Does any of my data leave my server?

The short answer

No. Merchgain makes no outbound connections at all — no account, no sign-up, no licence check, no usage statistics, no update ping of its own, no fonts or scripts from a CDN.

The one exception is your own choice. From version 0.2.6 an AI assistant you connect to your store can read the report through Merchgain’s read-only abilities, and the figures it asks for go to that assistant — see answers for AI assistants. Merchgain itself still sends nothing.

The report is SQL against your own database, rendered in your own admin. Your cost prices and margins are among the most sensitive numbers in a shop, and the simplest way to keep them private is to never send them anywhere.

What WooCommerce actually does

Nothing here is a WooCommerce behaviour — it is a choice about how a plugin is built, and the reason it needs saying is that the norm in this category is the opposite. A hosted analytics service has to receive your orders to report on them. A licensed plugin usually phones home to validate a key. A plugin funded by data collection sends “anonymous usage statistics” that include your revenue.

WordPress itself contacts wordpress.org for plugin updates. That is the WordPress updater, for every plugin you have installed, and it is not something Merchgain does or can switch off.

What to do about it

Verify rather than believe. Three checks, none of which needs trust:

• grep the plugin folder for wp_remote_get, wp_remote_post, curl_ and file_get_contents and look at what comes back;
• watch the traffic — a request log or a firewall on a test site tells you exactly what a plugin reaches for when you open its screen;
• read the source. It is GPL, in full, and the report is a few thousand lines rather than a compiled bundle.

This is worth doing for any plugin that sees your money, not just this one.

How Merchgain reports it

The only things Merchgain stores are its own options and its cached results, both in your database. Uninstalling removes them.

The plugin has no settings page collecting anything, no opt-in prompt for statistics, and no banner asking to “help us improve”. There is nothing to opt out of, which is the point.