Privacy Statement

Last updated 21 September 2026. This statement covers leancms.au, the website you are reading. It also answers what the Lean CMS plugin itself does and does not send us, because that is the question people actually mean.

This website collects nothing about you. There is no form on it, no account to create, no newsletter sign-up, no analytics and no advertising or social tracking. Nothing you do here is recorded against you, because there is nothing here that records.

That is unusual enough to be worth saying plainly rather than burying in a page of conditional clauses. The rest of this page explains what that means, the two places where data unavoidably does travel, and what happens when you contact us.

To be specific, this site has:

• No forms. Every "get in touch" link on this site goes to piksoul.com, a different website. Nothing is submitted here.
• No analytics. No Google Analytics, no Tag Manager, no page-view counter of any kind. We do not know how many people read this page.
• No advertising or social tracking. No pixels, no remarketing tags, no embedded like buttons or share widgets that phone home.
• No cookies set for visitors. Nothing on this site asks your browser to store an identifier, which is also why you are not being asked to dismiss a cookie banner. Signed-in editors get a WordPress session cookie, as any WordPress site does.

Two things happen that involve a computer other than your own, and we would rather name them than claim a purity we do not have.

Server logs. Loading any page on the internet sends your IP address and browser type to the server answering. Our hosting keeps ordinary access logs for a short period for security and diagnostics. We do not analyse them to build a picture of you, and depending on where the site is hosted they may be held outside Australia.

Web fonts. This site loads two typefaces from Bunny Fonts (fonts.bunny.net), which we chose specifically because it is a privacy-first font service that does not log requests or set cookies. Your browser still makes a request to it, which means an IP address reaches that provider. If that matters to you, a content blocker will stop it and the site will fall back to your system typeface.

The moment you use one of our enquiry links you leave this site. The form is on piksoul.com, and that site's privacy policy governs what you submit there — we are not going to restate it here, because a summary of someone else's policy is a second copy that drifts out of date.

What we can tell you is the shape of it. If you enquire, we will hold what you send us — typically a name, an email address, an organisation and whatever you write — for as long as we need it to answer you and, if you become a client, for as long as we are required to keep business records. We do not sell it, we do not rent it, and we do not add you to a marketing list because you asked a question.

This is a question we get asked and it deserves a precise answer. Lean CMS runs on your own server. It does not send us your page content, your editors' details, or anything about your visitors. There is no telemetry and no usage reporting.

What it does do is check for updates, the same way every WordPress plugin does. On WordPress's normal schedule, your site asks our update service whether a newer build exists. That request tells us:

• which product and version you are running;
• your site's address. WordPress puts it in the user-agent header of every request it makes on your behalf — this is WordPress's own behaviour, not something we added, and it applies equally to every update check your site performs against wordpress.org;
• and, only if a licence has been activated, the licence key and a one-way (SHA-256) hash of that address, so we can confirm the licence covers the site.

A site with no licence entered still makes that check — it simply sends no key and is told it is up to date. We are not going to claim otherwise: the request happens either way.

Separately, activating a licence makes a one-time registration request that records the site's address in plain text against your licence, so that you can see which of your sites holds which activation. That one is deliberate and it is for your benefit, but it does mean the address is stored readably in our licence records rather than only as a hash.

None of the above carries page content, visitor information, or anything about who is logged in.

We are an Australian business and we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

In practice that means you may ask us what personal information we hold about you, ask us to correct it if it is wrong, and ask us to delete it where we are not required to keep it. Ask, and we will tell you — there is no form to fill in and no fee.

If you are not happy with how we have handled your information, tell us first and give us a fair chance to put it right. If you are still not satisfied, you can take a complaint to the Office of the Australian Information Commissioner at oaic.gov.au.

If personal information we hold is lost or accessed without authorisation, and it is likely to cause you serious harm, we will tell you and notify the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme.

If you think you have found a security problem on this site or in the plugin, please tell us privately at [email protected] rather than posting it publicly, and we will work with you on it.

This is a site about software, sold to organisations. It is not aimed at children and we do not knowingly collect anything from them. Several of our clients are schools, and we are conscious that a school site may carry information about students — that information lives on the school's own site and belongs to the school, not to us.

If this site ever starts collecting something — a form of its own, or analytics — this page will be rewritten before that goes live, not afterwards, and the date at the top will change. A privacy page that describes a site as it used to be is worse than none.

Questions about privacy, or a request about your own information? Get in touch, or email [email protected].