id for password hashing, and JWT HS256 for session tokens. All data is transmitted over TLS.

Your Rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data. Contact us to exercise these rights.

Children

WPSignal is not directed at children under 13. We do not knowingly collect data from children.

Changes

We may update this policy from time to time. Material changes will be noted on this page with an updated date.

Contact

For privacy questions: privacy@wpsignal.io