---
title: Skyboot AI Markdown Security and Privacy
description: "What Skyboot AI Markdown stores, what it sends to third parties, and how it protects private content, export files, API keys and admin actions."
url: "https://skybootstrap.com/docs/skyboot-ai-markdown/security-privacy/"
canonical_url: "https://skybootstrap.com/docs/skyboot-ai-markdown/security-privacy/"
date: "2026-10-24T21:01:58+06:00"
modified: "2026-10-24T21:01:58+06:00"
author: Skybootstrap Team
type: article
site: SkyBootstrap
language: en-US
---

# Skyboot AI Markdown Security and Privacy

Skyboot AI Markdown only makes public what your site already shows to logged-out visitors, stores no visitor IP addresses or cookies, and sends data to third parties only for the features you use: IndexNow, crawler IP list downloads and AI fixing. This page lists exactly what is stored and sent.

## What does the plugin make public?

- Markdown versions exist only for content a logged-out visitor can already see. Drafts, private posts and pending posts return “not found”.
- Password-protected posts never expose their content through Markdown, `llms.txt`, `llms-full.txt`, archive summaries, meta descriptions or JSON-LD.
- Posts set to noindex, hidden products and cart, checkout and account pages are left out of `llms.txt`.
- Content types you untick under **AI Visibility > Settings > Content types** get no Markdown version and no `llms.txt` entry.

## What data does the plugin store?

| Data | Where | Personal data? |
| --- | --- | --- |
| Settings | WordPress options | No |
| IP addresses you exclude from analytics | WordPress options (plugin settings) | Only the addresses you enter yourself |
| AI analytics: date, crawler or assistant name, page path, hit count | Its own database table | No IP addresses, cookies or user IDs |
| Citation Readiness scores and scan exclusions | Post meta | No |
| Permissions for roles and people | WordPress options | User IDs of the people you add |
| AI provider API key | WordPress options, administrators only | It is a secret, so keep admin accounts secure |
| Markdown cache | `wp-content/cache/skyboot-md/` | No |
| Export files | `wp-content/uploads/skyboot-ai-md-exports/`, deleted after download or after 1 hour | Contains your exported content |

Analytics data is deleted automatically after the retention period (default 90 days).

## What data is sent to third parties?

| Destination | When | What |
| --- | --- | --- |
| IndexNow (api.indexnow.org) | When content is published, updated or removed, if IndexNow is on | Public URLs of your site and your IndexNow key |
| OpenAI, Google, Bing, Perplexity, Apple, DuckDuckGo, Cloudflare | Once a day, if analytics is on | Nothing is sent. Their public crawler IP lists are downloaded |
| Your AI provider (Anthropic, OpenAI, Google, OpenRouter) | Only when someone clicks **Generate**, **Generate fix**, **Write with AI**, **Fetch models** or **Test connection** | The page being fixed (as Markdown) and the instructions. For **Write with AI**: your site name, tagline, page and post titles and category names |
| ChatGPT, Claude, Gemini, Copilot, Perplexity | Only when an editor clicks one of those buttons in Review & Fix | Opens the assistant in that editor’s own browser with the page content |

Nothing is sent to the plugin author.

## How does the plugin protect your site?

- **Access control.** Every admin action checks a WordPress security token ([nonce](https://developer.wordpress.org/apis/security/nonces/)) and the feature permission set under **AI Markdown > Permissions** (see [Permissions](https://skybootstrap.com/docs/skyboot-ai-markdown/permissions/)). Fixing a post also requires permission to edit that post. Only administrators can change permissions and the AI API key.
- **Protected folders.** The cache and export folders block direct web access (`.htaccess` for Apache and LiteSpeed, `web.config` for IIS) and directory listing.
- **Safe requests.** The AI & Markdown Checker only requests URLs on your own site and does not follow redirects.
- **Safe imports.** Post type, status and author are validated, and ZIP imports are size-limited.
- **Database.** All queries use prepared statements.
- **Output.** All admin screens escape their output. Markdown and text endpoints are served with `X-Content-Type-Options: nosniff`.
- **AI updates** go through WordPress’s normal content filters and always create a revision.
- **Analytics endpoint.** The public endpoint that counts visitors from AI only accepts real pages on your site, counts each visitor once per page per day and has hourly and daily limits.
- **Your own IP.** The “Exclude my IP” button reads your address from the request on the server. It never trusts an address sent by the browser.

## What do I need to add on Nginx?

Nginx ignores `.htaccess` files. If your site runs on Nginx, add this to your server configuration:

```
location ~* /wp-content/(cache/skyboot-md|uploads/skyboot-ai-md-exports)/ {
deny all;
}
```

## What happens when I uninstall the plugin?

Under **Settings > Remove Data on Uninstall**, choose whether deleting the plugin also removes its settings, analytics table, readiness scores, permissions, API key and server rules. When this is off, your data stays in case you reinstall. Deactivating the plugin never deletes data, and WordPress roles are never modified.

## How do I report a security issue?

Please report security issues privately through our support contact, not in public forums.

## FAQ

### Does Skyboot AI Markdown store visitor IP addresses?

No. Crawler visits are verified by IP at the moment they happen, and only the date, crawler name, page path and hit count are stored. The only IP addresses saved are the ones you add to the analytics exclusion list yourself.

### Can password-protected or private posts leak through the Markdown version?

No. Drafts, private and pending posts return “not found”, and password-protected posts never show their content in Markdown, `llms.txt`, `llms-full.txt`, summaries, descriptions or JSON-LD.

### Is my AI API key safe?

The key is stored in your WordPress database, visible only to administrators, never sent to the browser and only sent to the provider you chose. Anyone with administrator access or database access can read it, so protect those accounts.

### Does the plugin send my content to AI companies?

Only when someone clicks a button that asks for it: **Generate**, **Generate fix** or **Write with AI** send the page to your chosen provider, and the ChatGPT, Claude, Gemini, Copilot and Perplexity buttons open those services in the editor’s browser. Nothing is sent in the background.