Telemetry

CPlugin server plugins talk to one place: the CPlugin update service at update.cplugin.com. That connection delivers your licence and your trial, tells you about new versions and lets us see which versions run where. This page lists everything the connection carries and everything the update service records about it. A plugin sends nothing that is not listed here. Before a plugin starts sending something new, or the update service starts recording something new, we publish a new version of this list and notify licensees (see Changes to this list).

List version 1, 16 October 2026.

What you will see in your server journal

On every start a plugin writes one line to the trading server journal, so that nobody has to find this page by accident:

CPlugin: checking license and updates at update.cplugin.com. No client, account, trade or database data is sent. What is sent and why: https://cplugin.com/telemetry

When the plugin connects

• At start. A plugin with a valid paid licence connects 30 to 120 seconds after it starts; a new installation, a trial or a plugin without a valid licence connects at once, because its right to run depends on the answer.
• About once a day. Every installation has its own fixed time of day, chosen from its installation key, so that requests are spread over the day. The service may ask for an earlier contact (never sooner than 5 minutes), and while records of starts are still waiting to be delivered, the plugin contacts the service again about a minute after each successful contact.
• After a failure or a wake-up. After a failed attempt the plugin retries with growing pauses (15 minutes up to 6 hours); after the operating system wakes from sleep, a trial installation, or one that has had no answer from the service for more than a day, connects again at once.

The connection is HTTPS to update.cplugin.com, port 443. The update service never connects to your server — it only answers the plugin's own requests. There is no setting that turns the connection off: a paid licence keeps working until the end date of its file if the service cannot be reached, but a trial does not start without it.

What is sent

Each request is one signed message from the plugin to the service. Its content:

Besides the message, the service sees what any server sees:

• the IP address of the connection and the time of receipt (stored with every request);
• the User-Agent header, CPlugin-Hub/1 <product code>/<version>;
• when the plugin downloads an update: the download is recorded with the IP address, the User-Agent and the installation key (header X-Hub-Installation).

What is never sent

Accounts and their logins, groups, balances, credit, equity or margin. Trades, orders and positions. Quotes and price history. Data about your clients: names, addresses, documents, e-mail addresses, phone numbers. The trading server database and its files. Credentials of managers and administrators, passwords. Plugin settings (the one identifier described above is the only value taken from the configuration). Server journals. Files from your disk other than the plugin's own files. The protocol has no fields for any of this.

What the service sends back

Only a signed answer to that one request: the service time, information about a new version, a licence or trial file, a code for linking the server to your organization in Toolbox, and codes of messages for the server journal. The answer carries no commands and no program code that runs by itself. Where a plugin version supports automatic download (SlippageControl for MT4 3.00 does not), a new version is saved next to the plugin as <plugin>.dll.new, checked against a signed checksum, and is never loaded until you replace the file yourself.

Why we collect it

• Licence. To deliver and renew your licence automatically and to bind it to your server.
• Trial. A trial needs no registration. The trial period is counted on our side for each product and server (by owner and server name), so reinstalling does not restart it. See the trial terms on the SlippageControl page.
• Updates. To tell you about new versions and, where a plugin version supports it, deliver them as a verified file.
• Support. To see which versions run where and to detect a broken update.
• Protection against abuse. Limits on new installations per IP address, so that the service cannot be flooded.
• Protection of our software. To notice a copied installation key and to detect and investigate use of the plugin without a licence.

Where it is stored and for how long

The records are kept in the database of the CPlugin update service, which CPlugin operates on servers rented from Hetzner Online GmbH in Germany.

• Licensing and installation history — without a time limit, also after a licence or trial ends. This history is: installation keys, company and server names, the link of a server to a Toolbox organization and who made it, licence and trial numbers with their state and last valid days, trial refusals, licence purchases and payments (invoice references), our staff's records of licence operations with their reasons, records of licences issued before this service existed (including the names written in those old licences and the old licence files), product, build and platform versions, the latest server clock time, and the records of requests, starts, linking attempts and downloads with their times and IP addresses. The purpose is to protect the intellectual property of CPlugin: for example, to notice that a licence which is no longer paid for has started working again years later, or that a licence said to be "transferred" to another company is still running on the same server and from the same internet address as before. A matching IP address or server name is a reason for a person on our team to look into a case, not proof of a breach.
• Not kept at all: the one-time code that shows the plugin has its licence file, and the random number, signature and protocol version of a request — they are checked and discarded.
• Program logs of the update service (technical messages of the service itself, which can include the IP address of a request) are not part of the history: they are limited by size (at most three files of 50 MB) and are deleted whenever the service is redeployed. The web server in front of the update service keeps no access log of requests.

An IP address can identify a person in some cases (for example a server run from someone's home), so we do not say "no personal data". What we do say: we never collect data about your clients or traders.

Before you link a server to your organization, its record is not tied to any Toolbox organization, but it is not anonymous: it already contains the company and server names that the plugin reports. A server is linked to an organization when someone enters the code from the server journal in CPlugin Toolbox, automatically when the same server is connected to Toolbox as a trading platform, or by CPlugin staff at your request or after checking. Linking is also written to the server journal. Entering a code records the organization, the user and the IP address of the attempt. A trial does not link a server to anyone. A trial is extended once, by 14 days, at your request: write to CPlugin support and we extend the trial of your server; our staff record who extended it and why.

Legal basis and your rights

These records concern business servers. Where they contain personal data, CPlugin Labs LP is the controller and relies on its legitimate interests in licence and trial controls, updates, support and the protection of its software; we do not rely on consent. Who receives the records, where they are kept, your rights (access, correction, erasure, restriction) and the right to object are described in section 12, "Licence checks by our plugins", of our Privacy Policy. The contract terms are in section 10 of the Server Plugin Licence Agreement.

Changes to this list

A plugin will not start sending a new kind of data, and the update service will not start recording one, until we have published a new version of this list with the purpose and the legal basis of the addition and notified licensees: by e-mail to the contact we hold for the licence and in the plugin's release notes, or, for data recorded by the update service itself, on this page at least 14 days before the recording begins. Every earlier version of this list stays on this page.

Questions

Write to info@cplugin.com. The rest of what we collect on this website is described in the Privacy Policy of this website.