This policy describes what stateless.ci collects and why. The site is operated by UDX (Usability Dynamics, Inc.), Durham, North Carolina.

What we collect

Contact form. When you send a message through the contact form we receive the details you type (name, email, company, message) and the page you sent it from. The form is delivered through our form gateway and stored in our inbox so we can reply. We do not sell or share this information.

Server logs. Our edge network and servers keep standard request logs (IP address, user agent, requested URL, timestamp) for security and troubleshooting. Logs are rotated and are not used to build profiles.

Cookies. The public site sets no tracking cookies. Stateless Connect uses a short-lived secure cookie to bind the browser to its sign-in transaction. Signed-in administrators receive the standard WordPress session cookies. If we add analytics in future this policy will say so first.

Google sign-in and Stateless Connect

WP-Stateless is a WordPress plugin that connects your Media Library to Google Cloud Storage in your own Google account. Stateless Connect on stateless.ci handles Google authorization for the plugin. You choose the WordPress site that receives access and approve the permissions in Google's consent screen.

Data accessed and purpose. OpenID and your Google email address identify the connected account. The Google Cloud permission lets the plugin list projects and billing accounts, create a project if you request one, link your selected billing account, enable the required APIs, create or select a storage bucket, and create a service account and key with access to that bucket. It also supports reconnecting and replacing credentials. The plugin uses the service account for subsequent media transfers. The permission is broad because setup uses Resource Manager, Cloud Billing, Service Usage, IAM and Cloud Storage APIs.

What the broker processes. During sign-in, stateless.ci processes your website's return address, authorization transaction and Google authorization code. After you confirm the receiving website, it exchanges the code with Google and temporarily holds the resulting access and refresh tokens encrypted for one-time delivery to that site. Approved pairing transactions expire after ten minutes. Unfinished sign-in transactions expire after twenty minutes. Expired records may remain in the underlying cache or database until its cleanup runs, but cannot be redeemed.

What remains after sign-in. The broker retains the connected website's origin, creation and last-use timestamps, and hashes of connection credentials and the refresh token to authenticate later refresh requests. The WordPress site stores its Google access and refresh tokens encrypted using that site's configuration secrets. For a refresh, the site sends its refresh token through the broker to Google; the broker returns the new access token. The broker does not keep a reusable copy of the refresh token after the pairing transaction is redeemed.

Sharing and use. Google authorization data is exchanged with Google and delivered to the WordPress site you confirm. That site's hosting provider and administrators control its stored configuration, service-account key and media. Your media files remain in the Google Cloud bucket you select; they do not pass through the stateless.ci sign-in broker. Setup is intended for public website media, and the wizard checks public access. Do not use a public media bucket for confidential files.

We do not sell Google user data, use it for advertising, or use it to train AI models. Stateless Connect's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Infrastructure providers process service data to operate the service; disclosures may also be necessary to comply with applicable law.

Disconnect and deletion. Use Disconnect in Stateless Connect to revoke the Google sign-in authorization and remove the broker connection record. You can also revoke access in Google Account connections. Disconnect does not delete your cloud project, bucket, media or service-account keys: these remain in your account so existing media can continue working. Remove those resources or keys in Google Cloud when you no longer need them. To request deletion of broker records or ask about Google data handling, email andy.potanin@usabilitydynamics.com with your site's address. Do not send private keys or tokens.

How we protect Google user data

We use encryption, access controls and short-lived authorization transactions to protect Google account information and credentials from unauthorized access, disclosure or alteration.

Encryption in transit and storage. Connections to stateless.ci and Google authorization and API endpoints use HTTPS/TLS. Public WordPress return addresses must use HTTPS; local development may return to a loopback address on the user's own computer. Google access and refresh tokens temporarily stored by the stateless.ci broker are protected with authenticated encryption using libsodium. The broker's OAuth client secret is supplied from Google Cloud Secret Manager through its server environment, rather than included in the public plugin. On the connected WordPress site, the current Stateless Connect implementation encrypts stored Google access and refresh tokens and broker connection credentials using libsodium or AES-256-GCM, with a key derived from that site's configuration secrets.

Access controls. Stateless Connect setup and credential management require an authenticated WordPress administrator with the applicable site or network management permission. The broker checks a connection credential and the refresh-token hash before forwarding a token refresh to Google. It retains hashes for those checks rather than reusable copies of those credentials after delivery. The service account created by the wizard receives access to the selected storage bucket rather than project-wide storage access.

Protection during sign-in. OAuth state and PKCE bind Google's authorization response to the sign-in transaction. A secure, HTTP-only browser cookie binds confirmation to the browser completing Google sign-in. Delivery to WordPress requires a secret verifier held by the initiating site; a pairing code alone is not sufficient to retrieve tokens. Pairing codes are single-use, time-limited and subject to request rate limits.

Your website and cloud account. Your hosting provider and authorized administrators control the WordPress installation, its configuration secrets and service-account key. The OAuth token encryption described above does not mean that every WordPress setting or service-account key is encrypted by the plugin. Protect your site's administrator accounts, configuration and backups, and manage access to your Google Cloud account. Public website media is intentionally readable from the selected bucket; these protections do not make public media private.

Third parties

Media files are served from Google Cloud Storage and the site is delivered through Amazon CloudFront. Fonts are loaded from Google Fonts and icons from Font Awesome. Each of these providers may see your IP address when your browser requests a file.

Your choices

You can ask us to delete anything you sent through the contact form by writing to the same address. For connected-site records and Google authorization, use the disconnect and deletion options above.

Changes

We will update this page when our practices change. Last updated: November 5, 2026.