Skip to content

Add privacy policy content registration #869

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
masteradhoc merged 5 commits into from
Jul 31, 2026
Merged

Add privacy policy content registration #869

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cbcbe8a
Add privacy policy content registration via wp_add_privacy_policy_con…
masteradhoc Apr 5, 2026
4399693
add since versions
masteradhoc Apr 16, 2026
3dff9de
adjust per accurate feedback
masteradhoc Apr 18, 2026
d089a38
update privacy content text
masteradhoc Jun 29, 2026
64606c9
Merge branch 'master' into 868-privacy-policy-content
masteradhoc Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 44 additions & 2 deletions class-two-factor-core.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,7 @@ public static function add_hooks( $compat ) {

add_action( 'login_enqueue_scripts', array( __CLASS__, 'login_enqueue_scripts' ), 5 );
add_action( 'admin_init', array( __CLASS__, 'trigger_user_settings_action' ) );
add_action( 'admin_init', array( __CLASS__, 'add_privacy_policy_content' ) );
add_filter( 'two_factor_providers', array( __CLASS__, 'enable_dummy_method_for_debug' ) );

// Add Settings link to plugin action links.
Expand Down Expand Up @@ -424,7 +425,7 @@ private static function add_error( WP_Error $error ) {
/**
* Attach Two-Factor profile errors to WordPress core profile update errors.
*
* @since NEXT
* @since 0.16.0
*
* @param WP_Error $errors WP_Error object passed by core.
*
Expand Down Expand Up @@ -2596,5 +2597,46 @@ public static function filter_session_information( $session, $user_id ) {

return $session;
}
}

/**
* Adds suggested privacy policy text for the plugin.
*
* @since 0.17.0
*/
public static function add_privacy_policy_content() {
if ( ! function_exists( 'wp_add_privacy_policy_content' ) ) {
return;
}

$content =
'<p class="privacy-policy-tutorial">'
. __( 'The Two Factor plugin stores authentication data for your account on this website to verify your identity at login. No data is transmitted to third parties. The suggested text below covers what is stored, why, and for how long.', 'two-factor' )
. '</p>'

. '<h3>' . __( 'Two-factor authentication data', 'two-factor' ) . '</h3>'
. '<p>'
. __( 'To protect your account we store the following personal data:', 'two-factor' )
. '</p>'
. '<ul>'
. '<li>' . __( '<strong>TOTP secret key</strong> – a unique cryptographic secret generated when you set up an authenticator app. It is stored in your user profile.', 'two-factor' ) . '</li>'
. '<li>' . __( '<strong>Backup codes</strong> – a set of one-time-use codes you can store offline. Hashed copies are kept in your user profile until they are used or regenerated.', 'two-factor' ) . '</li>'
. '<li>' . __( '<strong>Email address</strong> – your account email is used to send a one-time passcode when the email provider is active. The code itself is not stored after the login attempt concludes.', 'two-factor' ) . '</li>'

@georgestephanis georgestephanis Jun 29, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the plugin actually storing the email address, or are we just using what WordPress core already stores?

Not sure if this is something we'd need to include.

@masteradhoc masteradhoc Jun 29, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah good point to make that more clear @georgestephanis. i've updated it now. Does this sound better?

@dknauss dknauss Jul 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Much clearer!

. '<li>' . __( '<strong>Enabled providers list</strong> – a record of which two-factor methods you have activated (e.g. TOTP, email, backup codes) is stored in your user profile.', 'two-factor' ) . '</li>'
. '</ul>'

. '<h3>' . __( 'Who we share your data with', 'two-factor' ) . '</h3>'
. '<p>'
. __( 'Two-factor authentication data is never shared with or transmitted to any third party. All data remains on this website.', 'two-factor' )
. '</p>'

. '<h3>' . __( 'How long we retain your data', 'two-factor' ) . '</h3>'
. '<p>'
. __( 'Authentication data (secret keys, backup codes, provider settings) is retained for as long as your user account exists. It is deleted automatically when your account is removed.', 'two-factor' )
. '</p>';

wp_add_privacy_policy_content(
'Two Factor',
wp_kses_post( wpautop( $content, false ) )
);
}
}
Loading