WP.MD tracks the popularity of WordPress themes and plugins. It’s built and maintained by me, Pavel Ciorici. This page explains what data the site collects about you and what happens to it.
The short version
- No advertising trackers, no cross-site tracking, no fingerprinting.
- Analytics are anonymous and cookieless (Fathom Analytics).
- I don’t sell, rent, or share your data with anyone.
- The site holds personal data only if you give it: an account, a newsletter subscription, a comment, or an email to me.
What the site collects
Anonymous analytics. WP.MD uses Fathom Analytics, a privacy-first analytics tool, to count visits and see which pages people read. Fathom doesn’t use cookies, doesn’t store IP addresses, and doesn’t track you across other websites. I see aggregate numbers (“this page got 300 views”), never individual people.
Server logs. Like almost every website, the server that hosts WP.MD keeps standard access logs — IP address, browser type, pages requested, timestamps. These exist for security and debugging, are not used to identify or profile visitors, and are rotated automatically after a short period.
Search queries. Searches you type into the site’s search box are processed to return results and may be cached briefly for performance. They are not linked to you.
Comments. If you leave a comment on the blog, the site stores the name, email address, and optional website you provide, along with your IP address (WordPress records it for spam prevention). Your email is never published. Comments use Gravatar for profile pictures, which means an anonymized hash of your email address is sent to the Gravatar service to check whether you have a profile there — Gravatar’s privacy policy is here.
Email. If you email me, I’ll have your email address and whatever you wrote. I use it to reply to you and for nothing else.
Accounts
You can create an account on WP.MD, either with an email address and password or by signing in with Google.
- Manual registration stores your username, email address, and a hashed password (I can’t see the actual password).
- Google sign-in shares your name, email address, and profile picture with the site, as permitted by the consent screen Google shows you. I never see your Google password, and the site requests no access to anything else in your Google account. Google’s own privacy policy is here.
Your account data is used to run your account — nothing else. Anything you choose to publish on a public profile is, of course, public. You can ask me to delete your account and its data at any time.
Newsletter
The blog newsletter runs on Jetpack subscriptions, a service by Automattic (the company behind WordPress.com). If you subscribe, your email address is stored by WordPress.com to deliver new posts to your inbox; Automattic’s privacy policy is here. Every email includes an unsubscribe link, and unsubscribing takes effect immediately. Your address is used for the newsletter only — never shared, never used for anything else.
Cookies
The site sets no cookies for regular visitors — analytics are cookieless. Cookies are used only where they’re functionally necessary: to keep you logged in if you have an account, to remember your details if you leave a comment, and to manage your newsletter subscription. None of them track you across other sites.
Affiliate links
Some outbound links to commercial themes, plugins, and hosting products are affiliate links — if you click one and buy something, I may earn a commission at no extra cost to you. Pages that contain affiliate links say so. Clicking an affiliate link takes you to the vendor’s or affiliate network’s website, where their own privacy policy applies; some networks set cookies on their domains to attribute the sale. WP.MD itself sets no affiliate cookies, and rankings on this site are never influenced by affiliate relationships.
Data about themes and plugins (not about you)
The statistics on this site — install counts, download numbers, rankings, real-world usage — come from public sources such as the WordPress.org API, BuiltWith, Envato, and Google PageSpeed Insights. That data describes software products, not visitors. Theme and plugin author names shown on the site are the public author names from those same sources.
How long data is kept
Analytics data is aggregate and anonymous, so there’s nothing to delete. Server logs rotate automatically. Account data is kept while your account exists and deleted when you ask me to close it. Newsletter addresses are kept until you unsubscribe. Comments and the details attached to them are kept until you ask me to remove them. Emails are kept as long as needed to deal with whatever they’re about.
Your rights
You can ask me at any time to show you, correct, or delete the data the site holds about you — your account, subscription, comments, or correspondence. If you’re in the EU/EEA or UK, this covers your GDPR rights of access, rectification, erasure, portability, and objection; residents of other jurisdictions with similar laws (such as the CCPA) have equivalent rights. There’s no “sale” of personal data to opt out of, because none happens. Just email me and I’ll sort it out — and if you’re unsatisfied, you have the right to complain to your local data protection authority.
Changes to this policy
If the site starts collecting something new, this policy will be updated before that launches, with a new date at the top.