Last updated: 17 October 2026
TrakWP is a hosted web app at trakwp.me for people who publish plugins and themes on WordPress.org. Public ranking pages work without an account. An account stores your name, email and the products you track. Paid plans are billed by Dodo Payments. TrakWP does not sell personal information and shows no ads.
The Terms of Service are the rules for using the site.
When you register with email, or sign in with Google, we store your name and email address. If you set a password, we store a hash of it, not the password. If you use Google, we also store your Google account identifier and avatar URL. Google sign-in uses the profile and email scopes only. We do not ask for Drive, contacts or calendar.
If you turn on two-factor authentication, we store the secret and recovery codes used to check the sign-in. If you add a passkey, we store the public key credential and the name you give it. The private key stays on your device.
We store the plugins and themes you track, the rivals you attach to them, and the keywords you add, so we can record positions and show them on your account.
Subscriptions are sold through Dodo Payments, the merchant of record. At checkout we send Dodo your name and email, or your existing Dodo customer id, plus an internal account id so the subscription can be matched to you. We store the plan, billing interval, status, period end, and Dodo's customer and subscription ids. We do not receive or store your card number.
Dodo's own privacy policy covers the payment, tax and invoice details they collect. Copies of their webhook events are stored so a missed or repeated notice can be handled. Those copies can include an email address.
A session cookie keeps you signed in, a security cookie protects forms, and an appearance cookie remembers light or dark mode. There are no advertising or analytics cookies.
Guest searches, and sign-in attempts, are rate-limited. The limiter uses your IP address, or your account id when you are signed in, and keeps that key for a short time (about an hour for searches). Server logs may include an IP address, the browser and the request, for security and debugging. Logs are not used for advertising.
Plugin and theme names, ranks, ratings, install bands and download counts come from WordPress.org's public APIs. That catalog is not information about you. Searches we send are ordinary public API requests, identified as TrakWP. We do not send your tracked library to WordPress.org as a profile of you.
We do not sell personal information and we do not share it with advertisers.
| Who | What | Why |
|---|---|---|
| Name, email, and the sign-in itself, only if you choose Google | Sign-in | |
| Dodo Payments | Name, email, the plan you buy, and the card details you enter on their checkout | Subscriptions, tax and receipts |
| WordPress.org | Public API searches, with a TrakWP user agent | Directory data and keyword checks |
You can delete your account in settings. That removes your user record and the products, keywords and rivals stored on it.
Dodo may keep billing records they are required to keep. Webhook copies on our side are not removed automatically when you delete your account.
Public directory snapshots stay. They are WordPress.org listings, not your personal data.
TrakWP is not directed at children under 13.
If this policy changes, the new version is published at this address with a new date.
Questions: hello@trakwp.com
← All privacy policies