Privacy, licence and updates

Darwin AI runs inside your WordPress site. This page lists every time it sends information off your site, what is sent and why. It also explains the licence key, how updates are checked before they are installed, and what Darwin AI keeps on your site.

At a glance

Sent to	When	What
Darwin Labs (api.darwin-labs.co.uk)	When you activate or deactivate a licence key, and once a day after that	Licence key, site address, Darwin AI version
Darwin Labs	Update checks, while the licence is valid	Licence key, site address, Darwin AI version
Darwin Labs	Only when you send feedback	Your message and the fields listed below
Darwin Labs	Only if you switch on tool reports, and an agent sends one	The report, cleaned of secrets and email addresses, and the fields listed below
Your AI provider	When you use the chat	Your conversation and the tool results it needs
Figma, Google Fonts, jsDelivr, IndexNow, another Darwin AI site	Only when a tool that needs them is used	See Other services

All requests to Darwin Labs use HTTPS. The licence key travels inside the request, never in a web address.

The licence key

The licence key turns on updates from Darwin Labs. That is all it does. Darwin AI keeps working without a key; it simply stops offering new versions.

• One key covers a few sites. Deactivating a site frees its place for another.
• After activation, the key is checked once a day. Each check sends the key, your site address, the Darwin AI version and the product name (darwin-ai).
• If Darwin Labs cannot be reached, the last good answer stands for a grace period, 7 days by default, so a short outage does not stop your updates. Darwin Labs can set a different grace period.
• If Darwin Labs says the key is revoked, expired, unknown or over its site limit, updates stop at once. The settings say why.
• After you enter the key, the panel only ever shows its last four characters.

Adding or removing a key

1. Open the Darwin AI panel and click the Settings (cog) button.
2. Choose the Global tab, then Licence and updates.
3. Enter the key under Licence key and click Activate. If you do not have one, use the Get a key link.
4. To remove the key from this site, click Deactivate this site, then click Click again to deactivate within three seconds.

Under Updates, Check now asks Darwin Labs straight away. Otherwise the answer is reused for up to 12 hours. When a new version is offered, What's new shows the changelog and Update to installs it. Updates also appear on the normal WordPress Updates screen.

Signed updates

Every Darwin AI release is signed by Darwin Labs. Each release carries a list of every file with its fingerprint (a SHA-256 hash). That list is signed with Darwin Labs' private release key (an Ed25519 signature), which is kept offline. Darwin AI carries only the matching public key.

Before WordPress replaces any files, Darwin AI checks:

1. that the signature is genuinely Darwin Labs';
2. that every file in the package matches its fingerprint;
3. that no file is missing and no extra file has been added.

If any check fails, the update is refused and nothing is replaced. The settings show "The last update was not installed:" followed by the reason. The same check applies if someone uploads a Darwin AI zip by hand. The check needs PHP's sodium extension; without it, the update is refused rather than installed unchecked.

The download link comes from Darwin Labs at the moment of downloading, and only while the licence is valid.

Feedback

The Feedback button in the panel opens Send feedback to Darwin Labs. Nothing is sent until you click Send. It sends:

• the kind of feedback: Issue, Idea, Praise or Question;
• your message (up to 4,000 characters);
• a contact email, only if you type one;
• the Darwin AI, WordPress and PHP versions, the environment type (for example production) and your site address;
• your licence key, to identify the site. With no key, the site registers once with Darwin Labs using a random ID instead.

If a send cannot be confirmed and you try again, the same message is never counted twice.

Tool improvement reports

Agents can report a tool error, unexpected behaviour or a missing feature to Darwin Labs. This is off by default. To switch it on, go to Settings > Global > Reporting and turn on Send tool improvement reports.

When it is on, a report contains:

• a title, what happened, what was expected, the steps, the tool name and a category;
• the Darwin AI, WordPress and PHP versions, the environment type and your site address.

Before sending, the text is cleaned. Tokens, passwords, secrets, API keys, cookies and email addresses are replaced with a redacted marker. At most 20 reports an hour are sent from a site. An identical report reuses its ID for 7 days, so repeats are not counted twice. On the first report, the site registers with Darwin Labs using a random ID and receives a send-only credential. If your site address changes, reports stop until you reconnect by switching the setting off and on again.

Your AI provider (the chat)

The chat uses the AI provider you connect in WordPress (Settings > Connectors). Darwin AI stores no provider API key of its own: WordPress holds the connection. See Chat.

When you chat, the provider receives:

• your messages and the recent conversation (the oldest parts are dropped once it grows long);
• a short instruction naming your site, its address, your display name and the chat's permission level;
• the list of tools the chat may use;
• the results of the tools it runs, each cut to 6,000 characters. These can include content from your site.

When you set the chat up, Darwin AI also sends each provider one short test prompt. What the provider does with this information is set by your agreement with that provider.

Other services, only when a tool uses them

• Figma. When an agent converts a Figma frame into a page, Darwin AI downloads that frame's images from the Figma links the agent supplies.
• Google Fonts. In the same conversion, fonts are matched against Google Fonts and downloaded. The font list is cached on your site for a week.
• jsDelivr. When an Elementor build needs a Font Awesome icon that is not already in your media library, it is downloaded from the jsDelivr content network and then kept in your library.
• IndexNow. When an agent submits changed pages, the addresses go to IndexNow through Rank Math's own IndexNow module. Only addresses on your own site can be submitted.
• Another Darwin AI site. migrate_pull connects to the site address the agent gives, using a lease for that site. It requires HTTPS and does not follow redirects, so the lease reaches only that address.
• Addresses you supply. Uploading media from a web address, or importing a migration, downloads files from the addresses given.

Health checks, such as after activating a plugin or during a safe update, load your own site's pages. They do not contact anyone else.

What Darwin AI stores on your site

• No AI provider API keys.
• Your licence key and Darwin Labs' last answer about it.
• Handoffs and leases. Tokens are stored only as scrambled hashes. The copyable handoff connection is stored encrypted, so it can be copied again while the handoff is live.
• History, with secrets redacted, for 90 days. See History and access.
• Content and SEO snapshots for 7 days, and file backups (the newest 300). See Safety nets.
• Safe update snapshots for 7 days. These include a copy of your database, so they hold the same personal data your site does. They are kept in a protected folder with a name that cannot be guessed.
• Your chat conversation, saved to your own user account. New chat clears it. Chat usage (token counts and estimated cost) is kept for 90 days.
• Stored screenshots and mockups that agents save for visual comparisons, until they are deleted.

Deactivating and deleting

Deactivating Darwin AI removes the rewrite rule it adds on Apache servers and stops its scheduled tasks, including the daily History clean-up and licence check. Agents cannot use it while it is inactive.

This version has no uninstall clean-up. Deleting the plugin does not remove the data listed above. To free a licence place, click Deactivate this site before you delete the plugin.