What the Plugin Stores

What the Plugin Stores

Short version: your settings, and a table of rate-limit counters. No questions, no answers, and nothing that identifies a visitor.

In the options table

Option	Holds
ai_fq_provider	Which provider is selected
ai_fq_ollama_url, ai_fq_ollama_model	Ollama settings
ai_fq_hf_token, ai_fq_hf_model	Hugging Face settings
ai_fq_openai_endpoint, ai_fq_openai_key, ai_fq_openai_model	OpenAI-compatible settings

The two credential options are the only sensitive values, and you can keep them out of the database entirely with constants — see Keeping API Keys Out of the Database.

In its own table

One table, created on activation, named ai_fq_rate_limits with your site's prefix. Three columns:

• a bucket key — an HMAC hash, not a readable address
• a window start — a timestamp rounded to the minute
• a request count — an integer

The bucket key is a one-way hash of the visitor's IP address (and, for the finer bucket, their User-Agent) salted with your site's WordPress auth salt. It is not reversible and it is not comparable across sites. Nothing in this table records what anyone asked or answered.

Rows older than a day are deleted hourly by a scheduled task, and each request clears its own stale windows.

In transients, briefly

When a question is generated it is stored in a WordPress transient for ten minutes, keyed by a hash of the question token. That record holds the question, the hint, the punchline, and a hashed fingerprint used to check the same visitor is the one submitting the answer.

Once the punchline has been revealed, the record's lifetime is shortened to two minutes — just long enough that a duplicate submission gets a clear "already answered" response rather than a confusing "expired" one — and then it is gone.

Depending on your setup, transients live in the options table or in a persistent object cache. Either way they expire.

What is never stored

• Questions, beyond the ten-minute transient
• Visitors' answers. An answer is echoed back in the same response and written nowhere
• IP addresses in readable form. Only salted hashes, in the rate-limit table
• Any account, profile, cookie or tracking identifier. The widget sets no cookies and requires no login

What leaves your server

One outbound HTTP request per question, to the provider you configured. It contains the plugin's fixed prompt, a randomly chosen topic and angle to vary the output, and your API credential — nothing about the visitor.

Visitors' answers are never sent to the AI provider. The answer is compared and echoed locally; the punchline was already generated when the question was made.

If you self-host with Ollama, nothing leaves your network at all.

For a privacy policy

You may want to say something like:

This site uses AI Fun Questions, which generates a technology riddle on request by sending a prompt to [your provider]. No personal data is included in that request, and answers typed into the widget are not stored or transmitted to the AI provider. The plugin records short-lived, salted request counts for rate limiting; these cannot be traced back to an individual.

Adjust to name your provider and to match your own legal advice — this is a description of the plugin's behaviour, not legal wording.

On deletion

Deleting the plugin removes its files, but not the settings or the rate-limit table — there is no uninstall routine. To remove everything, drop the ai_fq_rate_limits table and delete the options beginning ai_fq_.