Deactivation feedback — privacy notice

What happens to the message you type when you deactivate one of my WordPress plugins.

My plugin Invisible Anti-Spam & CAPTCHA (gdpr-compliant-recaptcha-for-all-forms) shows a small box when you deactivate it, asking what went wrong. If you type something and submit, that message is sent to this server. This page explains exactly what is sent, what is stored, and for how long.

It is entirely optional. Leave the box empty and nothing is transmitted at all — the plugin simply deactivates.

What is sent

• The text you typed, at most 500 characters.
• From plugin version 6.1.0 on: which of the plugins you were deactivating, and its version number. Older versions send only the text.

What you can choose to add

Since plugin version 6.2.0 the box also offers two optional things, and neither of them travels unless you choose it:

• A reason to click — one of five short options (“it did not work”, “too complicated” and so on). Clicking one is optional; it is stored as a short keyword next to your message.
• Technical details — only if you tick the box. Before you do, you can expand the box and read exactly the text that would be sent: WordPress and PHP version, your theme, the plugin’s own settings, and the list of active plugins with their version numbers. The plugin shows you that text itself, so what you read is what goes.

What is never in those technical details: the address of your site, and anything at all from the submissions the plugin has captured. Those belong to the people who sent them, not to the site owner, and they are not the site owner’s to pass on.

What is not stored

• No IP address.
• No address of your website, and no referring page.
• No browser or operating system information.
• No e-mail address or name — there is no field for one, on purpose.
• Nothing at all from your site's forms, visitors, or spam protection. That data never leaves your server, in either plugin.

The stored record is the text, a timestamp, and — for newer plugin versions — the plugin name and version. Nothing else.

One thing worth stating plainly

Like every web server on the internet, this one writes a general access log containing the requesting IP address, the referring page and the browser identification. That log is a normal operating record, it is not connected to the feedback message, it is not evaluated for this purpose, and it is rotated and deleted automatically after about seven days. To keep it that way, plugin versions from 6.1.0 on send the message without a referrer.

One further detail, for completeness: because the message is sent from your site to a different domain, your browser attaches an Origin header naming your site's domain. That is how browsers work and cannot be switched off by the sending page. It is not written to the access log and never becomes part of the stored record.

Why, on what basis, and for how long

Purpose: to find out why people stop using the plugins, so the actual problems get fixed. Legal basis is your consent under Art. 6(1)(a) GDPR, given by voluntarily typing a message and submitting it after reading the note in the dialog.

Messages are deleted automatically 90 days after they arrive. They are stored on the same server, are not passed on to anyone, and are not used for any other purpose — no mailing list, no profiling, no advertising.

Your rights

You have the right to information, correction, erasure, restriction, and to lodge a complaint with a supervisory authority. One honest limitation: because no identifying data is stored alongside your message, I normally cannot tell which entry is yours. If you want a message removed, send me the wording and the approximate date and I will delete it.

Controller and contact

Matthias Nordwig
E-mail: matthias.nordwig@programmiere.de
Postal address: see the Impressum — it is kept there so there is only one place to correct when it changes.