HKC PluginsPrivacy policy
Last updated: September 18, 2026 · Version française
HKC Plugins publishes WordPress extensions, including HKC Performance, and operates a sign-in service at auth.hervekabla.com that lets those extensions connect to a Google account. This policy explains what data is processed, by whom, and why.
1. Who is responsible
Hervé Kabla, publisher of HKC Plugins. Contact: herve.kabla@gmail.com.
2. The WordPress extensions
The extensions run on your own WordPress site. The data they handle — performance measurements, Search Console figures, Google connection tokens — is stored in your site's database, under your control. We do not receive it. Uninstalling an extension deletes its data and revokes its Google access.
When checking for updates, your site downloads a small file from this website (plugins.hervekabla.com).
Download log. We keep one row per download, per update installed and per daily update check, in order to know how our extensions are used and which versions are still in the field. Each row holds: date and time, extension, type of request (first download, update, update check), the address of the WordPress site when it identifies itself (WordPress sends it in its user agent), the WordPress version, the IP address of the request, and the country derived from it. Rows are deleted after 12 months. This data is never sold nor shared; it is used only for these statistics.
The country is obtained by sending the IP address to api.country.is, which returns a country code. The result is cached so that the same address is sent at most once every 30 days.
3. Audience measurement on this website
We count page views on plugins.hervekabla.com, to know which extensions draw interest and where visitors come from. The measurement is done by the server: no cookie is set, no script or pixel is loaded in your browser, and your IP address is not kept.
Each page view produces one row holding: date and time, the address of the page, its language, the domain name of the site you came from when your browser sends it (the domain only, never the full address), the country derived from the IP address, and a visitor fingerprint. That fingerprint is computed from the IP address, the browser, the current date and a secret held by this website; it changes every day and allows neither recovering the IP address, nor following you from one day to the next, nor recognising you on another website. Rows are deleted after 13 months.
This stays within the scope the French data protection authority (CNIL) exempts from consent: purpose limited to measuring the audience of this website alone, no cross-referencing with other processing, no cross-site tracking. Robot visits are not counted. This data is never sold nor shared.
4. The sign-in service (auth.hervekabla.com)
When you click “Sign in with Google” in an extension, the sign-in goes through our service, which holds the Google application credentials. The service processes:
| Data | Purpose | Retention |
|---|---|---|
| Address and name of your site | Shown on the confirmation page; used to send you back to your site | Up to 15 minutes, then deleted |
| Google OAuth tokens (access and refresh tokens) | Handed over to your site right after sign-in; used to renew your site's access token; checked to allow Chrome UX Report requests | Not stored: in transit only. The one-time handoff expires after 5 minutes; a token validity check is cached for at most one hour |
| Cryptographic fingerprints of IP addresses and tokens | Abuse prevention (rate limiting) | Up to 24 hours |
The service does not receive, store or analyse your PageSpeed Insights or Search Console data: your site calls Google directly. Temporary data is encrypted at rest. The only cookie is a short-lived security cookie on the confirmation page.
5. Google user data
The extensions request read-only access to Google Search Console (https://www.googleapis.com/auth/webmasters.readonly) and to Google Analytics (https://www.googleapis.com/auth/analytics.readonly), and your basic account identity (openid, email) to show which account is connected. This data is used only to display performance and search reports to you, inside your own WordPress admin.
Analytics is read for one purpose: listing the pages your visitors failed to reach, so that broken links can be found without installing anything on your site. Nothing is ever written to your Analytics property, and no audience data leaves your WordPress admin.
HKC Plugins' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell Google user data, do not use it for advertising, do not transfer it to third parties, and do not allow humans to read it, except with your explicit consent for support, for security purposes, or to comply with the law.
You can revoke access at any time from the extension (“Disconnect”) or from your Google account permissions.
6. Hosting and security
This website and the sign-in service are hosted by OVHcloud, in France. All communications are encrypted (HTTPS).
7. Your rights
Under the GDPR you have the right to access, rectify and erase your data, and to lodge a complaint with your supervisory authority (in France, the CNIL). Given the minimal and short-lived data processed by the service, most requests concern data stored on your own site, which you control directly. Contact: herve.kabla@gmail.com.