Hatch privacy and third-party services
Which external services Hatch Connect contacts (Cloudflare API, Turnstile, Google Fonts), what data is sent and when, and what Hatch stores in your database.
Last updated October 29, 2026
Hatch has no Hatch server and no tracking. It contacts only the services below, each only for the stated purpose and after you set it up.
Services contacted
| Service | When | Data sent |
|---|---|---|
| Cloudflare API (api.cloudflare.com) | Only while you Check token, Deploy or Redeploy, or use the pickers in the setup guide. | Your API token, the frontend files, a script name, your site’s REST address and the Worker secrets (frontend account and cache-refresh secret). With a custom domain, zone and route settings too. |
| Cloudflare Turnstile (challenges.cloudflare.com) | Only after you turn it on and add keys. | The visitor’s response token and IP address when available, with your secret key. The browser loads the widget script. |
| Your own frontend address | After you save it. | A periodic HEAD request, a cache-refresh request when content changes, and a test request. The refresh secret is in a request header. |
| Google Fonts | Page views of the deployed frontend. | Visitors’ browsers request font files, so Google receives their IP address and browser details. |
Optional services in the frontend
Only when you switch on the matching feature: Google Tag Manager and Google Analytics (with a container ID), Cloudflare Web Analytics (if you enable it in Cloudflare), YouTube videos in your posts (shown through youtube-nocookie.com only when a post contains one), and Stripe and PayPal payment fields (if you enable those gateways in WooCommerce).
Not contacted
Hatch does not send usage statistics, does not check a Hatch server for updates and has no tracking. Plugin updates come from WordPress.org.
What Hatch stores on your site
- Form submissions: field values, form and provider name, the visitor’s IP address and browser user agent, in the table
wp_hatch_form_submissions(your prefix may differ). Entries older than 90 days are deleted automatically. Change the period with thehatch_form_retention_daysfilter, or return 0 to keep entries. Hatch has no personal-data export or erasure tool for this table yet, so delete matching rows to answer a data request. - Comments are normal WordPress comments.
- Your Cloudflare token and frontend account password, encrypted, so you can redeploy without pasting again. Disconnect forgets them.
Removing your data
Use Disconnect on the Connection tab, then see the “Remove all data on uninstall” switch in Security hardening.