Admin
Privacy, data and retention
What ChargeWarden stores, how identifiers are hashed, how long data is kept, the WordPress privacy exporter and eraser, and which outside services are called.
Last updated by the PluginLoom team
ChargeWarden is built to count repeat behaviour without keeping who a shopper is.
What is stored?#
| Data | Where | Form | Kept for |
|---|---|---|---|
| Attempt and failure counters | wp_chargewarden_hits | Hash of identifier, event type, time | The longest rule window (purged hourly) |
| Checkout security events | wp_chargewarden_events | Masked IP (203.0.113.x), country, keyed hashes of IP, network, email, browser, card and session, rule, order ID | 30 days by default (Settings > Alerts and privacy) |
| Blocks and allowlist | wp_chargewarden_lists | Keyed hash plus a masked label; allowlisted IP ranges as typed | Until they expire or you remove them |
| Order risk results | wp_chargewarden_reviews and order meta | Score, reasons, review decision, hashes | With the order |
| ACH ledger | wp_chargewarden_ach_entries | Transfer ID, order, amount, status, return code, account mask, keyed hash of Plaid's account ID, validation method | Until you delete it |
| Script inventory | wp_chargewarden_scripts, wp_chargewarden_script_events | Script URLs, hashes, justifications | Until you delete it |
| Plugin log | wp_chargewarden_logs | Messages, no raw emails or card data | 30 days by default |
Full IP addresses are kept in memory during the request only. Account and routing numbers are never stored.
How are identifiers hashed?#
HMAC-SHA256 with a random 256-bit key created for your site when ChargeWarden is first activated (option chargewarden_hash_key). On multi-server sites, set the same key everywhere with the CHARGEWARDEN_HASH_KEY constant. Changing the key resets all counters and makes existing blocks unmatchable.
How do the WordPress privacy tools work?#
ChargeWarden registers with Tools > Export Personal Data and Tools > Erase Personal Data:
- Export finds events by hashing the person's email the same way checkout does, and risk scores through their orders.
- Erase deletes those events, allowlist entries and risk records, and removes ChargeWarden's meta from their orders. A block on their email is kept, because the store needs it to prevent fraud, and the eraser says so. Remove it by hand if that is appropriate.
Suggested text is added to Settings > Privacy > Policy guide.
Which outside services are called?#
| Service | When | What is sent |
|---|---|---|
| Cloudflare Turnstile or hCaptcha | Only if you set one up, when a challenge is shown | The token and the shopper IP |
| Tor Project, AWS, Google Cloud, DigitalOcean, Oracle Cloud | Only if you turn on the free IP lists, once a week | Nothing about shoppers: the lists are downloaded |
| Stripe API | Only if you turn on the Radar lookup | The charge ID, with your Stripe key |
| pluginloom.com | License activation and update checks | License key, site URL, versions |
What happens when I delete the plugin?#
Scheduled tasks are removed. Tables, options and capabilities are removed only if you turned on "Delete all ChargeWarden data when the plugin is deleted".
Was this page helpful?