Privacy Policy

SiteRack is a product of Driven Development, LLC. It monitors WordPress sites, and this page explains what we collect, why we collect it, and what you can switch off.

What we collect

Your account

• Your name and email address.
• Your password, stored hashed, and your two-factor or passkey credentials.
• When you sign in, and the IP address you signed in from.

Billing

If you subscribe to a paid plan we store your plan, your billing email and your payment history. Card details go straight to Stripe, our payment processor. We never see them and we don’t store them.

Your sites

• The name and address of each site you connect.
• Its WordPress and PHP versions, and configuration such as whether HTTPS is on and whether file editing is disabled.
• The plugins and themes installed on it, with their version numbers.

Site activity, if activity logging is on

Events your site reports: sign-ins and failed sign-ins, plugin and theme changes, user accounts created, settings changed, files uploaded. Each event carries the time it happened, the WordPress user involved, and the IP address your site saw.

Files, if malware scanning is on

SiteRack indexes the files on your site that WordPress could execute. For each one it records the path and a cryptographic hash — a fingerprint that identifies the file without revealing what is in it.

Most files never go further than that fingerprint, because the same file sits on thousands of WordPress installs and we already know what it is. When a fingerprint is one we have not seen before, SiteRack uploads a copy of that file and scans it for malware.

Uploaded files are used for one thing: deciding whether the file is malicious. We don’t share them, and we delete them once the scan has finished and its result is recorded.

A file that WordPress can execute may contain configuration or credentials. If that isn’t acceptable for a particular site, switch malware scanning off for it — SiteRack then stores nothing about that site’s files at all.

What we don’t do

• We don’t sell your data, and we don’t share it with advertisers.
• We don’t hand your sites’ details or files to another company to be checked. Vulnerability matching and malware scanning both happen on our own systems.
• When we do ask an outside source a question, we ask about a plugin name or a WordPress version — never about your site.

How long we keep it

• Activity logs: 30 days on the Free plan, one year on Pro.
• Site information and file indexes: for as long as the site is connected. Remove the site and its records go with it.
• Uploaded files: until the scan finishes and its result is recorded, then they are deleted.
• Account information: until you close your account.

Who else is involved

• Stripe processes payments. Card details go to Stripe, not to us.
• Postmark sends our email.
• Our hosting and storage providers hold the data described above and act only on our instructions.

We also query public sources — WordPress.org and public vulnerability databases — about software versions and plugin names, as described above.

What you control

• Switch activity logging off for any site.
• Switch malware scanning off for any site, which stops both the scanning and the storing.
• Disable single sign-on.
• Disconnect or remove a site at any time.
• Ask us to close your account and delete its data.

Keeping it secure

Your SiteRack account supports two-factor authentication and passkeys, and traffic between your sites and SiteRack is encrypted in transit.

SiteRack has no way to install plugins, create users, or run code on your sites. Single sign-on is the one feature that grants access to a site, and it can be disabled.

Changes to this policy

We’ll update this page as SiteRack changes. The date at the top tells you when it last changed.

Contact

SiteRack is a product of Driven Development, LLC, King County, Washington, USA.

Questions about this policy, or want your account and its data deleted? Contact us.