Privacy Policy

This privacy policy was last updated on October 27, 2026.

This page explains what happens to your data when you read gauravtiwari.org, buy something from my store, join the community, ask for support, or install one of my WordPress plugins or themes. I’ve written it from what the site and the products actually do, not from a template.

The short version: I don’t sell your data, I don’t run advertising trackers across the site, and my plugins and themes don’t send usage telemetry. When something does leave your browser or your website, this page names where it goes and why.

Who I am and what this policy covers

gauravtiwari.org is run by me, Gaurav Tiwari, from Kushinagar, Uttar Pradesh, India. I’m the data controller for the personal data collected through this site and its store. When this page says “I”, “me” or “my”, it means me and the site.

This policy covers:

The website: articles, tools, calculators, study notes, lessons, deals and snippets on gauravtiwari.org.
The store: everything sold or given away at gauravtiwari.org/shop/, including plugins, themes, books, PDFs, Notion templates, AI skills, design systems and the All-Access pass.
Accounts, the community and support: your customer account, the community spaces, the support portal, tickets and the on-site chat assistant.
My WordPress plugins and themes: what they send back to me, and what they don’t, after you install them on your own site.
Email: the newsletter and the order, license and support emails I send.

What I collect when you browse

You can read every article without an account and without giving me your name or email.

When you load a page, a few things happen in the background:

Analytics. I use Rybbit, a privacy-focused analytics tool that I host myself at data.gatilab.com. It records page views, the referring site, your approximate location (country and region), browser, operating system, device type and screen size. It doesn’t use cookies, and it doesn’t record your full IP address. Session recording is turned off.
Conversion events. The same Rybbit setup counts a few actions so I know what’s useful: clicks on affiliate links, file downloads, email or phone link clicks, form submissions, add-to-cart, checkout starts and purchases. These events carry a product ID, a link slug or a file name, never your name or email.
Server and security logs. Like every website, the server and its security layer see your IP address, browser and the page you asked for. The site is hosted on a managed server through xCloud and sits behind Cloudflare, which filters attacks and caches pages. These logs are used for security and troubleshooting.
Your country. I read your approximate country from the network so the store can show prices in your currency and so some affiliate links can send you to the right regional store. I don’t store your IP address to do this.

Cookies and browser storage

The site sets very few cookies, and none of them are advertising cookies.

Login cookies keep you signed in to your account, the community and the support portal.
Store cookies remember your cart, your currency and any coupon link you followed. Without them checkout doesn’t work.
Comment cookies remember your name and email for the next comment, only if you tick that box.
Voting cookies stop a poll, roadmap vote or rating from being counted twice.
Local storage in your browser remembers your light or dark theme choice and whether you’ve already seen or dismissed a notice. This stays on your device and isn’t sent to me.

Third parties can set their own cookies when you use their features here: Google when you sign in with Google, the payment provider during checkout, Cloudflare Turnstile on forms and login pages, and YouTube after you press play on an embedded video. You can block or delete cookies in your browser settings, but the account and store features need theirs to work.

Accounts, sign-in and the community

You need an account only to buy, download what you bought, manage licenses, post in the community or open a support ticket.

What I store: your name, email address, password (stored hashed, never in plain text), and anything you add to your profile.
Ways to sign in: email and password, a passkey, or Google. If you choose Google, Google tells me your name, email address and profile picture. I don’t get access to your Google account beyond that.
Bot protection: login and registration forms use Cloudflare Turnstile, which checks your browser and IP address to tell people from bots.
Community posts: what you post in the community spaces, including your display name and profile picture, is visible to other members. Paid spaces check your purchase so only customers get in.

Purchases, licenses and downloads

When you buy from the store, I need enough information to take the payment, deliver the product, issue an invoice and follow tax law.

What I collect: name, email address, billing country and address, the products you bought, prices, taxes, any coupon used, and your consent choices at checkout.
Payments: card, UPI and wallet payments go straight to the payment provider shown at checkout, currently Razorpay or Dodo Payments depending on your country and currency, and in some cases Stripe, PayPal, Paddle or Polar. I never see or store your full card number. The provider tells me whether the payment worked and gives me a reference for refunds.
Licenses: paid plugins and themes come with a license key. I keep a record of the key, its expiry and the website addresses where you’ve activated it, so you can manage activations from your account.
Downloads: product files and free PDFs are delivered from my file storage on Cloudflare R2. Cloudflare sees your IP address when you download a file.
Currency rates: the store fetches exchange rates from a public rates service. Only currency codes are sent, nothing about you.

Contact and support forms are built with Core Forms. Each submission stores what you typed, plus your IP address, browser and the page you sent it from, so I can reply and spot abuse. Some forms use Cloudflare Turnstile.

Comments store your name, email, optional website, the comment, your IP address and browser. Comments, and messages sent through some forms, are checked by Akismet, a spam filter from Automattic, which receives your IP address, browser, the referring page and the text you submitted. If you have a Gravatar, your avatar can be looked up from a hash of your email address.

The newsletter runs on MailerPress, inside my own WordPress install. If you subscribe, I store your email address, your name if you give it, when and where you signed up, and which lists you’re on. Emails can record whether they were opened and which links were clicked so I can see what’s working. Every email has an unsubscribe link, and unsubscribing stops all newsletter email right away.

Order, license and support emails are sent through a transactional email provider, which handles your email address and the message to deliver it.

Customer records. Order and customer details are also synced to my own customer management system so I can handle support, renewals and refunds in one place.

Support and the chat assistant

The support portal and the chat widget run on Core Support, my own helpdesk plugin.

Tickets store your name, email address, your messages, any files you attach and the product the ticket is about. I use them only to help you, and to fix the product when a ticket shows a bug.
The chat assistant answers questions from my documentation. Your messages, along with the documentation passages relevant to them, are sent to the AI model provider that powers the assistant, such as OpenAI or Anthropic, to generate the answer. Those providers process the text under their API terms and don’t use it to train their models. Please don’t type passwords, license keys or payment details into the chat.
Chat transcripts are kept for up to 180 days and then deleted. If a chat turns into a ticket, it’s kept with the ticket.

Affiliate links and partner sites

Some links on this site are affiliate links. If you buy through one, I may earn a commission at no extra cost to you. As an Amazon Associate, I earn from qualifying purchases.

Affiliate links on this site go through short /go/ links managed by GT Link Manager. For each click I record the time, the page you clicked from (without its query string) and your country. I don’t store your IP address, set a cookie or fingerprint your browser for this. Individual click records are deleted after 7 days, and only daily totals are kept, for 90 days.

Once you land on the partner’s site, the partner or its affiliate network usually sets its own cookie to credit the sale. That’s governed by their privacy policy, not this one.

Embedded content and outside links

Some pages embed content from other services:

YouTube videos show a thumbnail from YouTube’s image server until you press play. The player loads only after you click, and from then on YouTube can collect data as if you’d visited YouTube.
Math formulas on some lessons and notes are rendered by a script loaded from the jsDelivr CDN, which sees your IP address.
Links to other sites, including the sites of products I review, are covered by those sites’ own policies. I don’t control what they collect.
Product sites of their own. Some of my products, such as Core Forms at core-forms.com, have separate websites. Those sites can use different tools, including Google’s ad measurement tag, and are covered by their own privacy notices.

My WordPress plugins and themes

I build my plugins and themes so that your website stays in your hands. Here’s exactly what they send back to me.

No telemetry. None of my plugins or themes send usage statistics, tracking data, your visitors’ data, your content or your admin email to me.
License and update checks (paid products). After you enter a license key, the plugin or theme contacts gauravtiwari.org to activate the license and check for updates. It sends the license key, the product ID, your site address and the product version. Most products also send your WordPress and PHP versions so I can offer a compatible update. Without a license key, nothing is sent. I store the activation record so you can see and manage your sites from your account.
Free themes from my site. The direct-download versions of my free themes check gauravtiwari.org for updates about every 6 hours. The check sends only the theme name and your WordPress version, not your site address. The wordpress.org versions don’t contact me at all.
Security notices. GT Page Blocks Builder checks a public security notice file on gauravtiwari.org so it can warn you about a critical issue. A site owner can switch this off with the GT_PB_DISABLE_SECURITY_CHANNEL constant.
Update downloads. Update packages are delivered from Cloudflare R2, which sees your server’s IP address.
Your site address in requests. WordPress adds your site address to the outgoing requests it makes by default. That’s WordPress behavior, not something my products add, and it applies to any service a plugin talks to.

Services you choose to connect

Many of my products can talk to outside services, but only after you, the site owner, turn that feature on and add your own account or API key. In that case your site sends data straight to that service. It doesn’t pass through me, and I don’t receive a copy. Examples:

AI providers such as OpenAI, Anthropic, Google Gemini, DeepSeek, xAI and Voyage, in Alpha Chat, Core Support, GT Page Blocks Builder, GT DeepSeek for AI and the OpenAI provider plugin. What’s sent is the prompt, the chat message or the content you ask the AI to work on.
Payment providers such as Stripe, PayPal, Razorpay, Paddle, Polar and Dodo Payments, in Core Forms, Core Bookings, GT Extensions for FluentCart and Stackless for WooCommerce.
Spam protection such as Google reCAPTCHA, Cloudflare Turnstile and Akismet in Core Forms and Core Bookings, which receive your visitor’s IP address.
Email, messaging and automation such as Emailit, Resend, Brevo, SendGrid, Slack, Discord, Telegram, Twilio, WhatsApp, Zapier, Make, n8n and webhooks, which receive the form entry, booking or ticket details you choose to send.
Calendars and meetings such as Google Calendar, Microsoft 365, iCloud and Zoom in Core Bookings.
Data sources and storage such as Google Sheets in Core Tables, S3 or Bunny storage in Core Support, and the Cloudflare or xCloud API in GT Performance.

Your visitors’ data

When you run my plugins, personal data about your visitors, such as form entries, bookings, chat transcripts, tickets, orders and click logs, is stored in your own WordPress database. You’re the controller of that data and I never see it. Several products include retention settings, IP hashing and WordPress’s built-in export and erase tools to help you meet your own privacy obligations.

Products that don’t connect to anything

Formatting Extender, Beautiful Recent Posts Widget and Dynamic Month & Year into Posts make no outside connections at all.

Books, PDFs, templates and AI skills

Books and PDFs are plain files. They don’t contain tracking pixels and don’t report back when you open them.
Notion templates are copied into your own Notion workspace, which is covered by Notion’s privacy policy.
AI skills and design systems are files you run in your own AI tool or project. I don’t receive anything you do with them.

How I use your data

I use personal data only for these purposes:

To deliver what you asked for: an order, a download, a license, a reply, a ticket answer or the newsletter.
To run your account and the community.
To keep the site, the store and your account secure, and to stop spam and fraud.
To understand which articles and products are useful, using the analytics described above.
To meet legal, tax and accounting duties.

Where the GDPR or a similar law applies, the legal basis is the contract with you for orders, licenses and support, your consent for the newsletter and optional features, my legitimate interest in running and securing the site, and legal obligation for tax records. You can withdraw consent at any time.

I don’t use your data for automated decisions that have legal or similarly significant effects on you.

I don’t sell, rent or trade your personal data, and I don’t share it for cross-site advertising.

I share data only with the service providers that help run the site, and only what each one needs:

Service	Why I use it	What it receives
xCloud and the server host	Hosting the site, its database and the store	Everything stored on the site
Cloudflare	Security, caching, file downloads (R2) and bot checks (Turnstile)	IP address, browser, and the pages and files you request
Rybbit, self-hosted on my server	Privacy-focused analytics	Page views, events, approximate location and device type, with no cookies or full IP address
Razorpay, Dodo Payments and other gateways shown at checkout	Taking payments	Name, email, billing details, the amount and the payment details you enter
Akismet by Automattic	Filtering spam comments and messages	IP address, browser, referring page, your name, email and message
Google	Sign in with Google	Your name, email address and profile picture when you choose to sign in with Google
Transactional email provider	Delivering order, license and support emails	Your email address and the message
AI model provider for the chat assistant, such as OpenAI or Anthropic	Answering chat questions	Your chat messages and the documentation used to answer them
YouTube and jsDelivr	Embedded videos and math rendering	IP address and browser when that content loads

I may also disclose data when the law requires it, to protect the site or its users from fraud or abuse, or as part of a sale or transfer of the business, in which case this policy would continue to apply to your data.

Where your data is stored

The site, its database and the analytics server run on servers that may be outside your country, and the providers above may process data in the United States, the European Union, India and other countries. Where the law requires it, these transfers rely on safeguards such as the providers’ standard contractual clauses.

How long I keep it

Orders, invoices and payment records: as long as Indian tax and accounting law requires, currently at least 6 years.
Licenses and activation records: for the life of the license and afterwards, so you can renew or recover access.
Your account and community posts: until you ask me to delete them.
Support tickets: as long as your account exists, unless you ask me to delete them.
Chat transcripts: up to 180 days.
Form submissions and comments: until they’re no longer needed to reply or keep a record, or until you ask me to delete them.
Newsletter data: until you unsubscribe. I keep your email on a suppression list after that only so I don’t email you again.
Affiliate click records: 7 days for individual clicks, 90 days for daily totals.
Analytics: kept on my own analytics server as aggregate statistics.

Your rights

Depending on where you live, laws such as the GDPR, the UK GDPR, California’s CCPA and CPRA, and India’s Digital Personal Data Protection Act give you rights over your data. I offer these rights to everyone, wherever you live:

Access the personal data I hold about you and get a copy.
Correct anything that’s wrong or incomplete.
Delete your data, unless I have to keep it by law, such as tax records.
Export your data in a common format.
Withdraw consent, for example by unsubscribing from the newsletter.
Object to or restrict how I use your data.
Complain to your local data protection authority.

To use any of these rights, email legal@gauravtiwari.org. I’ll reply within 30 days and may ask you to confirm the request from your account’s email address so I don’t hand your data to someone else. I won’t treat you differently for using your rights.

Delete your account or data

To delete your gauravtiwari.org account and the data linked to it, email gaurav@gauravtiwari.org from your account’s email address with the subject “Delete my account”. I’ll delete the account, your profile and your community and support data, and keep only the order records the law requires.

If you signed in with Google, you can also remove my site’s access from your Google Account under Security, then Your connections to third-party apps and services.

To remove Facebook’s access, open Facebook, go to Settings & privacy, then Settings, then Apps and websites, and remove “Gaurav Tiwari”.

Children

This site isn’t directed at children under 13, and I don’t knowingly collect their data. Many readers are students preparing for exams. If you’re under 18, please get a parent’s or guardian’s permission before you create an account or buy anything. If you believe a child has given me personal data, email me and I’ll delete it.

How I protect your data

The whole site runs over HTTPS.
Passwords are stored hashed, and you can sign in with a passkey instead of a password.
Login, registration and checkout are protected against bots with Cloudflare Turnstile.
Analytics and affiliate click tracking avoid storing full IP addresses.
Access to the admin side of the site is limited and protected.

No system is perfectly secure. If a breach affects your personal data, I’ll tell you and the relevant authorities as the law requires.

Changes to this policy

When my products or services change in a way that affects your data, I’ll update this page and the date at the top. If a change is significant, I’ll also tell customers by email.

Contact

For privacy questions, requests and legal notices, email legal@gauravtiwari.org.

Gaurav Tiwari
Kushinagar, Uttar Pradesh
India
Website: https://gauravtiwari.org