• rafi.w

    (@rafiw-1)


    I used AI to evaluate the plugin and this is the result.

    Your site sends visitor data to a third party

    Every time a visitor loads your page, their browser also loads:

    • External JS from MyPopups
    • Tracking pixels
    • Analytics requests

    This can expose:

    • IP addresses
    • User behavior
    • Possibly logged‑in WordPress user IDs (depending on implementation)

    You lose control over the popup content

    If their server goes down or they change the script, your site breaks.
    You cannot guarantee GDPR/and other privacy compliance standards

    For a privacy‑focused platform, this is a red flag.

    • This topic was modified 1 month ago by rafi.w.
Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Author Nick

    (@d4d5bh6)

    Thanks for taking the time to share this detailed review — we appreciate the focus on privacy and transparency.

    You’re absolutely right that loading functionality via external scripts raises important questions around data handling and control, and we take those concerns seriously.

    How our plugin works
    Our plugin uses a SaaS-based delivery model, which means certain assets (such as JavaScript) are loaded from our servers. This approach is common among modern popup and marketing tools, including platforms like OptinMonster, because it allows us to provide:

    • Faster updates and security patches without requiring manual plugin updates
    • Improved performance via global content delivery
    • Advanced targeting and behavioral features that are difficult to achieve purely locally

    Data and privacy
    We want to clarify that:

    • We do not collect personally identifiable information (PII)
    • We do not expose WordPress user IDs to our systems
    • Any data processing is limited to what is necessary to deliver popup functionality and analytics configured by the user
    • Site owners remain in control of whether and how tracking or analytics features are used

    Reliability and control
    Our infrastructure is designed for high availability, and we’ve been operating this service reliably for over 5 years without incidents of the type described. That said, we understand the importance of control, and we continuously work on improving transparency and configuration options for site owners.

    We appreciate feedback like this because it helps us improve both the product and how we communicate about it. If you have specific concerns or would like more technical details, we’re happy to discuss them.

    Thread Starter rafi.w

    (@rafiw-1)

    Nick!
    Can you explain:
    Why popup which is relatively simple code requires creating an account on an external site.
    Why the above is not clearly disclosed on the WordPress.org plugin page, the user discovers it only after the plugin is activated.
    Why the plugin loads remote scripts and sends user data offsite which is a violation of the WordPress.org guidelines on privacy and external services.

    • This reply was modified 1 month ago by rafi.w.
    • This reply was modified 1 month ago by rafi.w.
Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this review.