Data and external services
TurtleReport adds nothing to your public pages and collects nothing from visitors. Requests are made from your server; nothing is sent to the plugin author or any other party.
TurtleReport only contacts Google after an administrator adds a connection, and only to read data for the sites and sections they set up.
| Service | Used for | Sent |
|---|---|---|
| Google OAuth 2.0 | Signing in, refreshing and revoking access, exchanging service-account keys for tokens | Your OAuth client ID and secret or a signed service-account assertion, and authorisation codes or tokens |
| Search Console API | Listing properties and reading search performance | The property and date range |
| Analytics Data and Admin APIs | Listing GA4 properties and reading event, traffic and channel reports | The property, date range, metrics and filters |
| Business Profile APIs | Listing locations and reading daily performance (only if switched on) | The location and date range |
Google’s Terms of Service, Privacy Policy and API Services User Data Policy apply.
Slack
Only if an administrator saves a Slack webhook, and only when someone presses Send to Slack or Send a test message. Sent: the client’s name, the issue’s title, the affected address, its key numbers, what the data suggests, the recommended checks, the optional note, the name of the person sharing it and a link to the report.
AI providers
Only while the AI Advisor is switched on and someone asks a question, to the provider you picked: OpenAI, Anthropic Claude, Google Gemini or xAI Grok. See AI Advisor for exactly what is sent. Each provider’s own terms and privacy policy apply.
Scheduled emails are sent through your site’s own mail setup (wp_mail) to the addresses an administrator enters.
Stored on your site
Connections, credentials, sites, access grants, delivery history and cached report data are kept in your WordPress database. Credentials are stored encrypted. To keep the encryption key out of the database, define TURTLEREPORT_ENCRYPTION_KEY in wp-config.php before adding connections. By default the key is derived from your site’s security salts, so changing those means reconnecting.
Deleting the plugin
Deleting the plugin revokes Google sign-ins where possible and removes all connections, credentials, sites, access grants, cached data and the Report viewer role.