=== CJakCiasteczko ===
Contributors: maciejczyzak
Tags: cookies, gdpr, consent, google consent mode, cmp
Requires at least: 5.8
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

GDPR cookie consent banner with Google Consent Mode v2. Paste a key from cjakciasteczko.pl and the plugin injects the consent script into your pages.

== Description ==

CJakCiasteczko is a lightweight (~8 KB gzipped) Consent Management Platform (CMP). This plugin connects your WordPress site with an account on cjakciasteczko.pl. The banner's look, copy and behaviour are configured in the cjakciasteczko.pl dashboard; the plugin simply injects the script that loads it on every public page of your site, scoped to your domain via the install key you paste in.

= What the plugin does =
* Enqueues a small inline configuration script and an asynchronous external consent script (`cjakciasteczko.js`) into the `<head>` of every public page.
* The inline configuration sets the Google Consent Mode v2 defaults to "denied" with `wait_for_update`, so analytics/ads tags wait for the visitor's decision before firing.
* After the visitor interacts with the banner, the external script calls `gtag('consent', 'update', ...)` to grant or deny each consent category.

= What the plugin does NOT do =
* It does not configure the banner appearance or copy -- you do that in the cjakciasteczko.pl dashboard.
* It does not send any visitor data to cjakciasteczko.pl from PHP. The only PHP-to-API call happens once, when you save your install key in Settings -> CJakCiasteczko, in order to verify the key and resolve your domain. All visitor-side consent traffic happens in the visitor's browser, between the visitor and the cjakciasteczko.pl service, not via your server.

= Requirements =
* A free or paid account at cjakciasteczko.pl (the service this plugin connects to). The plugin is useless without it.

== Installation ==

1. Install the plugin (Plugins -> Add New -> Upload Plugin -> choose the `.zip`).
2. Activate.
3. Go to Settings -> CJakCiasteczko.
4. Paste the install key generated in the cjakciasteczko.pl dashboard (Your domain -> Settings -> Install key).
5. Save. The plugin validates the key against the cjakciasteczko.pl API and, on success, shows "Plugin connected".
6. Open your site in an incognito window -- you should see the consent banner.

== Frequently Asked Questions ==

= Does the plugin send visitor data anywhere from my server? =

No. The only server-to-server call this plugin makes is a one-time POST to `https://cjakciasteczko.pl/api/v1/install/verify` when you save your install key in Settings. That request contains only the install key you entered and returns the matching domain so the plugin knows which site identifier to inject. No visitor IP, no page content, no analytics data is ever sent from your server. The consent banner itself runs in the visitor's browser and talks to the cjakciasteczko.pl service directly.

= What happens if I cancel my cjakciasteczko.pl subscription? =

The backend returns "domain inactive" to the consent script, so the banner stops showing and Google Consent Mode stays in its "denied" defaults. The plugin remains installed but injects nothing until your install key is valid again.

= Can I self-host the backend? =

The API base URL and CDN script URL are hardcoded to `https://cjakciasteczko.pl`. Self-hosting requires forking the plugin -- contact cjakciasteczko@aveneo.pl if you need this.

= Is the plugin GPL-compatible? =

Yes, the plugin source code is licensed under GPL-2.0-or-later. The external service (cjakciasteczko.pl) is a separate product with its own commercial terms; see the External services section below.

== External services ==

This plugin relies on the cjakciasteczko.pl service to provide its core functionality (the consent banner UI, the GDPR audit log, and the Google Consent Mode integration). The service is provided by aveneo, ul. Dmowskiego 124, 60-124 Poznan, Poland (NIP 7792268011).

The plugin contacts cjakciasteczko.pl in the following situations:

1. **When you save your install key in Settings -> CJakCiasteczko**, the plugin POSTs the install key to `https://cjakciasteczko.pl/api/v1/install/verify` to validate it and to discover the matching domain name. This call is made only once per save, only from your server, and only contains the install key you entered. The response contains the domain name associated with that key.

2. **When a visitor loads any page of your site**, the plugin injects an asynchronous `<script>` tag pointing to `https://cjakciasteczko.pl/v1/cjakciasteczko.js`. The visitor's browser then loads that script directly from cjakciasteczko.pl. The script communicates with cjakciasteczko.pl to fetch the banner configuration for your domain and, after the visitor makes a consent decision, to persist that decision in the audit log. The plugin itself does not see this traffic -- it happens entirely between the visitor's browser and cjakciasteczko.pl.

The cjakciasteczko.pl service is required for the plugin to provide any visible functionality. Without a valid install key the plugin does nothing.

* Service Terms of Service: https://cjakciasteczko.pl/en/legal/terms
* Service Privacy Policy: https://cjakciasteczko.pl/en/legal/privacy
* Service provider website: https://cjakciasteczko.pl

== Privacy ==

The plugin stores three values in your WordPress `wp_options` table: the install key you pasted, the hostname resolved by the verify call, and the timestamp of the last successful verification. All three are removed when the plugin is uninstalled (see `uninstall.php`).

The plugin does not set any cookies on your site. The consent banner script loaded from cjakciasteczko.pl handles its own cookie/local-storage usage as documented in the service's Privacy Policy linked above.

== Changelog ==

= 1.0.2 =
* All user-facing description text (plugin header, readme) translated to English to comply with WordPress.org Plugin Directory guidelines.
* Replaced direct `<script>` echo in `<head>` with proper `wp_register_script` + `wp_enqueue_script` + `wp_add_inline_script(..., 'before')` so the script tag plays nicely with caching and optimization plugins.
* Added explicit "External services" section in readme documenting every call to cjakciasteczko.pl, the data sent, and the conditions under which it is sent, including links to the service's Terms of Service and Privacy Policy.
* Fixed Contributors header to list the WordPress.org username of the plugin owner.

= 1.0.1 =
* Tested up to: 6.9 (was 6.6).
* Text Domain aligned with plugin slug (`cjakciasteczko`).

= 1.0.0 =
* Initial release.
