wpShadow

Privacy

Last updated 25 October 2026

wpShadow is run by Christopher Ross from Fort Erie, Ontario. This page covers two things: this website, and the wpShadow WordPress plugin. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Who is responsible

Christopher Ross, operating as wpShadow is responsible for the information described here. Write to hello@wpshadow.com or by mail at 210 Gilmore Road, Fort Erie, Ontario L2A 2M3, Canada.

The plugin

The plugin sends nothing when it is installed or activated, and nothing in the background. It talks to one service,Shadow Steward (shadowsteward.com), which runs the checks and is operated by the same person. Only an administrator pressing a button starts a request.

  • The first time you press Run. Your site's home address, the plugin version and your WordPress version are sent once to connect the site. Shadow Steward then asks your site for a one-time code, at /?rest_route=/wpshadow/v1/verify, to confirm you control the address. The free checks run only on your own site.
  • Each free check. The address of the page you chose, on your own site. Shadow Steward reads that public page the way a visitor's browser would. The page and the result are not stored by Shadow Steward. The result is kept in your WordPress dashboard.
  • WordPress site health. This check runs entirely inside your site, in the plugin, reading your settings and database. Nothing is sent to Shadow Steward or anyone else. It makes one request from your site to its own address, to see whether usernames are visible, and looks up the public email records (SPF and DMARC) of your own domain. If you press "Also look up plugin ages on WordPress.org" and confirm, it sends WordPress.org the folder name of each active plugin, the same thing WordPress does when it checks for updates.
  • Paid checks, only if you add them. Your Shadow Steward key, and for the SEO report your home address, or for the image check the public address of the image you chose, its file name and your site name. The image is described by an AI service and the answer is labelled as AI-written.

What Shadow Steward keeps about a connected site

  • Your site's address, the plugin and WordPress versions, and when the site was connected and last used.
  • A count of the free checks run, which check it was and when, so fair-use limits can be applied. A short record of refused requests (a one-way fingerprint of the connection, never the address itself) is also kept for a few weeks to spot abuse.
  • A one-way fingerprint of the connection token. The token itself is kept only in your WordPress settings.

Disconnect in the plugin, or delete the plugin, and Shadow Steward deletes the site and its counts. The Shadow Steward privacy page covers its own accounts, credits and payments.

This website

  • Technical logs. Cloudflare, which delivers this site, keeps standard request logs such as IP address, time and page requested, to keep the site secure and working.
  • Visit counts. Cloudflare Web Analytics counts page visits and the type of device, without cookies and without following you across other sites.
  • Security check. Cloudflare Turnstile checks that a visitor is a person when you use the contact form or newsletter signup. It may process technical information about your browser for that purpose.
  • Messages. If you write to us by email or the contact form, we keep your message and our reply so we can help you.
  • Newsletter. If you subscribe, we keep your email address, the page you signed up on, the time and the wording you agreed to. Every email will have an unsubscribe link.

There is no advertising and no tracking across other sites. Downloading the plugin does not need an account or an email address.

Who else handles information

Cloudflare hosts this site and Shadow Steward. Vortops, an AI service also operated by Christopher Ross, passes paid-check requests to the AI model. Some of these services process information in the United States or other countries, where authorities may be able to access it under local law.

Your choices

You can ask what we hold about you, ask us to correct or delete it, or withdraw your consent, by writing to the address above. If you are not satisfied you can complain to the Office of the Privacy Commissioner of Canada.

Children

wpShadow is for adults and is not directed at children.

Changes

If this page changes in a way that matters, the date above changes too.