VaultFeed

Description

VaultFeed displays social media feeds on your WordPress site while keeping your OAuth tokens encrypted on your own server — never uploaded to a third-party SaaS platform.

Connect accounts from these feed sources: Facebook, Instagram, Twitter / X, YouTube, TikTok, Threads, LinkedIn, Bluesky, Pinterest, Mastodon, Reddit, Snapchat, Twitch, Vimeo, Google Business Profile, Yelp, and more. Every token is AES-256-GCM encrypted and stored only in your own database.

Features

VaultFeed is fully functional with no artificial limits on feed count, post count, or layout — everything below is included with the plugin as distributed on WordPress.org:

• Connect accounts from these feed sources: Facebook Pages, Instagram Business / Creator, Twitter / X, YouTube, TikTok, Threads, LinkedIn, Bluesky, Pinterest, Mastodon (public accounts, no credentials needed), Reddit, Snapchat (Snap Kit Display API), Twitch (clips and VODs via Helix API), Vimeo (user/channel/group feeds), Google Business Profile, Yelp, and more
• Display photo, video, reel, and review feeds in Grid, List, Masonry, Carousel, Slider, Waterfall, Ticker, Timeline, or Wall layout
• Star-rating widget with WCAG-compliant aria-label for review feeds
• Configurable columns (1–6), aspect ratio, hover effects, and post count
• Lightbox for photos and videos with keyboard navigation
• Load More button and infinite scroll
• Feed header with optional follow button
• Shortcode [vaultfeed id="N"] and Gutenberg block
• Automatic content caching with configurable TTL, fully adjustable
• Caption display, source icon, date, and like / comment counts
• Optional “Powered by VaultFeed” attribution link — off by default, opt-in only
• Fully translatable — .pot file included
• WCAG 2.1 AA compliant — focus traps, live regions, 4.5:1 contrast
• Zero telemetry — nothing phones home

Pro add-on

A separately sold Pro add-on is planned and will be available from the VaultFeed website. It will not be distributed via WordPress.org, and none of its code is included in this plugin. It will add functionality that depends on infrastructure this plugin does not include or run:

• ReelVault source — a video feed served from your own self-hosted Holochain node (requires running that node yourself; VaultFeed does not bundle or install it)
• DHT token storage as an alternative to the local database storage described below
• Priority support

None of this is locked or hidden in the WordPress.org version; it is simply not part of this plugin.

How token storage works

When you connect an account, VaultFeed encrypts the OAuth token with AES-256-GCM and stores it in your own WordPress database. The encryption key is derived from your WordPress secret keys and a random per-installation salt that is generated at first activation and stored in your WordPress database (the vaultfeed_token_salt option). VaultFeed never writes to wp-config.php or to any WordPress core, plugin, or theme file. No token ever leaves your server.

External services

VaultFeed relies on third-party services to do its job: it fetches feed content from the social platforms you explicitly connect, and it can optionally send data to a small number of integrations (email marketing, analytics, notifications, store lookups, AI caption rewriting) that stay completely inactive until you enter your own credentials or URL for them. Every service the plugin can contact is listed below with what is sent, when, and its terms and privacy policy. No data is ever sent to VaultFeed or its authors; the plugin operates no background service and has no telemetry.

1. Facebook Graph API (graph.facebook.com) — when you initiate an OAuth connection from the Accounts page, and when fetching feed content. Governed by Meta’s Terms of Service and Privacy Policy. Only called when you have a connected Facebook account.

2. Instagram Graph API (graph.instagram.com, graph.facebook.com) — when you initiate an Instagram OAuth connection from the Accounts page, and when fetching Instagram feed, tagged-post, or story content. Governed by Meta’s Terms of Service and Instagram’s Privacy Policy. Only called when you have a connected Instagram account.

3. Twitter / X API v2 (api.twitter.com) — when you initiate a Twitter OAuth 2.0 PKCE connection, and when fetching tweet content. Governed by X’s Terms of Service and Privacy Policy. Only called when you have a connected Twitter account.

4. Google / YouTube Data API v3 (accounts.google.com, oauth2.googleapis.com, www.googleapis.com) — when you initiate a Google OAuth 2.0 connection (your browser is sent to Google’s consent screen), and when fetching YouTube channel or playlist content. Governed by Google’s Terms of Service and Privacy Policy. Only called when you have a connected YouTube account.

5. TikTok for Developers API v2 (www.tiktok.com, open.tiktokapis.com) — when you initiate a TikTok OAuth 2.0 connection, and when fetching video content. Governed by TikTok’s Terms of Service and Privacy Policy. Only called when you have a connected TikTok account.

6. Threads API (graph.threads.net) — when you initiate a Threads OAuth 2.0 connection, and when fetching posts. Governed by Meta’s Terms of Service and Privacy Policy. Only called when you have a connected Threads account.

7. Google Business Profile APIs (mybusiness.googleapis.com, mybusinessaccountmanagement.googleapis.com, mybusinessbusinessinformation.googleapis.com) — when listing your business accounts/locations and when fetching Google business reviews. Uses the same Google OAuth credentials as YouTube (item 4 above); both APIs must be enabled in your Google Cloud project. Governed by Google’s Terms of Service and Privacy Policy. Only called when you have a connected Google Business Profile account.

8. Yelp Fusion API (api.yelp.com) — when you verify a Yelp API key connection, and when fetching business reviews. Governed by Yelp’s Terms of Service and Privacy Policy. Only called when you have a connected Yelp account.

9. LinkedIn REST API (api.linkedin.com) — when you initiate a LinkedIn OAuth 2.0 connection, and when fetching posts. Governed by LinkedIn’s User Agreement and Privacy Policy. Only called when you have a connected LinkedIn account.

10. Bluesky AT Protocol API (bsky.social, public.api.bsky.app) — when you connect a Bluesky account via App Password, and when fetching posts. Governed by Bluesky’s Terms of Service and Privacy Policy. Only called when you have a connected Bluesky account.

11. Pinterest API (api.pinterest.com) — when you initiate a Pinterest OAuth 2.0 connection, and when fetching boards and pins. Governed by Pinterest’s Terms of Service and Privacy Policy. Only called when you have a connected Pinterest account.

12. Mastodon API ({your-instance}/api/v1/) — when you look up a Mastodon account by handle, and when fetching public statuses. The specific domain depends on the Mastodon instance you connect, and each instance publishes its own terms and privacy policy — for example, mastodon.social’s Terms of Service and Privacy Policy. Only called when you have a connected Mastodon account.

13. Reddit OAuth2 / REST API (oauth.reddit.com, www.reddit.com) — when you initiate a Reddit OAuth 2.0 client-credentials connection, and when fetching subreddit posts. Governed by Reddit’s User Agreement and Privacy Policy. Only called when you have a connected Reddit account.

14. Snapchat Login Kit / Snap Kit Display API (accounts.snapchat.com, kit.snapchat.com) — when you initiate a Snapchat OAuth 2.0 connection and exchange or refresh its token, and when fetching your profile and public stories. Governed by Snapchat’s Terms of Service and Privacy Policy. Only called when you have a connected Snapchat account.

15. Twitch Helix API (id.twitch.tv, api.twitch.tv) — when you connect a Twitch app (an app access token is requested from id.twitch.tv), and when fetching clips and VODs. Governed by Twitch’s Terms of Service and Privacy Policy. Only called when you have a connected Twitch account.

16. Vimeo API (api.vimeo.com) — when you connect a Vimeo account via Personal Access Token, and when fetching user, channel, or group video feeds. Governed by Vimeo’s Terms of Service and Privacy Policy. Only called when you have a connected Vimeo account.

17. AI caption rewriting — via the WordPress AI Client — optional, and never automatic: it runs only when you click “Enhance Caption” on the Moderation screen, and sends only that one caption’s text plus a short rewrite instruction (the chosen tone). No OAuth tokens, visitor data, or other site data is ever included. VaultFeed hands the request to WordPress’s built-in AI Client (WordPress 7.0 and later), so the text goes to whichever AI provider you have connected under WordPress’s own AI settings; VaultFeed stores no credentials for it and contacts no AI provider on its own, and that provider’s terms and privacy policy apply. If you have not connected an AI provider in WordPress, the feature is simply unavailable and nothing is sent anywhere.

18. Mailchimp Marketing API (<dc>.api.mailchimp.com) — used only by the optional email-capture feature. Only active if you enable email capture on a feed and enter your own Mailchimp API key and Audience (list) ID in VaultFeed → Settings. When a visitor submits the email-capture form, their email address is sent to Mailchimp to be added as a subscriber to your audience. Nothing is sent if a Mailchimp key is not configured. Governed by Mailchimp’s Terms of Use and Privacy Policy.

19. ConvertKit / Kit API (api.convertkit.com) — used only by the optional email-capture feature. Only active if you enable email capture on a feed and enter your own ConvertKit (Kit) API key and Form ID in VaultFeed → Settings. When a visitor submits the email-capture form, their email address is sent to ConvertKit to subscribe them to your form. Nothing is sent if a ConvertKit key is not configured. Governed by Kit’s Terms of Service and Privacy Policy.

20. Google Analytics 4 Measurement Protocol (www.google-analytics.com) — used only for optional click analytics. Only active if you enter your own GA4 Measurement ID and API Secret in VaultFeed → Settings. When a visitor clicks a post, a vaultfeed_click event (feed ID, post ID, and post type — no personal data) is sent to your Google Analytics property. Nothing is sent if GA4 credentials are not configured. Governed by Google’s Terms of Service and Privacy Policy.

21. Slack incoming webhooks (hooks.slack.com) — used only for optional new-post notifications. Only active if you paste your own Slack incoming-webhook URL in VaultFeed → Settings and enable new-post alerts on a feed. When new posts arrive in that feed, a short text message (the number of new posts and the feed’s name — no post content and no visitor data) is sent to your Slack webhook. Nothing is sent if no Slack URL is configured. Governed by Slack’s Terms of Service and Privacy Policy.

22. Zapier webhooks (hooks.zapier.com) — used only for optional automation. Only active if you paste your own Zapier “Catch Hook” URL in VaultFeed → Settings. When a feed refresh finds new posts, the feed ID and, for each new post, its platform ID, caption text, first media URL, permalink, and timestamp are sent to your Zapier webhook. This is public social content you chose to display — no visitor data is included. Nothing is sent if no Zapier URL is configured. Governed by Zapier’s Terms of Service and Privacy Policy.

23. Shopify Storefront API ({your-store}.myshopify.com) — used only by the optional “Shop” badge. Only active if you enter your own Shopify store URL and Storefront API access token in VaultFeed → Settings and enable the shop badge on a feed. When a post’s hashtag has no product link you mapped manually, that hashtag is sent to your own store’s Storefront API as a product-handle lookup, together with your Storefront token, to find the product’s URL (results are cached for one hour). No visitor data is sent. Nothing is sent if Shopify is not configured. Governed by Shopify’s Terms of Service and Privacy Policy.

24. Your own outbound webhook URLs — optional. Only active if you add one or more webhook endpoints in VaultFeed → Webhooks. When an event you selected fires (feed refreshed, feed error, post approved/rejected), a JSON payload is POSTed to the URL(s) you entered: the event name, the feed ID, and for refresh events each post’s platform ID, type, source, caption text (first 280 characters), permalink, and publish date. Requests are signed with HMAC-SHA256 using your webhook secret. The destination is whatever server you specify, so its terms and privacy policy are those of the service you choose; no data goes anywhere unless you add a URL.

25. Social platform media CDNs (for example scontent.cdninstagram.com, pbs.twimg.com, i.ytimg.com — the exact hosts depend on the platforms you connect) — the images, thumbnails and videos inside your feeds are served from the platform’s own CDN, so a visitor’s browser requests them directly from that platform while viewing the feed, exactly as an ordinary embedded post would. The URLs come from the platform API response; VaultFeed does not rehost them. The platform’s terms and privacy policy are the ones listed for that platform above. If you would rather your visitors never contact those CDNs, switch on the built-in image proxy — wp option update vaultfeed_image_proxy_enabled 1 — and your own server fetches and caches the images instead.

26. YouTube embedded player (www.youtube-nocookie.com) — only when a visitor clicks a YouTube video; nothing loads before the click. The visitor’s browser then loads YouTube’s player directly, so YouTube receives the visitor’s IP address, browser details, your page address and the video ID, and may set cookies. YouTube Terms, Google Privacy Policy.

27. Vimeo embedded player (player.vimeo.com) — only when a visitor clicks a Vimeo video; nothing loads before the click. The visitor’s browser then loads Vimeo’s player directly, so Vimeo receives the visitor’s IP address, browser details, your page address and the video ID, and may set cookies. Vimeo Terms, Vimeo Privacy Policy.

28. TikTok embedded player (www.tiktok.com) — only when a visitor clicks a TikTok video; nothing loads before the click. The visitor’s browser then loads TikTok’s player directly, so TikTok receives the visitor’s IP address, browser details, your page address and the video ID, and may set cookies. TikTok Terms, TikTok Privacy Policy.

29. Twitch embedded player (player.twitch.tv for videos, clips.twitch.tv for clips) — only when a visitor clicks a Twitch video or clip; nothing loads before the click. The visitor’s browser then loads Twitch’s player directly, so Twitch receives the visitor’s IP address, browser details, your page address (your site’s host name is passed as the parent setting Twitch requires) and the video or clip ID, and may set cookies. Twitch Terms, Twitch Privacy Policy.

30. WordPress.org update API — standard WordPress plugin update check behaviour. No VaultFeed-specific data is transmitted beyond the plugin slug and current version.

Third-party libraries

VaultFeed’s own scripts, styles and fonts are all bundled with the plugin — none are loaded from an external server or CDN. (The post images and videos inside your feeds are a separate matter: those are served from the social platforms’ CDNs, as described in item 25 of “External services” above.)

• SortableJS 1.15.7 (MIT licence) — drag-to-reorder on the admin Moderation screen. Bundled at assets/js/vendor/sortable.min.js with the unminified source alongside at assets/js/vendor/sortable.js and the upstream licence at assets/js/vendor/sortable-LICENSE.txt. Source: github.com/SortableJS/Sortable.
• All other minified files in assets/js/*.min.js and assets/css/*.min.css are built from the human-readable .js / .css files of the same name that ship next to them.