Skip to content

Kinto Static Privacy Policy

Last updated: 31 October 2026.

This policy covers the free WordPress plugin Kinto Static and the two small services Kinto LLC runs for it: the connect relay (connect.kinto.co) and the problem-report service (feedback.kinto.co). It does not cover the kinto.co website, which has its own policy at https://kinto.co/privacy-policy/.

Who is responsible

Kinto LLC (“Kinto”, “we”) is the controller of the data described here. Address: KINTO LLC (OtoCo WY LLC – KINTO – Series 383, a U.S. Series LLC), 5212 Ardmore Springs Circle, Greenville, SC 29615, United States. Contact: [email protected].

The short version

  • The plugin has no analytics, tracking or telemetry. It sends nothing to Kinto on a schedule, and nothing at all until you agree.
  • Kinto never receives your Cloudflare password, access key, access token or renewal token.
  • Kinto never receives your site content or your user names. Your site address passes through the connect relay when you connect (section 1) and is not stored; problem reports do not collect it.
  • Kinto only receives data when you press Connect with Cloudflare (relay), send a problem report (after you read it and confirm) or send a panel choice from “Which panel should we automate next?” (after you tick its box).
  • Your static site is published to your own Cloudflare account. That is between you and Cloudflare.

1. Connect with Cloudflare (relay at connect.kinto.co)

Used only if you click Connect with Cloudflare after ticking the consent box. It is not used if you paste an access key instead.

What the relay sees

  • Your wp-admin return address (the page on your site where you land after approving), a random one-time value (nonce) and a PKCE challenge (a hash). These arrive in the request from your browser.
  • A signed “state” value that holds your return address, the nonce and an expiry (up to 10 minutes). It is signed with a secret key held by Kinto.
  • A short-lived browser cookie (__Host-kinto_tx, up to 10 minutes) that ties the request to your browser. It is cleared after use.
  • When Cloudflare sends you back, the one-time authorization code passes through the relay in the redirect URL. The relay forwards it to your site and does not keep it.
  • Like any web server, the request reaches Cloudflare’s network, which sees your IP address and browser details. See “Processors” below.

What the relay does not see: your access or renewal token, the PKCE secret, your Cloudflare password, or any content of your site. The token exchange happens directly between your server and Cloudflare.

What the relay stores: nothing. It has no database. Observability is turned off in its configuration, and the report Worker’s configuration does not enable it.

Purpose: to bring your browser back to the right WordPress site after you approve access at Cloudflare, because Cloudflare only allows pre-registered return addresses. Legal basis: your consent (the box you tick) and performing the service you asked for. Retention: none stored. The cookie expires in 10 minutes.

2. Problem reports (feedback.kinto.co)

Used only if you click Report a problem, read the preview, and tick the consent box. Nothing is sent before that.

What a report contains

  • The category you choose and your description (up to 1,000 characters). Emails, IP addresses, tokens, home-directory file paths and URL query strings are removed automatically on your site and again on our server; a web address you type keeps its domain. Please do not write personal data in the description anyway.
  • Plugin, WordPress and PHP versions; the active theme (name and version); page builders and a fixed list of cache, security, SEO and multilingual plugins, if present.
  • The page path (without query string), the deployment id and stage, and the error code if the last publish failed.
  • A random report id.

What the automatically collected fields do not contain: your site address, user names, the full plugin list, cookies, page content, tokens, or any identifier of your site or installation.

What we store about the sender: the report server uses the IP address of your WordPress server, which sends the report, only to rate-limit abuse. It is mixed with a secret salt and hashed, used for an hourly counter, and the raw IP is never written to the database or to logs. Counter rows are deleted after their hour has passed. For IPv6 the limit applies to the /64 network.

What we store in the database (Cloudflare D1):

  • reports: the cleaned report above.
  • signatures: a counter per kind of problem (builder, version range, category, stage, error code). No free text.
  • rate_limits: hourly counters keyed by a salted hash.

GitHub: The service has code that can create one internal GitHub issue per kind of problem. This is currently turned off (no repository is configured). If it is ever turned on, we will update this policy first; issue text would be held by GitHub and would not be covered by the 180-day deletion.

Purpose: to find and fix compatibility problems and to block abuse. Legal basis: your consent when you send the report; our legitimate interest in keeping the service safe (rate limiting). Retention: reports are deleted after 180 days. Problem counters are deleted when not seen for 180 days. A daily job does this.

3. Panel choice (feedback.kinto.co)

Used only if you pick a panel (or type a name) in Which panel should we automate next? in Settings, tick its consent box and press Send. Nothing is sent before that. It goes to the same report service as section 2.

What is sent: only the panel you pick or the name you type under “Other” (up to 60 characters, cleaned like a report description), a random report id, a consent flag, and a fixed placeholder for the theme (none). It is stored as a report with the category host_panel_request. It contains none of the versions, plugin list, page path or deployment fields of a problem report, and nothing that identifies your site, its address or its users.

What we store about the sender: the same as for problem reports (section 2): your server’s IP address is hashed with a secret salt only for an hourly rate limit, and the raw IP is never written to the database or to logs.

Purpose: to decide which hosting panel to support next. Legal basis: your consent when you press Send; our legitimate interest in keeping the service safe (rate limiting). Retention: deleted after 180 days, like any other report, by the same daily job.

4. Your Cloudflare account

When you publish, your WordPress server talks directly to Cloudflare (api.cloudflare.com, dash.cloudflare.com) using your credentials. It uploads your generated pages, images, styles and scripts to a Pages project in your account. Kinto does not see this traffic and does not get a copy. Cloudflare’s own terms and privacy policy apply:

5. Data kept on your own site

Your Cloudflare access key, or the access and renewal tokens from Connect with Cloudflare, are stored encrypted in your own WordPress database (libsodium secretbox, key derived from your site’s WordPress salts). They are used only from your server and are not sent to your browser or to Kinto. Pressing Disconnect revokes the connection with Cloudflare (for Connect with Cloudflare). Deleting the plugin from WordPress removes the stored credentials from your database, but it does not revoke them at Cloudflare. If you stop using the plugin, also delete the key in your Cloudflare dashboard.

6. Processors

Kinto uses Cloudflare, Inc. to run the relay Worker and the report Worker and its D1 database. Cloudflare processes data on our behalf under its own terms. Kinto does not use other processors for these services. Email sent to [email protected] is handled by Google (Google Workspace), which acts as our email processor for those messages.

7. Your rights

Depending on where you live (for example under the GDPR or CCPA), you may ask to access, correct or delete data about you, to withdraw consent, or to complain to a data protection authority.

Reports are anonymous by design: we cannot find a report by your name, email, IP or site. To delete a report, send us its report id (shown on screen after you send it) at [email protected]. We will delete it within 30 days. Without the report id we cannot identify yours; it will be deleted automatically after 180 days anyway.

You can withdraw consent at any time by not using Connect with Cloudflare or Report a problem. Past reports stay until deleted as above.

8. Children

The plugin is a tool for site owners and is not aimed at children. We do not knowingly collect data from children.

9. International transfers

Cloudflare runs a global network, so data may be processed outside your country. Kinto LLC is based in the United States.

10. Changes

If we change this policy we will update the date above and, for material changes, say so in the plugin’s readme or changelog. Older versions are available on request at [email protected].