Privacy Policy: WP MCP

This website

wpmcp-pro.com is a marketing and documentation site. We do not ask you to create an account here, and we do not knowingly collect names, email addresses, or other personal details unless you choose to email us or fill out a form we may add in future. If and when we add analytics to this site, we will update this policy first and describe exactly what is collected, the cookies it sets, and how to opt out.

Right now, this site sets no tracking cookies and loads no third-party analytics scripts. It is a static site with self-hosted fonts and images.

The WP MCP plugin, on your WordPress site

WP MCP (the marketing name for the open-source plugin wpmcp) runs entirely inside your own WordPress installation. This section explains what that means for your data.

The core privacy fact

WP MCP does not operate a separate server that stores a copy of your site. Every snapshot, every setting, and every piece of content the plugin touches lives in your own WordPress database, on your own hosting, under your own control.

What the plugin stores, and where

Change snapshots. Before an AI-driven write, the plugin saves a compressed copy of the affected post, option, user, comment, or order in a table in your own WordPress database (wp_wpmcp_snapshots). This is what powers one-click undo. It never leaves your server.
Operation history. A log of which tool ran, on which object, in which session, and when, stored the same way, in your own database, viewable from the wpmcp screen in your wp-admin.
No telemetry by default. The plugin's optional Pro licensing integration (Freemius) ships with anonymous_mode enabled by default, which skips the usual telemetry opt-in prompt. We do not collect usage analytics from your site unless you explicitly opt in to something that says so.

What connects to what

The plugin exposes your site's content and store data to whichever AI client you connect, over the Model Context Protocol, authenticated with a WordPress application password that you generate and can revoke at any time. That connection is between your WordPress site and the AI client you chose (for example Claude or Cursor); we are not a party to it, and we do not see the traffic. What that AI provider does with the data you send it is governed by that provider's own privacy policy, not this one.

Your responsibilities

Because WP MCP is self-hosted, you are the data controller for your own WordPress site. Application passwords, who you connect them to, and what the AI is allowed to touch, are choices you make and control. We recommend generating a dedicated application password for AI access and revoking it if it is no longer needed.

Emails you send us

If you email info@fahdmurtaza.com, we keep that correspondence to answer you and, occasionally, to improve documentation based on real questions. We do not add you to a marketing list from a support email, and we do not sell or share your email with anyone.

Third parties

The plugin's Pro tier, when purchased, is billed through Freemius, our payment processor and merchant of record for that transaction; their own privacy policy governs checkout data. GitHub hosts our source code and issue tracker; using GitHub is subject to GitHub's own privacy policy.

Children

This website and the plugin are not directed at children, and we do not knowingly collect data from anyone under the age of 16.

Changes to this policy

We may update this policy as the site, the plugin, or the law changes. The "last updated" date above reflects the most recent revision. Material changes, such as adding analytics or telemetry, will be reflected here before they take effect.

Contact

Questions about this policy or your data? Email info@fahdmurtaza.com.

See also our terms of service, or read how the safety model actually works under the hood.