Legal

Privacy Policy

Last updated: March 11, 2026

This Privacy Policy describes how the WP Remote Control mobile application ("App") and the Remote Control plugin ("Plugin"), collectively the "Service," handle your data. We are committed to transparency about what data exists, where it is stored, and who has access to it.

By using the Service, you agree to the practices described in this Privacy Policy.

1. Our Core Privacy Principle

WP Remote Control has no cloud backend. The App communicates directly with your WordPress sites over HTTPS. No data passes through, is stored on, or is processed by any server operated by us. We do not have access to your site data, your credentials, or any information about your WordPress sites.

2. Data the App Stores Locally on Your Device

The App stores the following data locally on your Android device:

2.1. Site Credentials (Encrypted)

  • WordPress site URLs
  • WordPress usernames
  • WordPress Application Passwords

These credentials are stored in the Android Keystore, which provides hardware-backed encryption. The credentials never leave your device except as part of authenticated API requests sent directly to your WordPress sites over HTTPS.

2.2. Site Configuration

  • Site display names
  • Custom tags you assign to sites (e.g., "Client: Acme Corp")
  • Lists of monitored URLs configured for health checks
  • Site settings and preferences

This data is stored in the App's local storage on your device.

2.3. Cached Data

  • Last-known health check results (HTTP status codes, response times)
  • Ping history and timestamps
  • Pending plugin update counts

This cached data provides instant access when you open the App and is refreshed when you interact with a site. Other data such as server vitals and plugin details are fetched live from your WordPress sites and held only in memory while the App is open. All cached data is stored locally on your device.

2.4. App Preferences

  • Display settings (sorting, filtering preferences)
  • Any App-level configuration you set

3. Data the App Transmits

3.1. To Your WordPress Sites

When you use the App, it sends HTTPS requests directly to your WordPress sites' REST API endpoints. These requests include:

  • Your authentication credentials (via HTTP Basic Authentication headers)
  • API requests for health data, plugin information, toggle states, and user data
  • Commands to perform actions (update plugins, toggle maintenance mode, generate one-time login URLs, etc.)

This communication occurs exclusively between your device and your WordPress sites. No data is routed through or intercepted by any intermediary server operated by us.

3.2. To Our Servers

None. The App does not transmit any data to servers operated by WP Remote Control. We do not operate a backend service, analytics endpoint, crash reporting service, or any other server that receives data from the App.

3.3. To Third Parties

The App does not send data to any third-party services. There are no:

  • Analytics or tracking SDKs
  • Advertising networks
  • Crash reporting services
  • Social media integrations
  • Any other third-party data collection

If we add analytics or crash reporting in a future version, this Privacy Policy will be updated before any such functionality is introduced, and users will be notified of the change.

4. Data Collected on Our Website

Our website at wpremotecontrol.com uses PostHog, a third-party analytics service, to help us understand how visitors use the site. PostHog may collect:

  • Pages visited and time spent on each page
  • Referring URL (how you arrived at our site)
  • Browser type, operating system, and screen size
  • Approximate geographic location (derived from IP address)
  • Interactions with page elements (clicks, scrolls)

This data is collected to improve our website and is processed by PostHog (posthog.com). PostHog's privacy policy applies to data they process on our behalf.

This analytics tracking applies only to the wpremotecontrol.com website. The WP Remote Control App and the Remote Control plugin Plugin do not include any analytics, tracking, or telemetry.

5. Data the WordPress Plugin Handles

The Remote Control plugin operates on your WordPress site(s) and handles data within that environment:

5.1. REST API Endpoints

The Plugin registers REST API endpoints under /wp-json/wprc/v1/ that provide:

  • Connectivity and version information
  • Server vitals (PHP, MySQL, disk, memory)
  • Plugin information and update triggers
  • Maintenance mode toggle
  • One-time auto-login URL generation
  • User password reset emails

These endpoints are protected by WordPress Application Password authentication and WordPress capability checks. Only authenticated users with manage_options permission can access them.

5.2. Auto-Login

The Plugin can generate one-time login URLs that grant temporary session access to the WordPress admin panel. These tokens are valid for 60 seconds, are single-use, and expire automatically.

6. Data We Collect

We do not collect any personal data, usage data, or telemetry from the App or the Plugin.

We have no knowledge of:

  • How many sites you manage
  • Which sites you connect to the App
  • How often you use the App
  • What actions you perform
  • Your name, email, or any other personal information

7. Data Sharing

We do not share any data from the App or the Plugin with third parties because we do not have access to any of your app or site data in the first place. As described in Section 4, our website uses PostHog for analytics — this is the only third-party data sharing we conduct, and it applies solely to the website, not to the App or Plugin.

8. Data Security

8.1. Credential Security

Your WordPress credentials are stored using the Android Keystore system, which provides hardware-backed encryption on supported devices. This means your credentials are encrypted by dedicated security hardware and are not accessible to other apps on your device.

8.2. Transport Security

All communication between the App and your WordPress sites occurs over HTTPS (TLS-encrypted connections). The Plugin refuses to serve requests over unencrypted HTTP connections in production environments.

8.3. Authentication

The Service uses WordPress Application Passwords for authentication. These passwords:

  • Are generated and managed within your WordPress admin panel
  • Can be revoked at any time from your WordPress user profile
  • Are scoped to individual applications (revoking the WP Remote Control password does not affect other application passwords)
  • Respect WordPress's built-in role and capability system

8.4. Local Data

Cached health data, ping history, and site configuration stored on your device are protected by your device's built-in security (screen lock, device encryption). We recommend keeping your device secured with a strong screen lock.

9. Data Retention and Deletion

9.1. App Data

All App data is stored locally on your device. To delete all data stored by the App:

  • Clear the App's data through your Android device settings (Settings > Apps > WP Remote Control > Storage > Clear Data). This removes all locally stored data, including site configurations, cached data, and encrypted credentials.
  • Uninstall the App from your device. Note that if Android's auto-backup is enabled on your device, some non-credential app data (site configurations, cached data, preferences) may be backed up to your Google account and restored if you reinstall the App. Encrypted credentials are not recoverable after reinstall. To ensure complete deletion, clear the App's data before uninstalling, or disable auto-backup for the App in your device settings.

9.2. Plugin Data

Maintenance mode settings are stored as WordPress options. This data remains on your WordPress site until you manually remove it or uninstall the Plugin.

9.3. Revoke Access

To revoke the App's access to a WordPress site:

  1. Log in to your WordPress admin panel.
  2. Go to Users > Profile.
  3. Scroll to Application Passwords.
  4. Revoke the Application Password named "WP Remote Control."

This immediately prevents the App from accessing that site. No action is needed within the App itself (though you may wish to remove the site from your App's site list).

10. Children's Privacy

The Service is not directed at children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect data from children. Since the Service does not collect any user data, this provision is included for completeness.

11. International Users

Since the App communicates directly with your WordPress sites and no data passes through our servers, your app and site data remains wherever your device and your WordPress sites are located. We do not transfer, process, or store app or site data in any jurisdiction. Website analytics data collected by PostHog (as described in Section 4) is processed in accordance with PostHog's data handling practices.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top indicates when changes were last made. If we make material changes -- particularly any change that introduces data collection or third-party services -- we will notify users through the App or our website before such changes take effect.

13. Your Rights

Depending on your jurisdiction, you may have rights regarding your personal data, including the right to access, correct, delete, or port your data. Since WP Remote Control does not collect or store any personal data on our systems, these rights are effectively self-service:

  • Access and portability: All your data is on your device and your WordPress sites, which you control.
  • Deletion: Clear the App's data or uninstall it to delete local data (see Section 9.1). Uninstall the Plugin and manually remove any remaining files to delete site-side data (see Section 9.2).
  • Correction: Edit your site configurations directly within the App.

If you have questions about exercising your rights, contact us at the address below.

14. Contact

If you have questions about this Privacy Policy, contact us at:

Email: hello@wpremotecontrol.com
Website: wpremotecontrol.com