In short
DocSync talks to Google only after a site administrator saves a self-managed OAuth client and a WordPress user connects their Google account. Content sync happens between that user’s Google account and the WordPress site. Brasth does not sit in the middle of document traffic.
Optional anonymous telemetry exists so Brasth can count opted-in installs and version compatibility. It is off by default. When it is on, it still does not send Google data, site URLs, emails, or document content.
What stays on your WordPress site
The plugin stores the following in the WordPress database:
- Site-level Google OAuth client settings (the client secret is encrypted with WordPress salts)
- Encrypted per-user Google tokens
- Connected Google account email addresses
- Linked Google document metadata and source sync status
- Diagnostic sync events (the Sync Activity logs)
- Imported attachment metadata
Images exported from Google Docs are imported into the WordPress Media Library. Synced posts and imported media remain on the site until someone with permission changes or deletes them.
How Google is contacted
After credentials are saved and a user connects, DocSync sends requests to three Google services:
- Google OAuth 2.0 — to authorize a user’s Google account and refresh access tokens.
- Google Drive API — to list visible Google Docs, shared drives, folders, document metadata, and HTML ZIP exports.
- Google Docs API — to read document structure when the large-document fallback is needed.
The OAuth scope is https://www.googleapis.com/auth/drive.readonly.
What can be sent to Google
- OAuth client details supplied by the site owner
- OAuth authorization codes and refresh-token requests
- Connected-user access tokens
- Drive file IDs, folder IDs, and shared-drive IDs
- Search text entered in the Drive browser
- Pagination tokens
- Document export and read requests
What can come back from Google
- The connected Google account email address
- OAuth tokens
- Google Docs titles, metadata, modified time, and version identifiers
- Document export content
- Image content URLs needed to import media into WordPress
Google’s terms apply to those services:
Optional Brasth telemetry
Anonymous active-install telemetry is off by default. It runs only when a site administrator turns it on — from the Setup consent prompt, or with the “Share anonymous usage diagnostics with Brasth” checkbox in Setup → Sync defaults.
When enabled, the plugin sends one weekly POST request to https://telemetry.brasth.com/v1/check-in. That request contains only:
- An anonymous site hash generated from a random install ID
- The plugin slug
- Plugin version
- WordPress version
- PHP version
- Telemetry consent version
It does not contain Google data, the site URL, user email, post data, document IDs, document metadata, document content, or imported media.
The telemetry service stores those fields in Cloudflare D1. It does not store IP addresses, user agents, request URLs, or request headers. Rows that have not checked in for more than 90 days are deleted.
The plugin already cites https://docsyncwp.com/privacy-policy. That address and /privacy/ publish this same text.
This website
The public DocSync site at docsyncwp.com uses Google Analytics 4 (measurement ID G-GJH1C2KREB) to count visits. Google may set cookies and collect standard usage data such as page views and approximate location. See the Google Privacy Policy. This is separate from the plugin’s optional telemetry, which stays off by default.
What uninstall removes
Uninstalling the plugin removes settings, encrypted user Google tokens, and scheduled cron events. Linked post metadata is retained by default. To remove that metadata as well, define DOCSYNC_WP_FULL_UNINSTALL or return true from the docsync_wp_full_uninstall filter. Synced posts and imported media are not deleted automatically.
WordPress.org listing
The canonical plugin description, including the External Services and Privacy sections this page is based on, lives on WordPress.org: