=== CompleteGreet - Shoppable Videos and Video Widget ===
Contributors: completegreet
Tags: video, ecommerce, woocommerce, chat, shoppable-video
Requires at least: 5.8
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect your WordPress site to the CompleteGreet service to show a site-wide video bubble and supported shoppable video campaigns.

== Description ==

CompleteGreet is a service-connected plugin.

After you connect your CompleteGreet account, the plugin can:

* connect your WordPress site to your CompleteGreet account
* show your site-wide CompleteGreet video bubble
* show supported shoppable video campaigns on your site
* connect your WooCommerce store to CompleteGreet
* send WooCommerce conversion and purchase events to CompleteGreet
* retry failed shoppable purchase sends automatically

= Account Requirement =

You need an active CompleteGreet account to use this plugin. The account connection is part of the core service. This plugin is not a standalone video player.

= External Services =

This plugin uses the external CompleteGreet service. The plugin will not work as a standalone video player without a CompleteGreet account.

CompleteGreet is provided by CompleteGreet. The service terms and privacy policy are here:

Terms of Use: https://completegreet.com/terms-of-use/

Privacy Policy: https://completegreet.com/privacy-policy/

The plugin connects to these CompleteGreet service URLs:

1. `https://backend.completegreet.com`
This is the CompleteGreet API. It is used for account authorization, secure token refresh, connection health checks, shoppable widget format lookup, WooCommerce store connection, and conversion or purchase event delivery.

Data sent to this API can include the site URL, OAuth connection values, refresh tokens for renewing the connection, saved campaign codes, WooCommerce store URL, WooCommerce store name, WooCommerce consumer key and consumer secret when WooCommerce auto-connect is used, order IDs, order totals, order currency, order product IDs, order status, order dates, hashed customer email or phone values where available, visitor IDs, session attribution values, and error/retry data needed to send failed events again.

This data is sent when an admin connects or disconnects the plugin, when the plugin refreshes its connection token, when the plugin checks a saved campaign code, when WooCommerce connection is enabled, when WooCommerce orders or tracked purchase events are processed, and when failed purchase or conversion events are retried.

2. `https://dashboard.completegreet.com`
This is the CompleteGreet dashboard. It is used when an admin clicks links to sign in, register, authorize the plugin, or manage campaigns.

The plugin sends the admin to this dashboard during sign-in, registration, and account management. Any information entered there is handled by the CompleteGreet service under the same terms and privacy policy linked above.

3. `https://backend.completegreet.com/js/CompleteGreetAPI.js`
This remote JavaScript file is loaded on the public site after the plugin is connected so the site-wide CompleteGreet video bubble can appear.

When this script is loaded, the visitor's browser requests the file from CompleteGreet. The plugin includes the connected site's public CompleteGreet user ID in the script tag so the correct bubble can be shown.

4. `https://backend.completegreet.com/shoppable-widget/*.js`
These remote JavaScript files are loaded on the public site when a supported shoppable video campaign is enabled. The exact file depends on the campaign format, such as a floating video bubble or popup.

When these scripts load or run, the visitor's browser requests the files from CompleteGreet. The plugin includes the saved campaign code in the script tag so the correct shoppable video can be shown. The shoppable widget can use visitor IDs, session attribution values, product IDs, campaign IDs, video IDs, and cart or purchase attribution data so CompleteGreet can show the campaign and attribute WooCommerce purchases to video interactions.

= Data Sent To CompleteGreet =

Depending on which features are enabled, the plugin may send this data to CompleteGreet:

* site URL during account connection and connection health checks
* OAuth authorization values during secure sign-in
* refresh token during secure token renewal
* saved campaign code when the plugin checks the campaign format or loads a shoppable widget
* connected site's public CompleteGreet user ID when the site-wide bubble script is loaded
* WooCommerce store URL, store name, consumer key, and consumer secret when WooCommerce auto-connect runs
* WooCommerce order ID, status, total, currency, product IDs, and order date for conversion or purchase tracking
* hashed customer email or phone values, when available, for attribution matching
* visitor IDs, session attribution values, campaign IDs, video IDs, and product IDs when available
* retry error details when failed conversion or purchase events are retried

= Privacy =

This plugin sends data to CompleteGreet only when needed for the connected service features described above.

Privacy Policy: https://completegreet.com/privacy-policy/

Terms of Use: https://completegreet.com/terms-of-use/

= Remote Scripts =

The plugin loads remote JavaScript from CompleteGreet on the public site to render the main CompleteGreet bubble and supported shoppable video formats. Those scripts are part of the CompleteGreet service.

= WooCommerce =

If WooCommerce is active, the plugin can create WooCommerce REST API credentials for the connected CompleteGreet service. Those credentials are stored locally in encrypted form and are revoked when you disconnect the plugin.

= Tracking =

If WooCommerce is active and tracking features are enabled in your CompleteGreet setup, the plugin sends conversion and purchase events to CompleteGreet so orders can be attributed to CompleteGreet interactions.

== Installation ==

1. Upload the `completegreet` folder to `/wp-content/plugins/` or install it through WordPress.org.
2. Activate the plugin in WordPress.
3. Open `CompleteGreet` in the WordPress admin menu.
4. Click `Connect to CompleteGreet` and sign in to your CompleteGreet account.
5. Save a supported campaign code if you want to use Shoppable Videos.

== Frequently Asked Questions ==

= Do I need a CompleteGreet account? =

Yes. The plugin connects your site to the CompleteGreet service.

= Does this plugin work without WooCommerce? =

Yes. The site-wide CompleteGreet bubble can still work without WooCommerce. WooCommerce is only required for store connection and order tracking features.

= What shoppable campaign codes are supported in the plugin settings? =

The plugin settings support Video Bubble (`cg_vb_...`) and Video Popup (`cg_vp_...`) campaign codes.

= What happens if I disconnect the plugin? =

The plugin revokes the CompleteGreet connection, clears local connection data, and revokes the WooCommerce API key it created for CompleteGreet.

= What if my existing site stops connecting after the new public auth flow? =

Reconnect the site from the CompleteGreet settings page in WordPress. If the site still does not connect, disconnect first, then connect again so the site can complete the new secure sign-in flow.

== Changelog ==

= 1.0.2 =
* Added a fallback OAuth token exchange path for WordPress hosts that receive a 403 block on the normal connection endpoint.
* Added a clearer blocked-request diagnostic with the response server/reference when available.

= 1.0.1 =
* Replaced the secret-based WordPress OAuth flow with a public-safe PKCE connection flow.
* Removed the shipped OAuth client secret from plugin code.
* Added stronger WordPress.org-facing disclosures for external services, remote scripts, and data flows.
* Added direct-access guards and tightened superglobal sanitization in plugin files.
* Gated OAuth debug logging behind `WP_DEBUG`.

= 1.0.0 =
* Initial release.
