Terms
These terms describe the plugin and Hub service boundaries, your responsibilities, account access, and what account deletion covers.
The Awthy plugin adds second-factor and passkey sign-in, recovery, and security reporting to your own WordPress and WooCommerce installation. It runs on your hosting, under your control, and it is licensed under the same copyleft terms recorded in the public repository.
The Hub is a hosted service for the parts that need to live outside one site: verifying licences, receiving audit exports, coordinating recovery points, and reporting across several installations. It is provided as a service rather than as distributed software.
Your data is not sold, and it is shared only with the providers needed to run the service or when the law requires it. After account deletion, account-owned content is scheduled for destruction; the required compliance record and limited ownership and deletion metadata remain.
Managed reporting and Google Drive connections are optional. Each one is enabled deliberately from your own account, and you can remove a destination without affecting the rest of the account.
Store your recovery codes somewhere safe and keep at least one administrator able to sign in. Awthy can lock a sign-in path down, but it cannot recover a password you have lost on your own hosting.
Backup copies contain sensitive site files and database content. Point them at storage you control, keep its credentials private, and grant only the access each destination needs.
Use Awthy only on sites you are authorised to administer, and do not use it to access data or installations you have no permission to reach.
The Hub signs you in with a short-lived email link. Anyone who can read that mailbox can complete the sign-in, so treat the address on the account as a security boundary.
Company owners control who joins, what role they hold, and which sites they can reach. Sensitive access changes require a recently verified sign-in.
Where a capability requires a licence, its entitlement is checked through the licensing integration. See the pricing page for the current offer and availability; proposed packaging is not an entitlement.
The Hub is operated on a best-effort basis with published health checks. Hub-backed capture and recovery depend on its availability. An already downloaded complete backup can use the separate offline restore workflow, subject to that workflow's prerequisites.
Features may change as the product develops. Material changes to how data is handled are reflected here and in the privacy page before they take effect.
You can delete your company account from the Hub. Every session is signed out, and after a short cooling-off period, destruction of your Awthy-managed backups, recovery points, and account-owned credentials is scheduled. Failed removals are retried. The required compliance record and limited ownership and deletion metadata remain. Shared install credentials remain while another account needs them or its destruction is unfinished. Copies in storage you control are not deleted by Hub account deletion. You can also stop using the plugin and uninstall it; that is separate from deleting a Hub company account.
Questions about these terms, a data request, or a security report can go to the same mailbox. Contact Awthy and include only what is needed — never a password, recovery code, or live credential.
