Privacy policy

Service and scope

This policy covers the FluxCDN Security website, API and WordPress plugin. FluxCDN is operated by Jaryan Abri Sepehr. Public vulnerability reports can be read without an account. An account is needed for connected sites, API tokens and personal notifications.

Account and security information

We store your email address, profile information, notification preferences and authentication settings to provide your account. Sign-in and session records include the actual outcome, time, IP address and browser or device information. Login notifications can include these details. Login codes, authenticator codes, recovery codes and API secrets are not included in notifications.

You can review sign-in history and sessions, manage security settings and revoke API tokens in your account. Email and Telegram notification preferences can be managed separately.

WordPress connections

Connecting the plugin shares the site address, WordPress and FluxCDN Security plugin versions, and installed plugin names, identifiers, versions and activation status with this service. These details are used to identify affected versions and send relevant alerts. The plugin does not upload WordPress passwords, site content, the user list or plugin source files.

Connection and disconnection notices identify the site. Vulnerability alerts identify affected sites and plugins. Disconnecting a site stops new checks and alerts for that connection; it does not immediately erase its previous inventory or revoke an API token shared with another site. You can revoke the token separately.

Cookies and visit statistics

Session and security cookies support sign-in and protect account actions. Theme and language choices may be remembered in your browser. When visit statistics are enabled, catalog visits record the page or report, time, response status, general browser and device category, referring domain and a pseudonymous visitor identifier. A visitor cookie helps distinguish repeat visits. Live traffic also shows the IP address and browser and operating-system versions to the super administrator for the last five minutes. These details are encrypted, expire from the live view and are periodically deleted; they are not included in aggregate archives. The full referring URL and raw browser header are not retained. Requests with Do Not Track enabled are excluded from this visit measurement.

Email, Telegram and public reports

Email delivery passes the recipient address and message to the configured mail provider. If you link Telegram, your chat identifier is stored and selected notices pass through Telegram and the configured delivery service. Telegram and your email provider also apply their own policies. Do not link a channel you do not want to receive account or site information.

Published vulnerability reports, their sources and required attribution or license notices are public. Private account information and a connected site’s plugin inventory are not published as part of those reports.

Retention and deletion

Login history and session records have a configured retention period; visit details and aggregated statistics also have separate retention periods. The latest successful WordPress inventory remains available until it is replaced or removed. Older scans and delivery records are cleaned periodically. Stored backups may retain earlier copies until their configured retention expires.

The WordPress plugin keeps local connection settings and the latest results. Its sync logs are limited to 30 days and 1,000 entries. Deactivation preserves these data; the optional deletion setting removes local plugin data on uninstall. Local removal does not remove data held by FluxCDN Security.

To request access, correction or deletion of account and connected-site data, contact FluxCDN through the contact channels listed on its main website. Some security records may need to be retained to investigate abuse or meet legal obligations.