Skip to content
Permo Docs

Privacy and data

Permo runs inside your WordPress site and keeps what it measures in your own database. It talks to two outside services: Google PageSpeed Insights, only after you add your own API key, and the plugin directory at WordPress.org, for the status of your plugins. It collects nothing about your visitors and adds nothing to the pages they see.

What Permo sends, and to whom

Section titled “What Permo sends, and to whom”

Google, only with your API key

Section titled “Google, only with your API key”

Without a key, Permo sends nothing to Google. With a key, each PageSpeed test sends:

  • the address of the page being tested,
  • the device (mobile or desktop) and the parts of the report it asks for,
  • your site’s language,
  • your API key, in a request header rather than in the address.

Google then loads that public page, the way any visitor would. When you test the key, Permo sends only the key, without a page address, and Google doesn’t load your site.

Google’s terms and privacy policy apply to these requests (links under Sources).

WordPress.org, for the plugin list

Section titled “WordPress.org, for the plugin list”

System info lists your plugins and shows how WordPress.org sees each one: the date of its last release, the WordPress version it was tested up to, how many sites run it, and whether it was closed. To get this, Permo asks the plugin directory at WordPress.org. Each request sends the slugs of your active plugins (the short name in a plugin’s address), several in one request. It doesn’t send your site’s address, plugin versions or any personal data.

As with any request from your server, WordPress.org sees the server’s IP address. Plugins that point to their own update server aren’t sent. The requests run in the background about once a week, shortly after plugins are installed, updated or activated, and when you click Load now or Refresh under Plugins. Whether an update is available comes from WordPress’s own update check; Permo sends no request for it.

The WordPress.org privacy policy applies to these requests (link under Sources).

Your own site

Section titled “Your own site”

To time how fast your server answers, Permo requests your pages from your own server. These requests carry no cookies and no login, add a random parameter (permo_nc) so they pass the page cache, and identify themselves as Permo/ plus the version number and (page measurement). They show up in your server’s access log like any other request.

To continue a longer check, Permo also sends a short request from your site to itself. It carries a signed token that is valid for at most two minutes and is never stored.

No one else

Section titled “No one else”

Permo doesn’t send usage statistics, doesn’t track anything, and makes no requests to permolab.com. The links to this documentation open only when you click them.

What Permo stores

Section titled “What Permo stores”

Everything stays in your WordPress database:

What How long
Server values, page timings, PageSpeed scores, metrics and findings One or three months, set in Settings → Data under Keep checks for
Screenshots and test details (requests, waterfall) Only for the latest test of each page and device
A log of changes to the site (plugins, themes, WordPress itself, Permo’s settings): what changed, never who changed it Not affected by Keep checks for
Daily counts, such as the number of posts or the size of the database Not affected by Keep checks for
Settings, including your API key Until you change or delete them. The key is never sent back to your browser.
Two preferences per user: whether the setup hint was closed, and whether descriptions are shown With the user

Permo doesn’t store anything about your visitors: no IP addresses, no cookies, no user names in its log.

Who can see it

Section titled “Who can see it”

Only users who can manage the site’s options, usually administrators, see Permo and its data.

Deleting data

Section titled “Deleting data”
  • Old checks are deleted every day once they’re older than the period you set.
  • One page: deleting it on the URLs tab removes all of its checks.
  • The API key: Delete in the API key card removes it; PageSpeed tests stop at once.
  • Everything: deleting the plugin removes all of Permo’s data, unless Keep data when Permo is deleted is on. See Installing, updating and removing Permo.
Section titled “Related”

Sources