External services and privacy

A Themeasy site contacts another server only for a reason you can point to: you activate a license, install the required plugins, import the demo, receive an update, or use a feature that loads content from a third party. This page lists every case — who receives what, when, and what you control — so you can describe it in your own site's privacy policy.

The requests come from two places:

• Your server — license activation, plugin installs, the demo import, updates and the Themeasy Library. Your visitors aren't involved. As with every request WordPress makes, the standard User-Agent header carries your site's address.
• Your visitors' browsers — fonts, maps and videos. The service sees each visitor's IP address and browser details, as with any resource loaded from another server.

At a glance

Before you activate a license

Nothing goes out. The theme and the Themeasy plugin each include the Freemius SDK — Freemius is the licensing and payments platform Themeasy sells through — and both run it in anonymous mode: until a license is activated, it sends nothing, and the theme shows no opt-in screen. The theme has no analytics or tracking of its own.

Theme Setup → License

The first step of the setup wizard is the only place where your license and personal details leave the site.

With an Envato purchase code

When you click Activate License, your server sends the Themeasy Hub (POST https://hub.themeasy.co/api/v1/bridge/envato):

• your purchase code;
• your site's domain (lowercase, without www.);
• your Full Name and Email Address — only with the consent box ticked. The wizard doesn't activate a purchase code until you tick it, because your license is created under that email.

Themeasy then checks the code with Envato and registers your license with Freemius under that name and email, as the consent text says, and sends back your license key with a download link for the Themeasy plugin. Your site never contacts Envato itself. The site then activates that license key with Freemius — see what Freemius receives.

The purchase code is kept in your site's database, where Envato asks themes to keep it. If you switch to another theme and later activate this one again, the stored code goes back to the Hub with your domain — without your name or email — to re-activate the license. That happens only when the theme is activated, never on an ordinary page load, so a site you release in the Hub stays released.

With a Themeasy license key

A license key bought on themeasy.co goes straight to Freemius through the theme's built-in SDK (see below). Your server then sends the key and your domain to the Themeasy Hub (POST https://hub.themeasy.co/api/v1/plugin/update-check) to fetch the Themeasy plugin's download link. There are no name or email fields: the key already belongs to your account.

What Freemius receives

When a license is activated, the SDK registers your site with Freemius (api.freemius.com) and sends:

• the license key;
• your site's address and a unique site ID;
• the theme's version, whether it's active, and the SDK's version;
• your WordPress and PHP versions, and your site's title and language;
• the name and email of the WordPress user who clicked Activate License — with a license key too, not only with a purchase code (Freemius links the site to the account the license belongs to).

After that, the SDK checks the license about once a day with the same site details, and the wizard re-checks it every few seconds while it's open — that's how a site you release in the Hub drops back to the activation form. The SDK doesn't send the list of your plugins and themes. Releasing a site in the Hub frees its license; the site stays known to Freemius, which is how it learns about the release.

The Themeasy plugin has an SDK of its own, which connects only when a plugin license is activated: a Widgets, Pro or Agency license, or the Pro or Agency key the wizard hands on to the plugin. On a theme license alone, the plugin's SDK stays in anonymous mode.

Theme Setup → Plugins

• Themeasy downloads from the Themeasy Hub, through a signed link that your license authorizes, that works once and expires within minutes.
• Elementor and Contact Form 7 — and WooCommerce on a store theme — install from WordPress.org, through WordPress's own installer (the theme uses the TGM Plugin Activation library). A store theme's optional, recommended plugins also come from WordPress.org, and only if you install them from the reminder on the Plugins screen.

Once installed, each plugin follows its own rules: Elementor, Contact Form 7 and WooCommerce describe their own external services in their documentation.

Theme Setup → Import

The demo's pages, menus and settings ship inside the theme. Only the images are downloaded, from the theme's public demo at {theme}.themeasy.co — prio.themeasy.co for the Prio theme, for example. The importer fetches over HTTPS only and refuses any file on another host. Nothing about your site is sent beyond the image requests themselves.

Updates

• The theme asks Freemius for new versions during WordPress's regular update checks, while its license is active. See updating the theme.
• The Themeasy plugin, on a theme license, asks the Themeasy Hub instead. It sends your domain, the theme's license key, the installed plugin version and a random install ID the plugin creates once (the first check registers that ID with the Hub). The answer is cached for six hours, and each download uses a fresh signed link. With a plugin license of its own (Widgets, Pro or Agency), the plugin updates from Freemius.
• Envato Market — if you install Envato's own Envato Market plugin, it checks ThemeForest for theme updates with the token you give it. That's Envato's plugin and Envato's service; the theme only makes sure its updates stay visible next to the Freemius ones.

Fonts

Fonts are set in Themeasy → Typography, where each font role (Primary, Secondary, Accent) has a Font Source. See typography & fonts.

• Google Fonts (the default) — visitors' browsers load the stylesheet from fonts.googleapis.com and the font files from fonts.gstatic.com, so Google sees each visitor's IP address and browser details. Your server also asks Google's font service which weights each family offers (just the family name), when you save the settings and occasionally in the background. With a Google Fonts API Key, your server fetches Google's full font list with your key while you work in the Typography settings.
• Adobe Fonts (Typekit) — only once you enter an Adobe Typekit ID. Visitors' browsers then load your kit from Adobe (use.typekit.net and p.typekit.net), and your server reads the kit to list its fonts in the settings.
• Custom Fonts (Upload) — fonts you add to the WordPress Font Library (Appearance → Fonts) or with the Custom Fonts plugin are served from your own server. Nothing external.

Elementor's local Google Fonts option

Elementor has its own option to load Google Fonts from your server. It applies to the fonts Elementor requests itself — a family you pick directly on a widget, for example. The families set in Themeasy → Typography are loaded by the Themeasy plugin from Google, which skips Elementor's copy of them so a font never loads twice. So Elementor's option doesn't keep those fonts on your server: to serve them yourself, choose Custom Fonts (Upload) and add the font files to the Font Library.

The Themeasy Library

The Themeasy Library in the Elementor editor sends nothing until you click its button. While it's open, your server requests the catalog from cms.themeasy.co — the categories and tags, and the template list with the filters and search words you choose — and, when you insert a template, its content. On a Pro or Agency plan, the insert request also carries your plugin license's ID and key, in request headers, so the Library can serve Pro templates.

Your browser loads the preview images from the addresses the catalog returns, and an inserted template may use images hosted on cms.themeasy.co until you replace them. Templates bundled with your theme insert from the theme's own files, with no request to the Library.

Widgets that load third-party content

These load something from another service only on pages where you place them.

• Maps — loads the Google Maps JavaScript API from maps.googleapis.com in the visitor's browser, with the API key you enter in the widget. Google sees the visitor's IP address, and the key is readable in the page, as with any Google Maps embed — restrict it to your domain in the Google Cloud Console. Without a key the widget shows a placeholder and loads nothing.
• Video (and the video lightbox of the Button widget):
  • YouTube — with no custom poster image, the visitor's browser loads the thumbnail from i.ytimg.com when the page loads. The video plays from youtube-nocookie.com, YouTube's privacy-enhanced mode. In the lightbox, YouTube's player script also loads from www.youtube.com, and the lightbox player asks noembed.com, an independent oEmbed service, for the video's title.
  • Vimeo — the player loads from player.vimeo.com only after the visitor presses play, with Do Not Track enabled (in the lightbox, when the lightbox opens).
  • The player itself is served from your site, and a self-hosted video contacts nobody.
• Social Share Row — plain links to X, Facebook, LinkedIn and WhatsApp, plus email and Copy Link. Nothing loads from those networks; when a visitor clicks one, that network receives the page's address (and the share text you set). Social Profiles is plain links too.

What stays on your site

• No tracking. The theme and the plugin send no analytics, and the Freemius SDK doesn't send your list of plugins and themes.
• No SDK screens or notices. The Freemius SDK's own admin notices, account and pricing screens are hidden; your license, its sites and renewals live in the Themeasy Hub. The theme also turns off the SDK's "why are you switching?" survey. When you deactivate the Themeasy plugin, an optional form asks why — you can skip it, and on a site without a plugin license an answer stays anonymous unless you untick Anonymous feedback.
• No redirected traffic. The theme and the plugin send their Themeasy Hub requests only to themeasy.co over HTTPS; a setting or code snippet that points them anywhere else is ignored.

WordPress and your other plugins

Not part of Themeasy, but worth knowing for your privacy policy:

• Avatars — comment and author avatars come from Gravatar, WordPress's own avatar service. Turn them off under Settings → Discussion → Show Avatars.
• Elementor, WooCommerce, Contact Form 7 and any plugin you add run their own services — check each one's documentation.

What you control

Privacy policies

• Themeasy — what Themeasy does with the data that reaches the Hub and the Library: themeasy.co/privacy
• Freemius — freemius.com/privacy
• Google (Fonts, Maps, YouTube) — policies.google.com/privacy
• Vimeo — vimeo.com/privacy

Questions about your data? Open a ticket or email help@themeasy.co.