# Privacy & HTTP Requests

This document lists **every** network request and filesystem read the plugin
performs, and explains why. It is intended to make review by the WordPress.org
plugin team (and anyone else who cares) as fast as possible.

**Short version:** The plugin makes zero third-party HTTP calls. It collects
no user data. It sends no telemetry. The only HTTP requests it ever makes are
loopback requests to the same WordPress site it is installed on, used to power
the admin dashboard.

---

## What the plugin does NOT do

- Does not call any external API (no `api.pressific.com`, no analytics, no SaaS)
- Does not transmit any user data, admin email, site URL, or plugin usage anywhere
- Does not set cookies
- Does not require an API key or account
- Does not use iframes or remote scripts
- Does not obfuscate or minify any PHP code
- Does not bundle any external HTTP libraries — it uses only `wp_remote_get()`
- Does not install any companion plugins

---

## Every HTTP request the plugin makes

All requests use `wp_remote_get()` with a URL built from `home_url()` — i.e.
the site's own URL. These are **loopback requests** (the site fetching itself)
and are the same technique WP core uses for the Site Health loopback check,
the cron loopback, and REST API discovery.

| # | URL | User-Agent | Triggered by | Purpose |
|---|-----|------------|--------------|---------|
| 1 | `{home_url}/robots.txt` | `PressificStatus/<plugin-version>` | Admin loads the Pressific Bio for LLMs.txt settings page (cached 5 min); hourly WP-cron event `pressific_hourly_health_check`; plugin activation | Parse the live robots.txt to determine per-crawler access (GPTBot, ClaudeBot, CCBot, etc.) for the status dashboard |
| 2 | `{home_url}/llms.txt` | `PressificStatus/<plugin-version>` | Same triggers as #1, AND only if our own content option is empty | Detect whether another plugin or static file is currently serving llms.txt so the dashboard can show the source |
| 3 | `{home_url}/llms-full.txt` | `PressificStatus/<plugin-version>` | Same as #2 | Same as #2, but for the full-text variant |
| 4 | `{home_url}/llms.txt` | `PressificImport/1.0` | Admin loads the Pressific Bio for LLMs.txt settings page AND the short-content option is empty | Auto-fill the editor with whatever is currently being served so the user does not have to start from scratch |
| 5 | `{home_url}/llms-full.txt` | `PressificImport/1.0` | Admin loads the page AND the full-content option is empty | Same as #4 |

The distinctive User-Agent strings exist so the plugin can recognise its own
loopback requests and step aside (so request #4 captures what another plugin
would serve, not our own empty response).

**Source code for these requests:**
- `includes/class-pressific-status.php` — method `loopback_fetch()` (requests 1, 2, 3)
- `includes/class-pressific-import.php` — method `detect()` (requests 4, 5)

Neither method can be configured to point anywhere other than `home_url()`.
Neither accepts a URL parameter from user input. The URLs are hard-coded.

---

## Filesystem reads

The plugin reads two files from disk, both inside the WordPress installation
the plugin is running on:

| Path | Purpose |
|------|---------|
| `{ABSPATH}/llms.txt` and `{ABSPATH}/llms-full.txt` | Detected when present so the admin dashboard can warn the user that a static file is overriding the plugin output. Never written. |
| `{plugin}/assets/images/menu-icon.svg` | Read once per admin page load and inlined as a base64 data URI for the sidebar menu icon |

Neither read executes or parses arbitrary code. No `include` / `require` from
untrusted paths.

---

## Data stored

All data is stored in the standard `wp_options` table, on the user's own
database. Nothing is ever sent elsewhere.

| Option name | Content |
|-------------|---------|
| `pressific_content_short` | The llms.txt content the user typed/pasted |
| `pressific_content_full` | The llms-full.txt content the user typed/pasted |
| `pressific_allow_ai_crawlers` | `0` or `1` |
| `pressific_health_summary` | A small array of booleans/timestamps for the menu bubble |
| `pressific_version` | The plugin's own version string, for upgrade detection |
| `pressific_status_cache` (transient) | A short-lived cache of the dashboard data; auto-expires after 5 minutes |

Uninstall removes all of these. See `uninstall.php`.

---

## How to verify

The claims above can be verified in the source:

```bash
# Find every HTTP call the plugin makes
grep -rn 'wp_remote_\|curl_\|fsockopen\|file_get_contents' --include='*.php' ai-llms-txt/

# Find every URL it passes to an HTTP call
grep -rn 'home_url\|admin_url\|site_url\|https://\|http://' --include='*.php' ai-llms-txt/
```

Every match will be either:
1. Loopback via `home_url()` (the requests enumerated in the table above)
2. `admin_url()` used for building **in-admin** navigation URLs (not HTTP calls)
3. A `https://` string in a user-facing description, a GPL licence URL, or an
   `href` attribute pointing to the public llmstxt.org spec or pressific.com

There is no outbound third-party connection anywhere in the codebase.

---

## WordPress.org plugin guidelines — explicit compliance notes

| Guideline | How this plugin complies |
|-----------|--------------------------|
| #7 No calling home without consent | The only requests made are to the site itself (loopback). No external service is contacted. |
| #8 No collecting user data | Nothing is collected, nothing is transmitted. |
| #9 No obfuscated code | All code is plain, readable, documented PHP. No minification, no base64-encoded payloads (except inlining the plugin's own SVG icon as a data URI for the admin menu — the SVG source is visible in `assets/images/menu-icon.svg`). |
| #10 No tracking without consent | No tracking of any kind. |
| #13 No external JS/CSS from CDNs | Only local CSS at `assets/css/admin.css`. No JavaScript bundled at all. |

---

## Questions from the WordPress.org review team

If the reviewer has a concern that isn't addressed here, the fastest path to
resolution is to quote the specific file and line number — the author will
respond the same day via the plugin's support channel at https://pressific.com.
