WordPress.org (Forums)
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- Staff may review your content; the policy does not describe an opt-out.
They collect account, IP, and usage data, share some with AI vendors, and keep project logs even after you ask to delete.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Browser and IP data, cookies, plus username and email if you use forums or events.
Read the exact line
Privacy policy
“WordPress.org also collects potentially personally-identifying information like Internet Protocol (IP) addresses.”
Training
They use it to run the sites, send some email, and sometimes run AI tools on submissions.
Read the exact line
Privacy policy
“Some WordPress.org services and workflows use AI tools to assist our team in reviewing submissions, moderating content, or supporting community programs or events.”
Sharing
Staff, contractors, affiliates, and third-party AI or search providers may see relevant data.
Read the exact line
Privacy policy
“This processing may involve sharing relevant data with third-party AI service providers.”
Kept
They keep it as long as the project needs; some names stay forever and logs are not deleted.
Read the exact line
Privacy policy
“WordPress.org will not delete personal data from logs or records necessary to the operation, development, or archives of the WordPress open source project.”
Controls
You can export or through linked forms, and unsubscribe from marketing email.
Read the exact line
Privacy policy
“If you would like to of your account and associated data, please follow these steps:”
Fine print
The policy is undated; they say using the site after a change means you accept it.
Read the exact line
Privacy policy
“Your continued use of this site after any change in this Privacy Policy will constitute your acceptance of such change.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Request account and data deletion
https://wordpress.org/about/privacy/data--request/
Request a copy of your data
https://wordpress.org/about/privacy/data-export-request/
Edit your WordPress.org profile
https://login.wordpress.org/ then profiles.wordpress.org and click Edit
Unsubscribe from marketing email
Unsubscribe link at the bottom of the email
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Even if you ask to be deleted, some records about you can stay in project logs forever.
Read the exact line
Privacy policy
“WordPress.org will not delete personal data from logs or records necessary to the operation, development, or archives of the WordPress open source project.”
For example, old forum posts or server logs tied to you may remain after you request account deletion.
If you go to a WordCamp, they keep your name and email with no end date.
Read the exact line
Privacy policy
“Attendee names and email addresses will be retained indefinitely, to preserve our ability to respond to code of conduct reports.”
For example, a ticket you bought years ago can still leave your email in their files.
Content you submit for review can be sent to outside AI companies.
Read the exact line
Privacy policy
“This processing may involve sharing relevant data with third-party AI service providers.”
For example, a plugin or program application you send could be processed by a vendor’s AI.
They can change the rules and treat you as agreeing if you keep visiting.
Read the exact line
Privacy policy
“Your continued use of this site after any change in this Privacy Policy will constitute your acceptance of such change.”
For example, they could add new sharing and you would not get a special warning.
A support or feedback message you send might be posted publicly.
Read the exact line
Privacy policy
“If you send us a request (for example via a support email or via one of our feedback mechanisms), we reserve the right to publish it”
For example, an email about a bug could show up on a public page.
People still look at AI-reviewed submissions and make the last call.
Read the exact line
Privacy policy
“Where AI processing occurs, it is human-supervised and all final decisions are made by a human reviewer.”
For example, a human moderator, not only a bot, decides if your post is allowed.
They say they will not rent or sell your personal information.
Read the exact line
Privacy policy
“WordPress.org will not rent or sell potentially personally-identifying and personally-identifying information to anyone.”
For example, they say they will not sell your email list to marketers.
There is a web form to ask them to delete your account and related data.
Read the exact line
Privacy policy
“If you would like to of your account and associated data, please follow these steps:”
For example, you can enter your email on that page to .
You can stop marketing emails with the unsubscribe link.
Read the exact line
Privacy policy
“If you no longer wish to be contacted for marketing purposes, please click on the unsubscribe link at the bottom of the email.”
For example, click unsubscribe at the bottom of a WordPress.org newsletter.
Words to know
Legal words from the lines above, in plain English.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- right to erasure
- Your right to have a company delete the personal data it holds about you, with some exceptions. For example, you can ask a social app to wipe your old posts and profile and it must, unless a law says otherwise.
- human review
- Company staff or contractors may read your messages or content, usually to check for rule breaking. For example, a flagged private chat with an AI can be read by a person at the company.
How we got here · grade C · score 44/100 · 14 of 15 policy answers backed by a verified quote · 7 not stated
What does the app collect beyond what it needs to work?
They collect browser details, cookies, IP addresses, and account info such as username and email when you interact.
Does it record your voice, face or body, and what happens to that?
The documents do not describe collecting voice, face, or body data.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Humans supervise AI review of submissions and make final decisions; no opt-out of that review is described.
Are you profiled or tracked for advertising?
They describe cookies for site stats and optional marketing email, not third-party ad tracking.
Do they sell or share your data, and can you opt out?
They say they will not rent or sell personal information, but they share it with staff, contractors, affiliates, and AI vendors.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You can request deletion by form, but logs stay, WordCamp names and emails can be kept forever, and some data is kept for years.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they take reasonable measures to protect personal information, without naming audits.
Is there a real age gate, and are teens protected?
Not stated in the documents.
Will they tell you when the rules change, and is the policy specific?
The policy is undated and says continued use after a change counts as acceptance.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 1,944 words at a college graduate level (Flesch reading ease 34.9); the terms are 286 words at a college level.
