=== Mamtack — Visual Feedback Tool for the AI Era ===
Contributors: mamtack
Tags: feedback, comments, collaboration, visual, ai
Requires at least: 5.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Collect visual website feedback. Clients pin comments to page elements, and teams discuss and resolve them in threaded conversations.

== Description ==

Turn vague feedback into clear, actionable conversations. Clients and teammates click directly on a page element to leave a comment, so everyone knows exactly what needs attention. Keep the discussion in a live thread, assign follow-ups, and track feedback through resolution—all without asking reviewers to install a browser extension or create a Mamtack account.

**How it works:**

1. Install the plugin and enter your API key from the [Mamtack dashboard](https://mamtack.com/app/dashboard)
2. The Mamtack widget loads on your site's frontend pages
3. Reviewers click elements on your page to leave pinned comments
4. You manage feedback threads in the Mamtack dashboard or directly on-site

**Features:**

* Pin feedback to page elements, with element-aware matching to keep pins attached when a page layout or markup changes
* Threaded conversations with real-time collaboration, so teammates see comments and updates as they happen
* Team mentions and thread assignments to bring the right people into a discussion
* Guest commenting for reviewers, with email, Google, or GitHub sign-in available for team members
* AI-generated suggestions that summarize feedback and recommend next steps
* AI tagging to categorize feedback threads; review and correct tags so future suggestions better match your project
* Email notifications for assigned threads, plus Slack notifications for project activity
* Outbound webhooks for feedback events, so you can connect Mamtack to your own tools and workflows
* Flag threads for a developer to fix, then use Mamtack's MCP server from a compatible IDE to list flagged threads, retrieve fix context, and report completed fixes
* Route feedback into Jira, Linear, or GitHub Issues when those integrations are configured
* Assign threads to teammates, track status, and resolve completed feedback
* Works with any WordPress theme and does not require a browser extension

**Perfect for:**

* Agencies collecting client feedback before launch
* Teams reviewing staging sites
* Designers getting sign-off on live pages
* Anyone who needs "point and comment" feedback

== Installation ==

1. Upload the `mamtack` folder to `/wp-content/plugins/`, or install directly from the WordPress plugin directory
2. Activate the plugin through the "Plugins" menu in WordPress
3. Go to **Settings → Mamtack** and enter your API key and project name
4. Make sure your domain is added in the [Mamtack Dashboard](https://mamtack.com/app/dashboard) under your site settings

Don't have an account? [Sign up at mamtack.com](https://mamtack.com) — the free plan includes 1 site and 15 threads.

== Frequently Asked Questions ==

= Where do I get an API key? =

Sign up at [mamtack.com](https://mamtack.com), create a site in the dashboard, and copy the API key from the site settings page.

= I installed the plugin but the widget doesn't appear =

The most common cause is that your domain isn't in the site's allowed domains list. Go to the Mamtack Dashboard → your site → Settings, and make sure your WordPress domain is listed. The domain must match exactly (including subdomains and paths for subdirectory installs).

= Does the widget slow down my site? =

The widget script (~30KB gzipped) loads asynchronously from a CDN and does not block page rendering. It has no impact on your site's Largest Contentful Paint (LCP) or First Input Delay (FID).

= Is the API key visible in my page source? =

Yes, the API key appears in the script tag as a `data-key` attribute. This is safe — the key is a public identifier (like a Google Maps API key) and is restricted to your allowed domains. It cannot be used to access your data from unauthorized domains.

= I use a caching plugin — will Mamtack work? =

Yes. The widget loads from an external CDN and is not affected by page caching. If you use a plugin that combines or minifies external scripts, you may need to exclude the Mamtack script from optimization.

= My site has a Content Security Policy (CSP) =

Add these domains to your CSP:

* `unpkg.com` — widget script source
* `cdn.jsdelivr.net` — Sentry browser SDK source when error monitoring is enabled
* `*.supabase.co` — API and real-time connections
* Mamtack's Sentry endpoint — error reports when error monitoring is enabled

= Can I disable the widget on specific pages? =

Yes. Go to Settings → Mamtack → Exclude pages, and enter comma-separated page or post IDs.

= Does this work with page builders like Elementor? =

Yes. The widget injects via standard WordPress hooks and works with Elementor, Divi, WPBakery, and other page builders.

== Changelog ==

= 1.0.0 =
* Initial release
* Settings page with API key, project, version strategy, load position, page exclusion
* CDN-loaded widget injection via wp_enqueue_script
* AMP auto-detection and exclusion
* i18n ready

== Upgrade Notice ==

= 1.0.0 =
Initial release.

== External Services ==

The WordPress plugin connector is licensed under GPL-2.0-or-later. The Mamtack hosted platform and widget are proprietary.

This plugin connects a WordPress site to the Mamtack hosted feedback service. Its interactive widget is the browser client that provides the service's core feedback features. The remote widget script is service functionality, not a general-purpose library, unrelated asset, or mechanism for installing or updating WordPress code. It is not included in this plugin's ZIP.

The widget script is loaded only on public pages after the administrator has configured a Mamtack API key and project, and only when the page is not excluded by the plugin settings. The administrator can select whether the service runtime is pinned to a version, receives compatible patch updates, or always uses the latest version. A Mamtack account and configured project are required. By configuring the plugin to enable the widget, the site administrator enables these documented service connections. The widget and supporting service files are delivered remotely because they are the client runtime for this hosted service.

**Mamtack widget service client via unpkg.com**

The visitor's browser downloads and executes the Mamtack widget JavaScript from unpkg, a public CDN for npm packages. This is the client runtime for the Mamtack hosted feedback service and provides the interactive commenting interface; it is not an unrelated asset or a general-purpose dependency. The plugin uses the administrator's selected widget version strategy to form a URL following this pattern: `https://unpkg.com/@mamtack/widget@{version}/dist/mamtack.iife.js`.

When the script is requested, unpkg receives normal HTTP request data, including the visitor's IP address, browser user-agent, and referrer. The API key, comments, and other feedback content are not sent to unpkg as part of the script request. The request occurs when WordPress enqueues the widget on an eligible public page. See the [unpkg terms](https://unpkg.com/).

**Mamtack feedback service using Supabase**

After it loads, the widget connects to Mamtack's Supabase-hosted backend at `https://qfmbdovuulyeqbowwfsk.supabase.co` to validate the configured site key and provide feedback and real-time features. During initialization, the service receives the public project key and site/page URL. When a thread is created, the widget also sends page and browser environment details (including browser and operating system, viewport, language, and referrer) and a snapshot of console warnings, errors, and unhandled errors; captured console data is scrubbed before submission. When visitors or team members use feedback features, the service processes pinned element information, comment and reply text, commenter display information, authentication/session data, and image attachments where available. Email or OAuth sign-in is handled through Supabase Auth and may also involve the selected identity provider. Data is sent when the widget initializes, when someone signs in or interacts with feedback, and as needed for real-time updates. See the [Supabase privacy policy](https://supabase.com/privacy).

**Error monitoring using Sentry via jsDelivr**

When error monitoring is enabled in the widget build, the browser downloads the Sentry browser SDK from jsDelivr at `https://cdn.jsdelivr.net/npm/@sentry/browser@10.57.0/+esm`. This request sends normal HTTP request data, including the visitor's IP address, browser user-agent, and referrer. The widget may send captured JavaScript errors and diagnostic information to Mamtack's Sentry project, including stack traces and the signed-in team member's user identifier and display name when available. Error monitoring is used to diagnose widget failures. See the [Sentry privacy policy](https://sentry.io/privacy/).

**Mamtack account and dashboard**

Site administrators use [mamtack.com](https://mamtack.com) to create an account, manage projects and API keys, and review feedback. The plugin links to the dashboard, and the widget uses mamtack.com for the OAuth sign-in callback. The plugin does not send its settings directly to mamtack.com during a normal page load; the widget communicates with the Mamtack service through the Supabase endpoint described above. An account and configured project are required. A free plan is available; plan limits and any paid options are described on the Mamtack site.

For details about Mamtack's handling of service data, see the [Mamtack Privacy Policy](https://mamtack.com/privacy) and [Terms of Service](https://mamtack.com/terms).
