=== Chatfolk Live Chat - AI Chatbot & Helpdesk, No Account Needed ===
Contributors: easywpstuff
Tags: live chat, chatbot, helpdesk, support, ai
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Live chat, a helpdesk and an AI chatbot that run on your own site. Conversations stay in your database. Bring your own keys.

== Description ==

Most live chat plugins are a thin loader for someone else's platform. Your conversations live on their servers, and you pay per agent, per month, forever.

Chatfolk stores everything in your own WordPress database. There is no FluxPress account, no per-agent pricing and no middleman holding your support history.

**What you get**

* A chat widget that works on any theme, rendered in a shadow root so nothing clashes
* An agent inbox you can install on your phone as an app
* Web push and email notifications for new chats
* A help article post type with search, shown in the widget
* An optional AI chatbot that answers from your own content
* Private notes, statuses, assignment, tags and file attachments
* Canned responses, opening hours, quiet hours and per-queue muting
* A customer panel beside every conversation: earlier chats, files, device

**Bring your own keys**

The chatbot works with OpenAI, Anthropic, Google Gemini or OpenRouter. You add your key, requests go straight from your server to that provider, and you pay them directly at cost.

New messages arrive by polling every few seconds. It works on any host and needs no third party.

**The chatbot's knowledge**

Two sources, and you choose either or both:

1. Custom knowledge you type into settings, for shipping times, refund policy, opening hours and pricing
2. Indexed site content from any post types you pick

Content is chunked and, where the provider supports embeddings, searched by meaning. Anthropic and OpenRouter have no embeddings endpoint, so with those the plugin falls back to keyword matching unless you point embeddings at OpenAI or Gemini.

== External services ==

This plugin can connect to third party services. All of them are optional, and every one is listed here.

**AI providers (optional, only after you add an API key)**

While the chatbot is on, the visitor's message, recent conversation history and the retrieved excerpts from your own content are sent to the provider you select so it can generate a reply. With a key added, the text of the content you chose to index is also sent to the embeddings provider (OpenAI or Google Gemini) when it is published or when you rebuild the index, so it can be searched by meaning. Nothing is sent until you add a key.

* OpenAI — https://openai.com/policies/terms-of-use and https://openai.com/policies/privacy-policy
* Anthropic — https://www.anthropic.com/legal/consumer-terms and https://www.anthropic.com/legal/privacy
* Google Gemini — https://policies.google.com/terms and https://policies.google.com/privacy
* OpenRouter — https://openrouter.ai/terms and https://openrouter.ai/privacy

**Push notification services (optional, only after an agent turns on notifications)**

Once an administrator has generated the push keys and an agent has turned on notifications in the inbox, each new chat sends an encrypted wake-up with no message text and no visitor details to the push service that agent's browser uses. The browser then asks your own site what to show. This is the browser's own Web Push system; which service it uses depends on the browser.

* Google (Chrome and most Android browsers) — https://firebase.google.com/terms and https://policies.google.com/privacy
* Mozilla (Firefox) — https://www.mozilla.org/about/legal/terms/services/ and https://www.mozilla.org/privacy/firefox/
* Apple (Safari) — https://www.apple.com/legal/internet-services/terms/site.html and https://www.apple.com/legal/privacy/
* Microsoft (Edge) — https://www.microsoft.com/servicesagreement and https://privacy.microsoft.com/privacystatement

== Installation ==

1. Upload the plugin and activate it.
2. Go to Chatfolk and switch the widget on.
3. Open Chatfolk, then Inbox. It signs you in with your normal WordPress login.
4. Optional: add an AI key on the Chatbot tab, write your custom knowledge, then rebuild the index from Tools.

== Frequently Asked Questions ==

= Do I need a paid service? =

No. Without any keys the widget polls for new messages and the chatbot is off. That configuration costs nothing and works on shared hosting.

= Why does polling need a shorter interval on busy sites? =

Every open chat window makes one request per interval. On a busy site, raise the interval under Delivery.

= Do push notifications work on iPhone? =

Only after the inbox has been added to the home screen. That is an Apple restriction on Web Push, not a plugin limitation.

= Where is the source code of the scripts? =

In the plugin itself. The minified files in `assets/build/` are compiled from the TypeScript in `src/` by `tools/build.mjs`, which uses esbuild. To rebuild them, run `npm install` and then `npm run build` in the plugin folder.

= What third-party code is included? =

Preact (MIT license) for the visitor widget, icons from Feather (MIT license), and the DM Sans and IBM Plex Mono fonts (SIL Open Font License) for the admin screens. All are compatible with the GPL.

= Where is my data? =

In your own database, in tables prefixed fpchat_. Deleting the plugin keeps them, so a reinstall picks up where you left off. To remove everything when you delete it -- the tables, the settings, the help articles and every file a visitor sent through the chat -- turn on Privacy, "Delete all Chatfolk data when the plugin is deleted", first. Nothing in your media library that did not come from a chat is ever touched.

== Privacy ==

The plugin stores visitor names, email addresses, message text, files visitors upload, a hashed IP address (never the address itself), the browser user agent and the page a chat started on.

Set a retention period in settings to delete old conversations automatically, along with their attached files. Files that were uploaded but never actually sent are cleared after a day.

Note that attachments are served from your ordinary uploads folder, so anyone holding the link can open one. Treat a chat attachment as you would any other file in your media library.

If you enable the chatbot, say so in your own privacy policy.

= Where your credentials are kept =

Your AI provider key and the push notification signing key are stored in your database, locked rather than in plain text.

What that gets you, precisely: a copy of your database on its own — a backup on a laptop, a dump handed to a developer, a host's snapshot, an export taken by an unrelated plugin — does not carry your credentials in readable form.

What it does not get you: the key is derived from the security salts in your `wp-config.php`, so somebody who can read that file as well as your database has both halves. This is not a claim that your keys are safe from an attacker who is already reading files on your server; nothing stored on a server is.

You can separate the two by defining your own key somewhere the database cannot reach:

`define( 'FPCHAT_SECRET_KEY', 'a long random string' );`

Put it in `wp-config.php`, or better, read it from an environment variable your host sets. Do this before entering your credentials, or re-enter them afterwards — anything already locked with the previous key cannot be read with the new one, and the settings screen will tell you so by name rather than failing quietly.

One consequence worth knowing before it happens: **rotating your WordPress security salts makes these credentials unreadable**, because they were locked with a key derived from them. That is a normal thing to do after a compromise. Nothing is lost that cannot be typed in again, and Chatfolk will say exactly which values need re-entering rather than behaving as though everything is still configured.

== Changelog ==

= 1.0.0 =
* First release.
