The plugin records IP addresses, which are personal data in the UK, the EU and plenty of other places. There is no honest way to build this without them: a record of failed sign-ins that cannot say where they came from tells nobody anything.

So it says so, rather than quietly not mentioning it:

suggested wording is added to Settings → Privacy for you to edit into your policy;
the retention setting is the answer to "how long do you keep it" — set it to what you are comfortable with;
nothing is sent anywhere. The records are in your own database and go nowhere else.

Password reset requests are recorded the same way, and so are sign-ups the screening turns away, with the username or email address they gave, and the suggested wording says so.

With Refuse passwords a machine would find on, the only thing kept about a password is the note that it did not pass at sign-in, when, and which rule; for one that was too short, the minimum length it fell short of, never its own length. It is not deleted with the log: it stays until the person chooses a new password. The suggested wording says that too. WordPress's own Tools → Export Personal Data lists it as Password flagged as weak with its date, and Erase Personal Data removes it.

With Let people skip the code on a browser they choose on, a browser somebody asks not to be asked on keeps a cookie for that many days, and the site keeps a scrambled copy of it with the kind of browser and system and its dates, never an internet address (see Skipping the code on a browser you choose). The suggested wording says so while the setting is on. Export Personal Data lists each one as Remembered browser, and Erase Personal Data removes them.

The log itself is not in the export and is not erased on request. A row is filed under the username or email address that was typed and holds the address of whoever typed it, which is often somebody else guessing at that account. Erase Personal Data says when the log holds rows under the person's email address or username, and the log deletes them after the days you set.

Privacy