Privacy policy

This policy covers two things: the MetaWrench plugin running on your WordPress site, and this website, metawrench.io, including our service at api.metawrench.io. It is written by MetaWrench LLC, Georgia, United States. Questions go to support@metawrench.io.

MetaWrench runs entirely on your own server. Your pages, settings, backups, email logs, firewall logs and 404 logs are stored in your WordPress database or your filesystem and never leave it unless you send them somewhere yourself — for example, a backup to your own Google Drive.

The plugin contacts our server, api.metawrench.io, for:

• Signing in to the services you connect, so you don’t need to create your own developer accounts. These are Google (Search Console, Analytics, Business Profile, Google Ads, Tag Manager, AdSense and Google Drive), Bing Webmaster Tools, Microsoft Advertising, the ad platforms whose tracking pixels MetaWrench can fill in for you (Facebook and Instagram, TikTok, Pinterest, Snapchat and LinkedIn), and Dropbox. Each one is used only after you press its Connect button. Our server holds MetaWrench’s app keys and completes the sign-in with the provider. The tokens that come back are handed to your site within five minutes and then deleted from our server. The long-term token that keeps you connected is stored only on your site. About once an hour your site sends that token to our server so it can be renewed; we pass the new short-term token straight back and store neither.
• Tracking pixels. When you press Connect next to an ad platform, your site reads the list of pixels or tags in your own ad account and saves the ID you pick, so you don’t have to copy it. If you have none, it can create one in your account when you ask. It does not read or change your campaigns, ads, audiences or budgets.
• Backups to Google Drive and Dropbox. Your site uploads backups straight to your own account. With Google Drive it can see only the files MetaWrench made there. With Dropbox it uses only its own folder, Apps/MetaWrench. Backup files never pass through our server.
• Page speed checks. The address of the page being measured is sent so Google PageSpeed Insights can test it. If you add your own PageSpeed key in the plugin, this goes straight to Google instead.
• My Site choices. When you choose what your website is for, the plugin loads the list of categories and the questions for your category from our server. It sends only what you type into the category search and the category you pick. Your answers stay on your site.
• Security features (Pro). Explained in section 03.

Each of these requests also sends your site address and licence details. Our server sees the IP address the request comes from and uses it only to stop abuse; it is not kept. We count how many requests each licence makes per day, storing the licence only in scrambled (hashed) form, and keep those counts for 40 days. We keep a short error log of what went wrong, never tokens or content, for no more than 30 days. We never receive page content, visitors’ browsing, logs or backups.

Licences and updates are handled by Freemius, our payment and licensing provider. When you activate a licence, your site connects to Freemius and sends your site address, your WordPress admin name and email address, and basic technical details (WordPress, PHP and MetaWrench versions) so the licence can be tied to your site and updates delivered to it. On the free version this connection is optional and you can skip it. Freemius handles this data under its own privacy policy. To confirm a licence, api.metawrench.io sends Freemius your site’s Freemius install ID and licence key, and remembers a confirmed answer for up to 10 minutes.

Some tools connect straight from your server to a service you choose, using credentials you supply: SMTP email providers, cloud backup storage (Amazon S3, FTP, or Google Drive and Dropbox if you use your own app keys instead of the Connect button), a Bing API key if you use one instead of signing in, and IndexNow, which tells search engines when your pages change. The Pro malware scan also asks WordPress.org for the official file fingerprints, and when you ask for it the original copy of a file, of plugins that come from WordPress.org — it sends only the plugin’s name and version. We are not in the middle of these and cannot see them.

These are part of MetaWrench Pro. The first two run whenever the matching feature is used; the rest only when you switch them on.

• Known security holes. Once a day, and after updates, your site sends the folder names and version numbers of your plugins, themes and WordPress. We answer with known security problems for those versions, using data from Wordfence Intelligence. We do not store the list.
• Security lists. Your site downloads the list of known attack networks, the malware patterns and the list of files confirmed as false alarms, sending only its licence and site address. The lists come from public sources (Wordfence, Spamhaus, Emerging Threats) and from MetaWrench; we send those sources nothing about you.
• Shared attack list (off until you switch it on). The IP addresses of visitors your site locked out for guessing passwords, or whose requests its firewall blocked as attacks, are sent to us once an hour with the kind of attack and how often it happened. We use them only to build a list of attacking addresses that other MetaWrench sites block. An address is only listed after three different customers report it. Reports are deleted after 8 days.
• False-alarm reports (off until you switch it on). When a malware scan flags a file, or you mark one as safe, we receive a fingerprint of the file, a short name (for files in your uploads folder, only the top folder and the file name), what the scan found and the plugin version — never the file itself. Reports are deleted 90 days after the last one about the same file.
• Site watching (off until you switch it on). We receive your site address and the email address for alerts. Our server loads your home page every 15 minutes, checks your SSL certificate twice a day and emails that address about problems. We keep daily up-or-down counts for 30 days and your last 20 outages, and delete everything 3 days after you switch watching off or remove the plugin.
• Email failure alerts. If your site’s email fails three times in a row, it sends us your administrator email address, the number of failures and the error message, and we email you a warning — at most once a day. We keep only the date of the last warning, for 7 days.

Our server runs on Hostinger, which also sends our alert emails.

When you connect a Google account, MetaWrench asks only for the permissions the features you use need:

• Search Console — to show the searches, clicks and rankings for your site. If you ask MetaWrench to set it up for you, it also adds your site to Search Console.
• Site Verification — to prove you own your site, so Search Console can be set up without DNS changes. Only when you ask MetaWrench to set things up.
• Google Analytics — to show visitor numbers. If you ask it to, it also creates an Analytics property for your site.
• Business Profile — to show views, calls and direction requests from your Google listing, and your reviews.
• Google Ads — only if you connect it: to show clicks, spend and conversions, and to fill in your conversion tracking ID. MetaWrench only reads your account. It never creates or changes campaigns, ads, budgets or bids.
• Tag Manager — only if you connect it: to list your containers and, when you pick one, add your own Analytics and Ads tags to it and publish it.
• AdSense — only if you connect it: to show what Google’s ads on your site earned, ad clicks and earnings per 1,000 page views. MetaWrench only reads your AdSense account. It also adds your AdSense line to your site’s ads.txt file, which Google requires.
• Google Drive — only if you connect it for backups: to save your website backups to your Drive and to restore or delete them. It can see only the files MetaWrench created, not anything else in your Drive.
• Your Google account email address — shown in the plugin so you can see which account is connected.

This data is fetched by your site and stored only on your site, to show on your MetaWrench dashboard. We do not store it, sell it, use it for advertising, or use it to train AI models, and people at MetaWrench cannot read it — unless you give us permission to look for a support request, it is needed for security, or the law requires it.

MetaWrench’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time from the plugin’s Connections screen (or the Backup screen for Google Drive), which deletes the tokens and the data from your site. You can also remove MetaWrench’s access from your Google Account at myaccount.google.com/permissions.

• Bing Webmaster Tools — to show your site’s searches and clicks on Bing, and to send Bing your new pages.
• Microsoft Advertising — only if you connect it: to show clicks, spend and conversions. It only reads your account.
• Facebook and Instagram, TikTok, Pinterest, Snapchat and LinkedIn — only if you press Connect next to a tracking pixel: to read the list of pixels in your own ad account, save the ID you pick, and create one if you ask. It never reads or changes your campaigns, ads, audiences or budgets.
• Dropbox — only if you connect it for backups: to save, restore and delete backups in its own folder, Apps/MetaWrench, and to show which Dropbox account is connected.

As with Google, this data is fetched by your site and stored only on your site. We do not store it, sell it, or use it for advertising or to train AI models.

To delete it: press Disconnect for that service in the plugin (on the Connections screen, or the Backup screen for Dropbox). That deletes its tokens and data from your site straight away. Removing the plugin deletes all of it. You can also remove MetaWrench’s access in that service’s own settings — for Facebook and Instagram, under Settings › Business integrations — or email support@metawrench.io and we will confirm that our server holds nothing about you.

Checkout is handled by Freemius, who act as merchant of record. They collect your name, email address, billing address and payment details under their own privacy policy. We receive your name, email address, the product you bought, the licence key that was issued and the sites it is activated on. We do not receive or store card numbers.

We use your email address to send the licence key, renewal reminders, and notices about changes that affect your licence. We do not send marketing email unless you opt in.

metawrench.io uses Google Analytics to count visits and see which pages are read, and Google Ads conversion tracking to see which of our ads lead to a purchase. Google sets cookies for both. We do not sell or share visitor data.

If you email support, we keep the conversation so we can refer back to it if you write again.

Purchase records are kept for as long as your licence is active and for seven years after, because tax law requires it. Support emails are kept for three years. Analytics data is kept for the period Google Analytics is set to, currently 14 months. On api.metawrench.io: sign-in data is deleted within minutes, licence checks are remembered for up to 10 minutes, request counts for 40 days and the error log for no more than 30 days. Security data is kept as section 03 describes: attack reports 8 days, false-alarm reports 90 days, site watching until 3 days after it is switched off, and the date of the last email-failure warning 7 days.

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email support@metawrench.io and we will answer within 30 days. Deleting a purchase record will cancel the licence attached to it.

We process this data to provide the features you use and switch on, and in our legitimate interest of keeping websites secure.

If you are in the EU, UK or another region with a data-protection regulator, you also have the right to complain to that regulator.

Because the plugin runs on your site, you are the controller of any visitor data it processes — IP addresses in the firewall log, addresses in the 404 log, recipients in the email log (kept for 30 days), and so on. Your own privacy policy should cover that. MetaWrench gives you retention settings for those logs so you can keep them as short as you like, and adds suggested wording you can copy into your policy under Settings › Privacy › Policy Guide in WordPress.

If you switch on the shared attack list, the IP addresses of attackers your site caught are also sent to us, and we use them only as section 03 describes.

If we change this policy in a way that affects you, we will email licence holders before it takes effect. The date at the top is always the current version.