Privacy

What this plugin stores, what it transmits, and what to put in a privacy policy.

What leaves your server

By default: nothing.

The self-hosted challenge runs entirely on your own server. Nine of the ten checks reach their conclusion locally. No cookie is set, no fingerprint is taken, no third party is told that your visitor exists, and there is no account anywhere.

Three things can change that, and all three are choices someone has to make deliberately:

The blocklist ships disabled specifically because it is the one check that contradicts everything else here. If your privacy policy says visitor data stays on your site, leave it off — and the settings screen says so at the point of decision, not in a footnote.

What is stored, and where

Against each scored entry

A score breakdown in Gravity Forms entry meta:

• the total score and the threshold it was measured against
• which checks fired, their points, and a short explanation
• which checks abstained, and why
• a salted hash of the sender's IP address — never the address itself

Elsewhere

• Settings, in two WordPress options.
• A short-lived counter per address, for rate limiting. Keyed by the same salted hash, expires after five minutes, swept hourly.
• A used-challenge marker, so one challenge cannot be spent twice. Expires when the challenge would have.
• A plugin log of at most 50 rows: policy changes, refusals, and failed checks. Secret-shaped values are redacted at any nesting depth before anything is written.

Raw IP addresses are never written to the database. The address is used in-request — to look up a rate-limit counter, and, if you enabled the blocklist, to ask about the sender — and then it is gone.

About the IP hash

The hash is keyed with material unique to your site, so hashes cannot be compared between sites and a stolen database cannot be matched against the address space with a plain SHA-256.

It is still personal data, and this plugin treats it as such. It is a pseudonym, and it is reversible by anyone holding the site's key material and a candidate address — which is a small enough space to exhaust. Calling it anonymised would be a convenient reading rather than an honest one.

That is why the breakdown is registered with WordPress's privacy tooling rather than quietly left out of it.

Data subject requests

Both WordPress privacy tools are wired up. Under Tools:

• Export Personal Data includes the Form Guard analysis for that person.
• Erase Personal Data removes it.

The eraser removes only this plugin's data. The entry itself belongs to Gravity Forms, whose own eraser handles it — deleting it here would erase data on another plugin's behalf and could destroy something the site still needs.

Retention

Filed spam is deleted after 30 days by default, configurable from 7 days to 10 years. Only entries this plugin filed are ever removed.

Suggested privacy policy wording

For a default installation, with the external blocklist off:

Our contact forms are protected by an automated spam filter that runs on this website's own server. It examines the content and timing of each submission and stores a one-way encrypted form of the sender's IP address alongside the submission. No information about you is sent to any third party for this purpose, and no tracking cookie is set. Submissions identified as spam are deleted after 30 days.

If you have enabled the external blocklist, add:

To identify known sources of abuse, the IP address and email address given in a form submission are checked against StopForumSpam, an external blocklist service.

If you have selected Cloudflare Turnstile or hCaptcha, add the wording that provider gives you; their script runs in your visitor's browser and their own privacy terms apply.

Encryption keys

Provider secret keys are encrypted at rest with AES-256-GCM. The key is derived per purpose, so the key that signs challenges cannot decrypt a stored secret.

Key material is resolved in this order:

1. AJC_FORM_GUARD_KEY in wp-config.php — recommended, and the only option that survives salt rotation.
2. Your WordPress salts.
3. A random key generated on activation and stored in the database.

The tier currently in force is shown under Forms → Form Guard → Status.