

A pin left directly on the page it refers to - no separate tool, no screenshot pasted into an email.
Vifee is a bug tracker and kanban board built into your WordPress admin, made for website projects. Clients, testers and teammates report bugs and change requests straight from the page they are looking at, and every report lands as a card on your board – with the exact spot, a screenshot and the browser details attached. Everything is stored in your own WordPress database; no external service is involved.
Feedback, screenshots and reviewer details are stored in your own WordPress database and a private, non-public uploads directory. Vifee makes no outbound requests, calls no third-party API and sends no telemetry. Screenshots hide passwords and form values before they leave the reviewer’s browser. For agencies working with public-sector, healthcare or legal clients, “the data never leaves our server” is often a procurement requirement.
A separate PRO add-on is planned for agencies managing feedback across multiple client sites. It will be entirely optional – nothing described above is disabled, watermarked, or held back in this free version to encourage an upgrade, and every feature here stays free, forever.
Vifee keeps separate feedback for every site of a network. When the plugin is active on a site – individually or network-wide – that site gets its tables, keys, the manage_vifee_feedback capability for administrators and its daily maintenance on its first request, including sites added to the network later. Uninstalling honours each site’s own “delete all data” setting.
Feedback may contain a display name, an optional private email address, technical browser data, replies and screenshots. Optional email addresses are encrypted at rest, using a dedicated encryption key generated on activation, and are never exposed to other reviewers.
Feedback is retained indefinitely by default; there is no automatic expiry, and older feedback must be removed manually from the Vifee admin screen. Review sessions expire automatically after 30 days.
Go to Vifee Settings to opt in to deleting all Vifee feedback, attachments and reviewer data when the plugin is uninstalled. This is disabled by default, so uninstalling the plugin normally leaves your feedback data in place.
This plugin supports the WordPress Tools Export/Erase Personal Data screens. They find guest reviewers by the email they left and signed-in authors by their WordPress account, and cover the profile, submitted feedback, replies and attachments. Erasure replaces the person’s text with a removal notice, clears browser details, deletes their screenshots and ends their review sessions.
Screenshots hide personal data before they leave the reviewer’s browser, so nobody has to remember to cover it. Passwords and elements with the data-vifee-mask attribute are always hidden; values typed into form fields are hidden by default. On Vifee Settings Privacy you can list more elements to hide by CSS selector, or hide all page text. The reviewer can cover anything else with the Hide area tool, which paints a solid block into the image: only the finished image is uploaded, never the original.
By default each new comment gets a screenshot of the visible part of the page, taken when the reviewer places the pin, with the pin painted on it. The reviewer sees it under the comment and can remove it before sending; it is masked exactly like a screenshot taken by hand. Switch it off on Vifee Settings Privacy.
Screenshots are stored under random file names in a private uploads subdirectory protected by .htaccess / web.config. On servers that ignore those files (nginx) the random names keep them unguessable; to keep them out of the web root entirely, define VIFEE_PRIVATE_DIR in wp-config.php with a directory outside it.
Bundled library
The review widget bundles html2canvas-pro (MIT licence, GPL-compatible: https://github.com/yorickshan/html2canvas-pro), a maintained fork of html2canvas, to render the on-page screenshot capture entirely in the reviewer’s browser. No image processing happens server-side and no third-party service is involved.