Legal

Privacy Policy

What slugsync.com collects, who else sees it, and how to make it stop. Written for this site specifically rather than pasted from a generator, so it should match what actually happens.

Last updated 20 August 2026

The short version

There are no accounts on this site and nothing to log into. The only data you can hand us directly is an email address, and only if you type one into the waiting list or the contact form.

Beyond that, Google sees your visit twice over: once for advertising, and once for Google Analytics, which we use to see which pages people actually read. Both set cookies, and in the EEA, the UK and Switzerland both wait for your consent before they do.

Who is responsible

slugsync.com is operated by Armin Kapetanovic, an individual developer based in Bosnia and Herzegovina, as the publisher of the Slug Sync WordPress plugin. For the purposes of the GDPR, that is the data controller for this website.

The quickest way to reach us about anything on this page is the contact form.

What we collect

Grouped by how it reaches us, because that is what determines what you can do about it.

Things you type in

Waiting list Your email address, and nothing else. Submitted only when you use the Pro waiting list form on the homepage. Used for exactly one message — that Pro has shipped — and then not again.
Contact form Your name, your email address and whatever you write in the message. Used to answer you.

Both forms post to slugsync.com itself, where a small piece of code turns the submission into an email and hands it to Resend for delivery. Resend is our mail provider and sees the message in order to deliver it; their privacy policy governs that leg of the journey.

What is kept afterwards differs by form, and the difference matters:

  • The contact form is not stored. Your message becomes an email in an inbox and nowhere else. Nothing about it is written to a database.
  • The waiting list is stored — your email address and the date you joined, in a database on Cloudflare, and nothing else. No name, no IP address, no record of which pages you read. It is kept for one reason: so that the single email announcing Pro can actually be sent to the people who asked for it. An inbox is not a mailing list, and an address lost to a spam folder is a promise quietly broken. Ask us to remove it and it is deleted; the whole record is one row.

You also get an acknowledgement at the address you gave, confirming the message arrived. It deliberately does not repeat what you wrote — anyone can type your address into a form, and a reply that quoted the message back would be a way to send you someone else's words in our name. It is one automatic email, sent once, and it is not the start of a mailing list.

Both forms are protected by Cloudflare Turnstile, a spam check that runs in place of a CAPTCHA. It sees your IP address and some browser characteristics in order to decide whether you are a person. Cloudflare states that it does not use this to track you across sites. A hidden field that a person never sees does a second pass at the same job, and collects nothing at all.

Things your browser hands over automatically

Like every website, ours sits behind a web server that keeps standard access logs: IP address, the time of the request, which page was requested, the referring page, and your browser's user agent string. These are used to keep the site running and to investigate abuse. They are not combined with anything else and are not used to build a profile of you.

Analytics

We use Google Analytics 4 to understand which pages get read, which get ignored, and roughly where visitors come from. It is the only analytics product on this site — there is no session recorder, no heatmap and no scroll tracking.

What it collects is the standard GA4 set: the pages you view and when, how long the visit lasted, the referring site or search engine, your approximate location derived from your IP address, and your device, browser and language. It stores a randomly generated identifier in a cookie so that two page views in the same visit are counted as one visit rather than two people.

On top of that we record a short list of things you do on the page, because page views alone do not say whether the site works: that a download button was pressed and which of the three it was, and that the Pro waiting-list form was started, completed, or failed. Failures are recorded for the same reason as successes — a form that quietly stops working is otherwise invisible to us.

None of those carry what you typed. Your email address is never sent to Analytics, from either form, in any event. What Google receives is that a submission happened and whether it succeeded — not who made it.

Some specifics that are ours to decide, and that we have decided:

  • GA4 discards the full IP address rather than storing it, and that behaviour cannot be switched off. Location is derived before the address is dropped, and is coarse — city at best.
  • Google signals is switched off. That is the setting that would let Analytics join your visit here to your Google account and feed it into ad targeting. We have no remarketing audiences and no use for it. It is declined in the request itself — every page configures Analytics with allow_google_signals: false, so the refusal travels with each measurement rather than depending on a dashboard setting staying as we left it.
  • Ad personalisation signals from Analytics are switched off the same way and for the same reason, with allow_ad_personalization_signals: false. Advertising on this site is handled by AdSense alone, described below.
  • We do not upload any data of our own into Analytics, so nothing you typed into a form is ever joined to your analytics record.

Google acts as our processor for this, under its data processing terms. Its description of how Analytics uses data is at policies.google.com/technologies/partner-sites.

Turning it off

  • In the EEA, the UK and Switzerland, Analytics does not run at all until you consent — see consent below. Decline, and no analytics cookie is set.
  • Anywhere in the world, Google's opt-out browser add-on blocks Analytics on every site you visit, this one included.
  • Blocking third-party scripts or cookies in your browser also stops it, and breaks nothing here.

Advertising and Google AdSense

This site is monetised in part by Google AdSense. Advertising is what pays for the free plugin being free, and we would rather say so plainly than bury it.

Some practical detail:

  • Google, as a third-party vendor, uses cookies to serve ads on this site.
  • Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
  • You can opt out of personalised advertising by visiting Google Ads Settings. Ads do not disappear; they stop being tailored to you.
  • You can opt out of a large number of other vendors at once at aboutads.info/choices or youronlinechoices.com.
  • Google's own explanation of what its advertising cookies do is at policies.google.com/technologies/ads.

The DoubleClick DART cookie

Google uses the DART cookie to serve ads based on your visits to this and other sites. You may decline it at the Google ad and content network privacy policy.

Where the law requires it, a consent message appears before any advertising or analytics cookie is set, served through Google's Privacy & messaging. Until you answer it, both Analytics and personalised advertising are held off — the page ships with its consent state defaulted to denied for these countries, so nothing fires while the message is waiting.

Your choice is stored in your browser so you are not asked on every page. You can change it at any time by clearing this site's cookies, which brings the message back on your next visit.

If you refuse, the site keeps working in full. Analytics does not run at all, and you see non-personalised ads instead — chosen from the page's content rather than from anything about you.

Other advertisers

Third-party ad servers and ad networks use technologies such as cookies, JavaScript and web beacons in the advertisements that appear on slugsync.com, and these are sent directly to your browser. They automatically receive your IP address when this happens. We have no access to and no control over those cookies, and this policy does not cover them — consult the privacy policy of the advertiser in question.

Cookies

The site has no login, no session and no preference that needs remembering, so nothing we wrote sets a cookie. Every cookie here is placed by Google's scripts — though the Analytics one is stored under slugsync.com rather than a third-party domain, which is why your browser may report it as first-party.

Analytics A randomly generated identifier (_ga and a per-property companion) so that several page views in one visit are counted as one visit. Set only after consent where consent is required. Expires after two years, or sooner if you clear it.
Advertising Set by Google to select ads, cap how often you see the same one, and measure whether an ad worked. Personalised only where you have consented or where consent is not required.
Spam check Set by Cloudflare Turnstile, and only on a page with a form, to tell a person apart from a bot.
Consent state Remembers the answer you gave the consent message, so it does not reappear on every page.

Every browser lets you block or delete cookies; the instructions live in your browser's own settings. Blocking them will not break anything on this site — no feature here depends on a cookie.

Other third parties

Google Analytics Receives the page views described in Analytics above, as our processor. Held off entirely until consent in the EEA, the UK and Switzerland.
Google Fonts The Roboto typeface is loaded from Google's servers, which means Google receives your IP address when a page loads. Self-hosting the font would remove this and is on the to-do list.
GitHub The download buttons point at GitHub Releases, so the actual file transfer happens on GitHub's infrastructure under their privacy statement. Downloading the plugin does not require a GitHub account.
Resend Delivers the email that a form submission becomes, as our processor, including the copy that goes back to you. Nothing is sent to them unless you submit a form.
Cloudflare Serves this site and runs the Turnstile spam check described above, as our processor.
The web host Keeps the access logs described above, as a technical necessity of serving the site.

We do not sell personal information, and we do not share it with anyone beyond the processors named on this page.

The plugin itself

Worth stating separately, because it is the question we get asked: the Slug Sync plugin is not this website, and it collects nothing.

  • It makes no outbound network requests. It does not phone home, check in, or report usage.
  • It has no licence server. The Pro key is an Ed25519 signature verified on your own server, offline, so no purchase or activation data ever leaves your site.
  • Everything it writes — the change log, the redirect map, the undo history — stays in your own WordPress database.

This policy therefore applies to slugsync.com only. Installing the plugin creates no data relationship with us at all.

Legal bases

Under the GDPR we rely on:

  • Consent — for analytics and for personalised advertising cookies where consent is required, and for the waiting list, which you join by choosing to.
  • Legitimate interests — for server logs and spam protection, in keeping the site available and free of abuse; and for replying to a message you sent us.

How long we keep things

Waiting list emails Until Pro ships and the single announcement has gone out, or until you ask to be removed — whichever comes first. The list is deleted after that mailing.
Contact messages As long as the conversation is useful, and no more than 24 months.
Analytics records Google Analytics is set to the shortest retention it offers for event data: 2 months. Aggregate reporting outlives that, but it is counts and cannot be traced back to a visit.
Server logs Kept on a short rolling window by the host and overwritten automatically.

Your rights (GDPR)

If you are in the EEA or the UK you are entitled to the following, and we will honour a request from anyone, anywhere, rather than checking where you live first:

  • Access — a copy of the personal data we hold about you.
  • Rectification — correction of anything inaccurate, and completion of anything incomplete.
  • Erasure — deletion of your data, subject to the usual legal exceptions.
  • Restriction — a pause on processing while something is disputed.
  • Objection — to processing carried out on the basis of legitimate interests.
  • Portability — your data in a machine-readable form, or sent directly to someone else.
  • Withdrawal of consent — at any time, without affecting anything done before you withdrew it.
  • Complaint — to your national supervisory authority, if we have not resolved things to your satisfaction.

Use the contact form and we will respond within one month. Given the amount of data involved, in practice it will be much sooner.

Your rights (California)

Under the CCPA as amended by the CPRA, California residents may request that a business disclose the categories and specific pieces of personal information it has collected, request deletion of that information, and request that it not be sold or shared.

We do not sell personal information and never have. Advertising cookies set by Google may constitute “sharing” for cross-context behavioural advertising under that law; the opt-outs in the advertising section are the mechanism for stopping it. To exercise any other right, use the contact form. We will not discriminate against you for asking.

Children

This is a site about a WordPress developer tool and it is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has sent us something, tell us and it will be deleted.

Changes

If this policy changes, the date at the top of the page changes with it. Material changes — a new category of data, a new recipient — will be described here rather than slipped in silently. Continuing to use the site after a change means you accept the updated policy.

Contact

Questions about this policy, or a request to exercise any right in it, go through the contact form. See also the Terms and Conditions.