Telemetry & Privacy

Last updated: May 14, 2026

Overview

Flavor Media Folders can optionally send periodic environment reports so development can see which features actually get used and which WordPress / PHP versions matter. It is off by default. Turn it on or off any time in Settings → Privacy inside the plugin.

This page lists what the plugin sends, with a sample you can compare against the actual request in your browser.

This disclosure covers only the Flavor Media Folders WordPress plugin. For the website's general privacy policy, see the main privacy page.

Opt in, opt out

No telemetry is sent until you explicitly opt in. There are two opportunities to enable it:

  • First-run prompt – a one-time prompt appears after the plugin has been in use for a while. Dismissing it doesn't come back to bother you.
  • Settings → Privacy – a toggle to enable or disable at any time. This is the canonical switch.

When telemetry is off, nothing is sent.

What is collected

Environment snapshot (per scheduled report):

  • Plugin version – e.g. 1.0.0
  • Environment – production, staging, development, or local
  • WordPress version – e.g. 6.6.2
  • PHP version – e.g. 8.2.10
  • MySQL or MariaDB version – e.g. 8.0.36
  • WordPress locale – e.g. en_US, de_DE
  • Multisite flag – true or false
  • Memory limit in megabytes – e.g. 256
  • OS family – one of linux, windows, darwin, freebsd, unknown
  • Active theme slug – the public identifier from the theme's folder name, e.g. twentytwentyfour

Usage counters – always bucketed into ranges, never precise counts. Buckets: 0, 1-10, 11-50, 51-200, 201-1000, 1000+.

  • Feature usage counts – e.g. folder_create: 11-50, drag_and_drop: 51-200, command_palette_open: 1-10
  • Folder count bucket, file count bucket, max nesting depth bucket

Performance – typical and worst-case timing for a few operations, plus a count of JavaScript errors without any error details.

  • How fast the folder tree renders
  • How fast the admin interface loads
  • How long REST API calls take
  • How many JavaScript errors occurred (count only, no stack traces or URLs)

What is never collected

  • Site URL – only a non-reversible salted hash (see below)
  • IP address – not stored, not logged, not used for aggregation
  • File names, folder names, or file contents
  • User names, email addresses, or any WordPress account data
  • Search query contents – only counts how often search was used

Sample payload

This is what the plugin actually sends. You can compare it to the real request in your browser's DevTools when the scheduled cron fires.

{
  "product_slug": "flavor-media-folders",
  "plugin_version": "1.0.0",
  "environment": "production",
  "client_hash": "<64-char lowercase hex>",
  "wp_version": "6.6.2",
  "php_version": "8.2.10",
  "mysql_version": "8.0.36",
  "wp_locale": "en_US",
  "multisite": false,
  "memory_limit_mb": 256,
  "os_family": "linux",
  "theme_slug": "twentytwentyfour",
  "usage": [
    { "metric_name": "folder_create", "metric_value": "11-50" },
    { "metric_name": "drag_and_drop", "metric_value": "51-200" },
    { "metric_name": "command_palette_open", "metric_value": "1-10" }
  ],
  "perf": [
    { "metric_name": "tree_load_ms.p50", "metric_ms": 120, "sample_count": 256 },
    { "metric_name": "tree_load_ms.p95", "metric_ms": 340, "sample_count": 256 }
  ]
}

The server rejects any unknown field, so the plugin cannot silently add something without a corresponding update to this page.

Site identity

Site identity on the server is a non-reversible hashed identifier, not your domain. The plugin never sends the raw domain and never sees the server's secret. The server holds that secret outside the database; without it, hashes cannot be reversed to a domain.

If the server-side secret is rotated, every historical identifier becomes unlinkable from any current one.

Retention

The data is kept only as long as needed to understand how the plugin is used, then deleted. Long-term, only anonymous statistics remain.

Other plugin–server paths

This page describes telemetry specifically. Three other code paths contact our server – each documented in the External services section on the WordPress.org plugin page:

  • Pro license activation – sent only by the Flavor Media Folders Pro add-on plugin. Validates the license key and enforces the seat limit. The free plugin never makes this call.
  • Pro update checks – sent only by the Pro add-on, through the standard WordPress update channel.
  • Feedback submissions – Free and Pro. Sent only when you explicitly submit feedback through the plugin UI.

Verify it yourself

The most convincing proof is the payload on the wire. To inspect it:

  1. Open the WordPress admin with DevTools / Network tab visible.
  2. Trigger the telemetry cron – for example, via WP-CLI.
  3. Watch for the outbound request to the Flavor Media telemetry API and compare its body to the sample above.

The wire format is the authoritative disclosure. If anything on this page differs from what the plugin actually sends, treat the payload as the truth and report the discrepancy.

Questions

Anything unclear about what the plugin collects or how it is processed? Email [email protected].