What is collected — and what is not

Summary

Link Pulse Free collects nothing from your WordPress site. This website uses cookieless Cloudflare Analytics, stores email addresses you deliberately submit (with a salted IP hash for abuse prevention), and sets one short-lived functional cookie only when you download the plugin. No advertising, no trackers, no third-party scripts in your browser beyond Cloudflare Analytics.

The data controller

The data controller is AP Media Group LLP. For privacy and data requests, write to [email protected]. GDPR applies. Related legal terms for the site and plugin are set out on the terms page.

What the plugin collects

Link Pulse Free collects nothing. It has no telemetry, no analytics, no phone-home, no licence check for Free, and no account. Indexing and ranking run on your own server against your own database. No content is transmitted anywhere.

What it stores locally: index tables and settings in your own WordPress database, under your control. Retention and deletion options are documented in uninstall and data.

What this website collects

• Cloudflare Web Analytics — aggregate page views, referrers, and country. Cookieless. No cross-site identifier, no personal data. No consent banner is required because there is nothing to consent to.
• Cloudflare edge logs — standard request logs, retained per Cloudflare's policy, as for any site behind Cloudflare.
• No Google Analytics. No Google Fonts. No advertising pixels. No session recording. No chat widget. No third-party embeds of any kind.

Cookies

The site sets exactly one cookie, disclosed in full below.

Cookie	When	Contents	Lifetime
lp_dl	Only when you submit the download form	An opaque token authorising your download. No identifier, no email address, nothing readable by scripts	15 minutes

It is set only in direct response to a form you deliberately submitted, so the download link can be issued without putting a token in a URL. It cannot be read by scripts and expires in fifteen minutes. It performs no tracking and is not set on any other page. Under ePrivacy, a cookie strictly necessary to deliver a service you explicitly requested is exempt from consent — no banner is shown.

What happens with your email address

When you submit a form on this site, a record is stored in Cloudflare D1. The fields match the live schema exactly:

• email — the address you submitted
• list — which list: download or pro-waitlist
• source_page — which page you submitted from
• created_at — when you first submitted (ISO 8601 UTC)
• last_seen — when you last submitted (ISO 8601 UTC)
• ip_hash — a salted SHA-256 hash of your IP address, for abuse prevention, deleted after 30 days
• consent_text — the exact wording shown when you submitted. Current download wording: "Release notes and one message when Pro is ready, and no other correspondence. You may unsubscribe at any time. See the privacy policy." Current waitlist wording: "One message when Pro is ready, and no other correspondence. You may unsubscribe at any time. See the privacy policy."
• synced — whether the address has been copied to Emailit
• sync_error — last Emailit sync error, if any
• unsubscribed_at — when you unsubscribed, if applicable

Lawful basis: consent (GDPR Art. 6(1)(a)). Submitting the form is the consent; the form states what is being consented to; the wording shown is stored alongside the record so the consent is demonstrable rather than merely asserted.

Use: release notes and a message when Pro is ready. No other correspondence. Not sold, not shared with advertisers, not used for advertising, not enriched against third-party data.

Withdraw: the unsubscribe link in any email, or write to [email protected]. Withdrawal is honoured in both Emailit and the local database.

Who else processes your data

Sub-processor	What they process	Why
Cloudflare, Inc.	Site hosting, edge request logs, aggregate analytics, the subscriber database, the plugin download	Hosting and infrastructure
Emailit	Your email address and subscription status	Sending release notes and the Pro announcement

There are no others: no advertising networks, no data brokers, no analytics vendors, no CRM, no session recording.

International transfers. AP Media Group LLP operates from the United States and both sub-processors process data outside the EEA. Where personal data of EEA or UK residents is transferred, it is done under the relevant Standard Contractual Clauses and each provider's data processing terms. See Cloudflare's DPA and Emailit's data processing terms.

Your rights under GDPR

You may exercise access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and you may complain to a supervisory authority in your country of residence. Route for all of the above: [email protected]. Response commitment: 30 days.

With only an email address and a hashed IP held, an access request is a one-row query and an erasure request is a one-row delete.

How long data is kept

Data	Retained
Email address and list membership	Until you unsubscribe or request deletion
Salted IP hash	30 days, then purged automatically
Consent wording (consent_text)	For as long as the subscriber record exists
Cloudflare edge logs	Per Cloudflare's retention policy
Analytics	Aggregate only; no individual record exists to retain
Database backups	90 days, then deleted automatically. Erasure is immediate on the live database; backup copies age out within 90 days. Salted IP hashes are excluded from backups.
Download cookie (lp_dl)	15 minutes

Pro and AI providers

Pro will introduce optional AI reranking through a provider key you supply. It is enabled deliberately, and once enabled, your content is transmitted to the provider you have selected. The trade-off is explicit, and the decision remains yours. Link Pulse does not proxy, store, or resell those requests. Pricing for Pro, when it ships, is on the pricing page.

Changes to this policy

If the stored record gains a field, this page changes in the same commit. Material changes will be dated here. Last updated: 2026-07-20.