Geckada

Geckada brings monitoring, backups and maintenance into one WordPress plugin.

• See site health, errors and backup status in your Geckada account.
• Back up your files and database locally, to Google Drive, Backblaze B2 or an S3-compatible service. Cloud backups go directly from WordPress to your chosen provider.
• Choose optional encryption and keep your recovery key safe. Keep every part of a backup set together to restore it.
• Update plugins, themes and WordPress after Geckada makes a verified safety backup. Approved remote updates can roll back automatically if checks fail.
• Add optional light or dark admin branding, and adjust comments, emoji assets and revisions in Site Tuner.

Local backup and restore work without a Geckada account. To use hosted monitoring or remote management, open Geckada > Overview, select Connect to Geckada and approve the site. The plugin contacts Geckada only after you connect it or save a connector token. See External services and Privacy below for details.

External services

Geckada

The plugin contacts https://geckada.au only after an administrator connects the
site or manually saves a connector token. It sends the monitoring and backup
status and maintenance progress listed in the Privacy section to provide the
Geckada monitoring and maintenance service. Heartbeat responses can contain managed
backup settings and requests, approved maintenance updates, or automatic rollback
commands as described in the FAQ. Easy Google Drive connection also sends authorization
requests and the selected folder ID/name to Geckada. Geckada stores an encrypted Google
refresh token and issues short-lived access tokens to the authenticated website.
Geckada does not receive backup archives, object-storage secrets, or recovery keys.

When you submit Contact Geckada, your topic, message and reply email are saved in
Geckada’s support inbox and linked to your connected project. An email notification
is sent by Geckada, not by WordPress. WordPress, PHP and Geckada version numbers are
included only if you select the optional technical-details checkbox.

Geckada privacy policy: https://geckada.au/privacy
Geckada terms: https://geckada.au/terms

Google Drive

After an administrator selects Connect Google Drive, Geckada handles Google consent
and folder selection. Authorization codes and tokens pass through Geckada; backup
files upload directly from WordPress to Google. Disconnect removes this website’s
Geckada grant without deleting Drive files or disconnecting other websites. You can
also revoke Geckada in your Google account permissions.

Advanced setup uses your own Google application with tokens held in WordPress.
Both modes use
https://accounts.google.com for authorization, https://oauth2.googleapis.com for
OAuth token exchange and revocation, and https://www.googleapis.com for Drive
file operations. OAuth identifiers, authorization codes, access and refresh
tokens, backup archives, filenames, sizes, checksums, and plugin-created folder
metadata are sent directly to Google as required to store, list, download, and
remove retained backups in the administrator’s Drive account.

Google privacy policy: https://policies.google.com/privacy
Google terms: https://policies.google.com/terms

Backblaze B2 and S3-compatible storage

The plugin contacts an object-storage service only after an administrator saves
its HTTPS endpoint and credentials. It sends signed S3 API requests, the access
key identifier, backup archives, filenames, sizes, and storage metadata directly
to that endpoint to test the connection and to store, list, download, and remove
retained backups. The secret key remains stored encrypted in WordPress and is
used locally to sign requests. Supported services include Backblaze B2, Amazon
S3, Cloudflare R2, Wasabi, DigitalOcean Spaces, and other administrator-selected
S3-compatible services. Use of a configured service is governed by that
provider’s terms and privacy policy.

For Amazon S3, the standard API endpoint is https://s3.amazonaws.com. An Amazon
Web Services account, an S3 bucket, an access key ID, and a secret access key are
required. Administrators must explicitly enter their provider’s HTTPS endpoint;
the plugin does not prefill or contact one merely by being activated or viewed.
Requests begin only after an administrator saves the destination and explicitly
tests it or runs a backup, recovery, retention, or restore operation. This is an
optional storage API integration, not a source of remotely loaded JavaScript,
CSS, images, fonts, or executable code.

Backblaze privacy: https://www.backblaze.com/company/policy/privacy
Backblaze terms: https://www.backblaze.com/company/policy/terms-of-service
AWS privacy: https://aws.amazon.com/privacy/
AWS service terms: https://aws.amazon.com/service-terms/
Cloudflare privacy: https://www.cloudflare.com/privacypolicy/
Cloudflare terms: https://www.cloudflare.com/terms/
Wasabi privacy: https://wasabi.com/legal/privacy-policy
Wasabi terms: https://wasabi.com/legal/terms-of-use
DigitalOcean privacy: https://www.digitalocean.com/legal/privacy-policy
DigitalOcean terms: https://www.digitalocean.com/legal/terms-of-service-agreement

Privacy

When connected and enabled, the plugin sends data to https://geckada.au. Data can
include health heartbeats; WordPress, PHP, theme and plugin names and versions;
active plugin status; fatal error messages, file locations, line numbers and the
affected URL; database error messages; backup state, progress, filenames, sizes
and destination labels; maintenance command identifiers, update and rollback
progress, results and backup filenames; failed email events; and supported
scheduled-task failures.

The plugin does not intentionally send passwords, cookies, form contents,
database records, WordPress users, visitor IP addresses, backup archives, object-storage
credentials or recovery keys. Easy Google Drive connection stores encrypted Google
authorization credentials and destination metadata on Geckada. Review Geckada’s privacy policy at
https://geckada.au/privacy and terms at https://geckada.au/terms.