This is the customer-facing version of what ApprovalTrail stores and why. If you need the technical source, it lives in the plugin’s repository as docs/privacy.md.
What’s stored
| Data | Where | Retention |
|---|---|---|
| Customer name and email | Read from the order; the email is also copied onto decision entries | With the order / the record |
| Hashed IP address | The decision record | With the record |
| User agent (truncated) | The decision record | With the record |
| Uploaded proof files | Private uploads directory | Masters released after your retention window; preview and fingerprint kept |
| SHA-256 fingerprint of each file | Version row | Indefinitely |
| Approval-link token | Digest only | Until it expires |
Raw IP addresses are never stored. They’re hashed on arrival using a random value unique to your site, and the raw value is discarded immediately. The hash lets ApprovalTrail correlate activity (“the same visitor viewed the proof, then approved it”) — it cannot be reversed, and it cannot be matched against any other site.
No external services (free build)
The WordPress.org build of ApprovalTrail sends nothing anywhere. No telemetry, no analytics, no remote rendering, no third-party timestamping service. Proof files never leave your site’s own filesystem. This is asserted by an automated test in the plugin’s own codebase, which confirms zero outbound HTTP requests happen on the public approval page.
The licensed build talks to the license service and to nothing else, sending exactly: your site URL, WordPress version, PHP version, plugin version, and the plugin’s slug. See License, updates and support.
Export and erasure
ApprovalTrail registers with both of WordPress’s built-in privacy tools, appearing as “Proof approvals” under Tools → Export Personal Data and Tools → Erase Personal Data.
- Export returns, per proof: the title, order, outcome, and each record entry the person’s address appears on.
- Erase clears the email, hashed IP, and user agent from those entries, then writes a tombstone entry naming exactly which entries were erased. The fact that a decision was made — when, and against which file version — survives; only the personal identifiers are cleared.
The trade-off, stated plainly
An erasure request and a tamper-evident record pull in opposite directions, and we’re not going to soften that. Deleting the entries outright would destroy your own record of an approval you may be relying on in a dispute — which is the entire reason you’re using this plugin. Our resolution is to erase the person, not the event: the customer’s identifying data is cleared, but the fact that an approval or a change request happened is kept, and the record continues to verify afterward, reporting those entries as redacted rather than as tampering.
If you’re a shop owner deciding whether to install ApprovalTrail, know this before you need it, not after a request arrives: your evidence record and your privacy obligations are handled honestly here, but they are not the same thing, and one does not silently override the other.
What to tell your own customers
Your store’s privacy policy should say that when a customer opens a proof approval link, your site records the time, a hashed form of their IP address, their browser’s user agent, and the decision they made together with the exact wording they selected — and that this is kept as the record of the approval.