Your media goes directly to your bucket.
Offloft sends your media only to the storage bucket you connect, using keys you enter. The keys are stored encrypted in your own database. The free plugin sends no data to its makers: no tracking, no analytics, no phone-home. Pro talks to Freemius only to manage your license.
What Offloft sends, and where
Your cloud storage provider. When you connect a bucket, Offloft sends your media files (the original and every image size), their file names and folder paths, and requests signed with your access keys, to that provider's storage address. It does this when you test the connection, and when files are offloaded, checked, brought back or deleted.
Your delivery address. Offloft fetches one small test image from your public address, to check that delivery works.
Freemius, only if you click. The plan buttons in the free plugin are plain links to Freemius, the shop that sells Offloft Pro. Nothing is sent unless you click one, and Offloft adds no site details to the link.
Offloft doesn't add cookies or collect your visitors' personal data.
How your keys are stored
Your access keys are encrypted in your own WordPress database with libsodium, using a key made from your site's WordPress security keys, or from OFFLOFT_ENCRYPTION_KEY if you define it in wp-config.php. If those security keys change, Offloft can't read the saved keys, and asks you to enter them again. You can also keep keys out of the database altogether by defining them in wp-config.php. System info and the debug log mask keys.
What Pro sends to Freemius
When you activate a license, Freemius receives the license key, the name and email address of the WordPress user who activates it, your site's address, title and language, and your WordPress, PHP, Offloft Pro and Freemius SDK versions. Freemius uses these to manage your license, updates and billing.
Your media, your cloud credentials and your alert settings are never sent to Freemius. Alerts go only to the channels you set up.
Keys for one bucket
Each setup guide shows how to create a key that reaches one bucket, with only the permissions Offloft needs. Pro's automatic setup creates exactly that, using temporary access that it never saves.
Public files
Visitors have to be able to load your media, so files you offload can be read by anyone who has their address. Keep paid or private files out of your bucket, using exclusions.
Reporting a security issue
Email security@offloft.com, with what you found and how to reproduce it. Please give us time to fix it before you share it publicly.
This website
This site sets no cookies, and its analytics are cookieless. Your browser may remember small preferences on your own device, such as dark mode. See the privacy policy.
Your media, in your bucket, checked.
Install Offloft free. Setup takes five steps, and nothing moves until the connection test passes.