Privacy policy

Effective November 1, 2026. FixGuru is a service of CurrencyWiki Technologies LLC. Questions: [email protected].

Our whole pitch is that you can trust us with access to your website. This page says exactly what we collect, where it goes, how long it stays, and how it is destroyed. It is written to be checked against what the product actually does.

What we collect, and why

Your account

Your name and email address, from Google or Apple when you sign in with them or from the code you receive by email. Used to sign you in, to send you the emails about your jobs, and to put your name on the report.

Your website

The address you enter and the results of the free site check: DNS answers, the response and certificate we receive, the hosting provider and network we identify, and the results of two checks we run against Google services, Safe Browsing and PageSpeed. Running those checks sends your site's address to Google. We keep check results for a year so a job can show before and after.

Your job

What you tell us about the problem, the messages between us, the access checklist and its log, the report, and the receipt. Kept with the financial record of the job.

Access credentials

• Passwords you put in the vault are encrypted the moment they arrive, under a key kept apart from the rest of the application. Each time a member of our team opens one, the time and the address it was opened from are recorded and shown on your job page. Vault items are destroyed 72 hours after the job closes, or earlier if you destroy them.
• Per-job SSH keys are generated by us for that job only. The private half is encrypted the same way and destroyed when our access is removed.
• API tokens and the WordPress plugin's connection secret are encrypted the same way and destroyed when the access item is revoked.
• We never ask for your private keys, your card number, or a password in a message, and messages that look like they contain one are refused.

The WordPress plugin

FixGuru Access sends us your site address, WordPress and plugin versions, the temporary administrator's name and expiry, and a connection secret when you connect, and a short notice when access ends. Backups it takes stay on your site. The full list is on the plugin page.

Texts and voicemail

If you text or call our support line, Twilio delivers the message to us. We keep the text, your number and any voicemail transcription with your job record so the team can follow up, and a text on a linked job appears on that job's timeline. The first reply to a new number is automated and says so. Your phone number and the content of your texts are never shared with third parties or affiliates for marketing or promotional purposes, and we never send marketing texts. Text STOP at any time to end messages. More on the text line page.

Payment

Card details go to Stripe and never touch our servers. We store Stripe's identifiers for the authorization and the charge, the amount, and what Stripe shows us about the card, such as the brand and last four digits.

Technical records

Our web server logs requests with IP addresses and browser details for up to 30 days, for security and troubleshooting. Your access authorization at checkout is stored with the time and IP address it was given from, because hosts and payment processors accept that record when access is questioned.

What we do not do

• We do not sell or rent your data, and we do not share it with anyone except the processors below, as needed to run the service.
• We do not send cold email or newsletters. You hear from us about your jobs and your account.
• We do not use advertising trackers or analytics cookies at this time. If that changes, the Cookie notice will say so and you will be asked first.
• We do not look at, copy or keep anything on your systems that the job does not need.
• We do not offer the service to anyone under 18.

Who processes data for us

• Stripe, for payments.
• Amazon Web Services, for sending email (SES, United States).
• Google, for Google sign-in and for the Safe Browsing and PageSpeed checks of your site address.
• Apple, for Sign in with Apple.
• Twilio, for the support text line and voicemail (United States).
• Cloudflare, for DNS, network protection and routing of our own mailboxes.
• Akamai (Linode), for the servers the service runs on, in the United States.

Each of them sees only what its job needs. We add to this list before using anyone new.

How long we keep things

• Vault items: 72 hours after the job closes, or sooner if you destroy them.
• Per-job SSH keys, tokens and plugin secrets: destroyed when the access item is revoked, at the latest when the job closes.
• Sign-in codes: 10 minutes.
• Server logs: up to 30 days.
• Site check results: one year.
• Jobs, reports, messages and receipts: seven years, because tax law requires the financial record. Closing your account removes your name and email from it and keeps the record.

Your rights

Email [email protected] to see what we hold about you, to correct it, or to close your account. We answer within 30 days. If you are in California, the CCPA gives you these rights by law, and we do not sell personal information, so there is nothing to opt out of. If you are in the United Kingdom or the European Union, you have similar rights and the same address works.

If something goes wrong

If we ever suspect that vault contents were exposed, we destroy every vault item, rotate the key, and tell affected customers within 72 hours exactly what to change. Any other breach of personal data is reported to the people affected as the law requires.

Changes

The date at the top is the version in force. If a change affects how your data is handled, we email you before it takes effect.