Yindle Share Cart

Description

Yindle Share Cart adds a Share Cart button to the WooCommerce cart. It
creates a link that carries only the products, variations and quantities that
were in the cart — never prices, coupons, customer details or session data.

Opening the link shows a preview built from the shop’s current catalogue:
today’s prices, today’s stock, today’s purchase rules. Nothing is added to the
recipient’s cart until they choose Replace my current cart or Merge with
my current cart and submit the form.

All free features listed below are included and enabled. There is no paid usage
quota, expiring trial, telemetry, Yindle account requirement or forced credit
link on your storefront. Short rate limits protect the public sharing endpoint
from abuse; they do not require payment to reset.

What it does

• Share Cart button on the classic cart and the WooCommerce Cart Block.
• Capability links. The public link is a 64-character random capability.
  Only a purpose-separated HMAC-SHA-256 hash of it is ever stored, so a database
  copy does not hand anyone a working link.
• Current-price preview. Prices and availability come from live product
  objects at the moment the link is opened, not from the snapshot.
• Deliberate replace or merge. A GET request only ever renders the preview.
  Importing needs a WordPress nonce, an explicit mode choice and a signed
  single-use intent.
• Guest revocation. Creating a link also hands the sender a separate
  management capability. It can revoke the link but cannot read the cart, and
  the read capability cannot revoke anything.
• Expiry. 1–365 days, 30 by default, rechecked in the database on every
  request rather than relying on a cron run.
• Atomic import. The whole plan is validated before the cart is touched. A
  failure restores the previous cart, its coupons and its session data.
• Stock and purchase rules. Product existence, published state, variation
  ownership, purchasability, sold-individually, maximum quantity and combined
  merge quantities are all revalidated at import time.
• Privacy. Registered with WordPress’s personal-data eraser, and user
  deletion removes the matching rows.
• Classic and Blocks. One server-side service behind both cart renderers.

Separate Pro plugin

Share Cart Pro by Yindle is a separate plugin available from Yindle, with named
saved carts, account management and printing. These implementations are not
included or locked inside this directory package. Existing published links and
shared data remain readable when switching editions.

Moving from Share Cart by Yindle 1.0.1

The directory name is now Yindle Share Cart and its folder is yindle-share-cart.
This is a manual replacement: the older share-cart-by-yindle installation
cannot receive an automatic update across the folder change.

1. Back up your database and plugin files.
2. In WooCommerce settings, turn off Delete data on uninstall before
   removing the old installation. Keep it off when removing an older Pro
   installation too; older uninstall scripts do not recognize this new folder.
3. Install Yindle Share Cart, then deactivate the old Free copy without deleting
   it and activate the new copy. If both remain active, the new copy stands by
   until the old Free copy is deactivated. Pro takes precedence when active.
4. Verify your existing share links and settings.
   Delete it only after confirming deletion is disabled. Keeping it inactive is
   also safe. Do not reset capability secrets or remove shared database tables.

When this new plugin is active it protects shared data during companion
uninstallation without changing the saved deletion preference. That protection
cannot run while it is inactive. Deactivation always preserves data.

Privacy

Share snapshots store product and variation IDs, selected attributes, quantities,
creation and expiry times, hashed link capabilities and, for signed-in creators,
their WordPress user ID. Prices, coupons, addresses, payment information and
WooCommerce session contents are not included in the shared snapshot.

The plugin uses the shop’s WooCommerce session to bind import confirmation to
the current visitor and may ask WooCommerce to create its session cookie when
opening a share preview. The creator’s browser stores one revocation capability
in local storage (yindleCartManagementToken); it is replaced by the next share
and removed when revoked or when the visitor clears site data.

Abuse prevention uses short-lived local counters keyed by a salted hash of the
visitor’s session/user identity and peer IP address, with a five-minute default
window. The raw IP address is not stored by this plugin. One-use import markers
expire after one day. Shared links expire after the configured 1–365 days
(default 30); scheduled cleanup removes expired records that are not referenced
by a retained saved cart.

WordPress’s privacy export includes your saved-cart names and owned product
selections without link tokens or keys. The eraser and user-deletion hooks remove
saved-cart relations and anonymise creator IDs. Network deletions use bounded
background jobs; per-site orphan cleanup retries when the plugin and cron are
available, including data from former memberships. Product selections may remain when another
saved cart references them. Store owners should describe this behavior in their
shop’s privacy notice.

Third-party assets

Plus Jakarta Sans and Geist Mono fonts are bundled under the SIL Open Font
License 1.1. Lucide icons are bundled under the ISC license. Their notices and
source provenance are included in assets/yindle/. Runtime JavaScript is
human-readable and uses WordPress/WooCommerce-provided libraries.

Translations

This directory package uses WordPress language packs from translate.wordpress.org
for PHP and Cart Block strings. It ships no bundled translation catalogues and
needs no custom translation loader. Until a language pack is available, English
source strings remain usable. Community translations are welcome.

Technical details