Privacy Policy
How MigratePress handles your data — including data you authorise us to access through Google, Dropbox and Microsoft.
This Privacy Policy explains what MigratePress ("MigratePress", "we", "us") does with information when you use the MigratePress WordPress plugin, the MigratePress sign-in service at migratepress.bdwebguy.com/mgp-oauth, and this website.
The short version. MigratePress is software that runs on your own WordPress server. Your backups, your database and your files are transferred directly from your site to the storage account you connected. We never receive, store or process the contents of your website, and we never sell data to anyone.
1. Who we are
MigratePress is a WordPress plugin published by Cloud Nine Web. The plugin is installed on servers controlled by you. For questions about this policy, contact [email protected].
2. What the plugin does
MigratePress packages a WordPress site — database, plugins, themes, uploads and other content — into archive files, uploads those archives to a cloud storage destination you choose, and restores or migrates the site from them. All of that work happens on your server, between your site and your storage provider.
3. Information we collect
| Where | What | Why |
|---|---|---|
| The plugin, on your site | Your storage credentials and access tokens, your backup settings and job history | To run backups and restores. Stored in your own WordPress database, encrypted at rest. Not transmitted to us. |
| The sign-in (OAuth) service | The address of the site starting the sign-in, the provider name, the time, and the outcome | To hand the resulting tokens back to the correct site, to rate-limit abuse, and to support you when a connection fails |
| This website | Standard server logs (IP address, user agent, requested URL) and any message you send us | Security, abuse prevention and answering your support request |
The plugin does not phone home. It does not send us your site content, your database, your visitors' data, your usage statistics or your storage credentials.
4. Google user data
If you connect Google Drive, MigratePress asks Google for your permission to use one scope:
https://www.googleapis.com/auth/drive.file— access limited to files and folders that MigratePress itself creates in your Drive.
With that permission MigratePress will: create a backup folder in your Drive; upload backup archives to it; list those archives so you can pick one; download an archive when you restore or migrate; and delete an archive when your retention setting expires it. It cannot open, read, modify or delete any other file in your Google Drive, because drive.file does not grant that access.
Google issues an access token and a refresh token when you approve the consent screen. Those tokens are stored encrypted in your own WordPress database. Our sign-in service holds a finished sign-in for a maximum of five minutes so your site can collect it once, server to server, and deletes the record on collection. We do not keep copies of your tokens, and we never store the contents of your Drive.
Limited Use. MigratePress use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except as needed to provide the backup feature you asked for, and we do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models.
A fuller description, written for Google's verification review, is on the How MigratePress Uses Google User Data page.
5. Dropbox, Microsoft and other providers
Dropbox and OneDrive work the same way: MigratePress requests only the permissions needed to write, list, read and delete its own backup files, and the resulting tokens live encrypted on your site. For S3-compatible storage, Nextcloud and FTP you supply access keys or a password directly to your site; they are encrypted in your database and never sent to us.
6. Sharing and disclosure
We do not sell personal information and we do not share it with advertisers or data brokers. Information is disclosed only: to the storage provider you connected, as part of performing the operation you asked for; to our hosting provider, as an unavoidable part of running this website; or where we are legally required to do so.
7. Retention
- Sign-in records: deleted the moment your site collects them, and in any case within five minutes.
- Service log: the site host, provider and outcome of a connection, kept for a short rolling window for support and abuse handling, and never containing tokens or file data.
- Data in the plugin: stays on your server until you delete it, and is removed when you uninstall the plugin.
- Support emails: kept while the matter is open and for a reasonable period afterwards.
8. Security
Credentials and tokens are encrypted with AES-256 before being written to a database, transfers use HTTPS, and the sign-in service signs the state it hands to a provider so a finished authorisation can only be returned to the site that started it. No system is perfectly secure, but we do not hold your backups, so a compromise of our systems cannot expose them.
9. Your rights and choices
You can disconnect a storage destination at any time from the plugin's Storage screen, revoke MigratePress access from your Google, Dropbox or Microsoft account, and delete the backup files from your storage. Step-by-step instructions are on the Delete Your Data & Revoke Access page.
Depending on where you live you may have the right to access, correct, export or erase personal data we hold about you, and to object to or restrict its processing. Write to [email protected] and we will respond within 30 days.
10. Children
MigratePress is a tool for website administrators and is not directed at children under 16. We do not knowingly collect personal information from children.
11. Changes to this policy
If this policy changes materially we will update the date at the top of this page and, where the change affects how Google user data is handled, describe the change on this page before it takes effect.
12. Contact
Privacy questions: [email protected]
Support: [email protected]