Privacy and data.

Applies to JAFA SafeGuard 0.2.1 and its English edition. Last updated November 10, 2026. Operator: JAFA Co., Ltd. (ジャファ株式会社). Contact: jafasafeguard@worldscene.net. Company address: 3-9-30 Kamiosaki, Shinagawa-ku, Tokyo 141-0021, Japan. Company information.

Inside your WordPress site

SafeGuard stores settings, one previous generation, start time, a random installation key, selected file hashes, relative file identifiers and results in the WordPress database. File contents and wp-config.php contents are not sent to JAFA. Optional login throttling stores HMAC identifiers derived from REMOTE_ADDR and username using WordPress authentication salts, with counts, a 15-minute decision window and up to 512 entries. Cleanup occurs on subsequent failures/checks, so records may remain if scheduling stops. HMAC is pseudonymization, not guaranteed anonymization. Raw passwords, IPs and usernames are not stored in this throttle record.

Attack-pattern checks

Limited URL-path, GET, ordinary POST and small JSON checks occur in local memory, excluding sensitive fields and the documented unsupported inputs. The latest 20 minimal timestamps, rule IDs, detect/block states and partial-check flags are stored locally. Raw attack input, IPs and URLs are not saved in that record or sent to JAFA. Other plugins and normal web-server logs may record data separately. Local plugin data is removed on uninstall; separately installed recovery files must be removed separately.

Optional remote advisories

Only after explicit opt-in, the random installation key, WordPress version and plugin/theme identifiers and versions are sent over verified HTTPS to worldscene.net. JAFA stores the key hash, service period/status and subscription identifiers if applicable, not your per-site software inventory. Site URLs, site content, database dumps, file contents, WordPress credentials and API keys are not request fields. Connection IPs remain visible at the transport/log layer.

JAFA queries WPVulnerability using the component identifier or core version, without forwarding your installation key or site IP. The source sees JAFA’s server connection. Results are cached for six hours and old shared cache entries are cleaned after about two days. Source coverage and freshness are limited. See WPVulnerability.

Logging and retention

Normal service logs may contain IP, time, URL and User-Agent. Authorization values and request bodies are not deliberately logged. Dedicated service access logs have a seven-day deletion policy. Service rate-limit identifiers are retained up to 24 hours, payment event IDs about 45 days and inactive unpaid installation records about 90 days. Clearing external consent stops further checks. Active paid subscriptions must be cancelled before unlinking remote registration. Only the key hash and original trial period may remain as an anti-abuse tombstone for up to about 90 days. Cleanup can be delayed by outages.

Finding alerts and payments

Optional finding alerts use the WordPress administrator email and the site’s mail route. They are separate from JAFA notice signup. Mail providers may retain delivery records. Billing is currently disabled. If opened, card details are entered directly with Stripe, not stored by WordPress or JAFA. JAFA handles customer/subscription IDs, state, period and verified webhook IDs. See Stripe privacy.

Download agreement

A required Secure, HttpOnly, SameSite=Strict cookie lasts 15 minutes to verify the browser session and consent. We store hashes of random session/verification codes, agreement time, policy version/digest and archive digest. Unused sessions are deleted after expiry; approved receipts are kept up to about 90 days. That table contains no name, email, IP or User-Agent. Normal server logs are separate. This records browser actions, not verified personal identity. Rejecting the cookie prevents the consent download.

Optional service-notice email signup

Sender: jafasafeguard@worldscene.net. Email is used only for signup confirmation, free-beta ending, paid availability/pricing/signup instructions and important operational changes. We do not use this consent for unrelated product advertising. Only email-confirmed, non-unsubscribed records are eligible. Your WordPress administrator address is never automatically enrolled.

We store email, signup/confirmation/stop times, consent-purpose version, preferred notice language and hashes of confirmation/unsubscribe codes. Names, site URLs and WordPress credentials are not required. Mail is relayed through ColorfulBox SMTP. Pending records expire after 24 hours; stopped records are cleaned after about 90 days. Confirmed records remain while the stated purpose continues and are scheduled for operator deletion about 90 days after the final beta/paid-transition notice. Outages may delay cleanup. Every notice provides a stop link; the stop button works even when new-email sending is disabled. Token-bearing notice routes are excluded from dedicated access/error logging. Mail-provider records follow that provider’s handling.

Your choices and requests

Withdraw remote-check and alert consent independently in WordPress. Unsubscribe from notices using the link, or contact jafasafeguard@worldscene.net for access, correction, deletion or other rights requests. We may need to verify identity. Site operators must separately assess processing purposes, legal basis, notices, processors and international transfers applicable to their own activity. Use of this product alone does not guarantee GDPR or other privacy-law compliance.