=== Instinctor ===
Contributors: instinctor
Tags: page builder, ecommerce, website builder, visual editor, online store
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Visual page builder with ecommerce, smart live chat, and SEO tools.

== Description ==

Instinctor builds cinema-grade websites right on WordPress: a visual 3D page builder, a real ecommerce store, a store-aware live chat, and self-running SEO, all in one plugin. No templates, no page-builder plugin stack, no code. Free to start.

Here is what makes it different.

**A chat that actually knows your store.** Instagent is not a generic widget bolted on. It knows your products, prices, hours, and bookings, so it answers real questions and helps close sales around the clock. When a conversation needs you, your phone buzzes: step in with a reply, or let it run.

**Your site will not look like everyone else's.** No templates. Instinctor was built by cinematographers, so every block lands looking expensive, even if you have never designed anything in your life.

**Everything moves, everything reacts.** Dozens of controllable motion presets. Your page breathes, glides, and responds to the mouse or a phone tilt, with no heavy video weighing it down.

**Cinematic scroll.** Scroll, and your content moves through real 3D space. Visitors stop, they remember, and they choose the site that felt different from the fifty they scrolled past today.

**Editable, studio-grade sections.** Instagent builds page sections that stay fully editable in the same clean editor, never locked behind code you cannot touch. Do not like a section? Tell it what to change and it rebuilds it.

**SEO that does its own job.** Every page gets a live 0-to-100 score and reaches 100 in a few clicks, plus JSON-LD structured data, XML sitemaps, and redirect management. No monthly retainer required.

**Control every last detail.** Decide how each element appears, how it moves as people scroll, and how it behaves while the page sits still. A headline that changes color the moment someone scrolls past it is two clicks.

**A real store, not a plugin stack.** One built-in ecommerce system instead of WooCommerce plus a dozen add-ons. Every checkout field is yours: ask for just an email, or the full shipping and requirements story.

**Modern, fast, and yours in a day.** Light, stable, and quick to learn, with Instagent right in the editor answering as you build. No manuals, no support queue.

**A library with personality.** Hundreds of graphic elements ready to drop in: a bold shape behind a headline, a small character peeking out of a corner. Personality without a design project.

= What's included =

* **Impulse visual builder:** standard layouts or full-screen cinematic sections, with WebGL animated backgrounds, entrance animations, parallax, and per-device (desktop, tablet, mobile) overrides on every setting. Layout, content, ecommerce, navigation, form, and account blocks, plus 3D display text.
* **Store:** physical, digital, subscription, gift-card, bundle, and booking products with variants; orders, invoices, packing slips, and returns; coupons, stock, multi-currency, tax rules, loyalty points, volume discounts, add-ons, and order tracking. Payments via Stripe, PayPal, bank transfer, and cash on delivery. Editable transactional emails for the full order lifecycle.
* **Instagent live chat:** a live chat widget with an optional smart response layer that answers questions about your products, prices, and stock, or is answered by hand from the dashboard. The smart responses are opt-in and delivered through the Instinctor Platform relay (see External Services below); no AI-provider key is entered on your site.
* **SEO:** per-page meta, Open Graph and Twitter tags, focus keyword, canonical URL, and a search preview; a per-page health score; JSON-LD structured data; XML sitemaps; and redirect management.

= Source code =

The plugin ships as source. The `.js` files in `assets/js/` are the canonical, hand-written source: no transpiler, bundler, or build step is involved. A few engine files (impulse-3d-effects.js, impulse-motion-lava.js, impulse-fx-engine.js, impulse-wave.js, impulse-animations.js) are written densely on single lines for performance, but each statement is normal readable JavaScript. PHP is unobfuscated. Third-party libraries under `assets/js/vendor/` ship in their original minified form; see `assets/js/vendor/README.txt` for versions, licenses, and source URLs. For a copy of the development repository, contact instinctor@instinctor.com.

A separate Instinctor Pro plugin (from instinctor.com, not distributed here) adds more WebGL environments, motion presets, advanced 3D text effects, and SMS/WhatsApp chat notifications.

== Installation ==

**From WordPress admin:**

1. Go to Plugins → Add New
2. Search for "Instinctor"
3. Click Install Now, then Activate
4. Open Instinctor from the admin sidebar
5. Configure store basics in Settings → Store Info
6. Create your first page in Impulse → Pages

**Manual installation:**

1. Download the plugin zip from WordPress.org
2. Go to Plugins → Add New → Upload Plugin
3. Upload the zip and activate
4. Open Instinctor from the admin sidebar

== Frequently Asked Questions ==

= Does this require WooCommerce? =

No. Instinctor includes its own ecommerce system: products, cart, checkout, orders, and payments. It does not depend on WooCommerce.

= Will it conflict with my existing page builder? =

Impulse pages are managed independently. Pages built with other builders or the theme are not affected. Both can be used on the same WordPress install.

= How does it interact with my theme? =

On Impulse pages, the plugin renders its own template instead of loading the theme's header, footer, or stylesheet. The theme remains active and unchanged on non-Impulse pages.

= What payment methods are supported? =

Stripe (credit/debit cards, Apple Pay, Google Pay, Link), PayPal, bank transfer, cash on delivery. All require credentials configured in Settings → Payments.

= What does Instagent require? =

Nothing beyond the plugin. The smart-response features are delivered through the Instinctor Platform relay (platform.instinctor.com) and are opt-in via the platform consent notice. No OpenAI or other AI API key is entered on your site.

= Can I receive SMS or WhatsApp notifications? =

SMS and WhatsApp notifications are available in Instinctor Pro at instinctor.com, delivered through the Instinctor Platform relay (platform.instinctor.com). The version on WordPress.org includes email notifications only.

= Where can I get help? =

Use the support panel inside the plugin, visit instinctor.com/docs, or email helpdesk@instinctor.com.

= Why is Three.js bundled locally instead of loaded from a CDN? =

The plugin serves Three.js (r185, MIT) from its own assets directory rather than a CDN so the site stays self-contained, works behind a Content Security Policy, and never leaks visitor data to a third party. Three.js now ships as ES modules only, but the 3D effects engine loads it as a classic-script global, so the official r185 module distribution is bundled into an equivalent global build with esbuild (no library source is modified; the MIT license banner is preserved). See assets/js/vendor/README.txt for the exact build command. Three.js is a client-side rendering library with no network, storage, or server-side surface, and r185 has no known security advisories.

= Why does the plugin emit inline <style> and <script> tags? =

Impulse is a visual page builder. The styling for every block is computed from user-chosen settings (gradients, layered animation parameters, per-device overrides, custom fonts) and is unique to each rendered page, so the CSS cannot be pre-shipped as a static file. The same applies to a small number of runtime initializers that need the page's element_tree as configuration. All emitted CSS and JS is escaped through esc_attr / esc_html / wp_json_encode where it embeds user-supplied values, and the JavaScript bundles themselves are enqueued via wp_enqueue_script.

== Screenshots ==

1. Cinema-grade WebGL backgrounds rendered right on WordPress: clouds, aurora, fireflies, plasma, and depth-mapped photos at 60fps, with graceful fallback on older devices.
2. The Impulse visual editor: drag in layout, content, store, and form blocks, choose a live WebGL environment, and tune every setting per device in one clean panel.
3. A build-your-own product from the built-in store: live size and topping choices with instant pricing, no extra plugins.
4. A service business site built with Instinctor: photographic hero, clear calls to action, and quote capture, running on WordPress.
5. A skincare studio site built entirely in the editor: elegant hero, online booking, and treatments, with no code.

== External Services ==

This plugin connects to the following external services. Each connection is described below including what data is sent and when.

= Stripe =
Used for payment processing when Stripe is enabled in Settings → Payments. Customer payment data is submitted directly to Stripe and is not stored on your server.

* Service: https://stripe.com
* Terms: https://stripe.com/legal
* Privacy: https://stripe.com/privacy

= PayPal =
Used for payment processing when PayPal is enabled in Settings → Payments. When a customer chooses PayPal at checkout, the order amount and currency are sent to PayPal's REST API at api-m.paypal.com (or api-m.sandbox.paypal.com in test mode) to create and capture the order. No data is sent unless PayPal is enabled and selected at checkout.

* Service: https://paypal.com
* Terms: https://www.paypal.com/us/legalhub/useragreement-full
* Privacy: https://www.paypal.com/us/legalhub/privacy-full

= Authorize.Net =
Used for payment processing when the Authorize.Net gateway is enabled in Settings → Payments. When a customer pays, the checkout page loads Authorize.Net's Accept.js library from js.authorize.net (or jstest.authorize.net in test mode) to tokenize the card in the browser, and the resulting payment token plus the order amount and billing details are sent to Authorize.Net's API at api.authorize.net (or apitest.authorize.net in test mode) to process the transaction. No card data touches your server, and no data is sent unless the Authorize.Net gateway is enabled and selected at checkout.

* Service: https://www.authorize.net/
* Terms: https://www.authorize.net/about-us/terms.html
* Privacy: https://www.visa.com/en-us/legal/privacy-policy

= AI features (via Instinctor Platform relay) =
Used by Instagent (smart live chat) and the SEO workspace features. When these features are used, page content, product data, and chat messages are sent to the Instinctor Platform relay at platform.instinctor.com, which forwards them to an AI provider on the plugin's behalf. No AI provider API key is entered or stored on your site. These features are opt-in via the platform consent notice (see the Instinctor Platform section below).

* Service: https://platform.instinctor.com
* Terms: https://instinctor.com/terms
* Privacy: https://instinctor.com/privacy

= SMS notifications (via Instinctor Platform relay) =
Used for SMS notifications (Instinctor Pro feature). Notification content and recipient phone numbers are sent to the Instinctor Platform relay at platform.instinctor.com, which delivers the message through its downstream SMS carrier (Telnyx). The plugin does not contact the carrier directly and no carrier credentials are entered on your site.

* Service: https://platform.instinctor.com
* Terms: https://instinctor.com/terms
* Privacy: https://instinctor.com/privacy

= Transactional email (via Instinctor Platform relay) =
Used for transactional email delivery when the relay mailer is selected in Settings → Email. Email content and recipient addresses are sent to the Instinctor Platform relay at platform.instinctor.com, which delivers the message through its downstream email provider. The plugin does not contact the email provider directly and no email-provider credentials are entered on your site.

* Service: https://platform.instinctor.com
* Terms: https://instinctor.com/terms
* Privacy: https://instinctor.com/privacy

= ExchangeRate-API =
Used by the multi-currency feature to fetch exchange rates when an API key is configured in Settings → Currency. The base currency code is sent to the API. Off by default; only used when an API key is configured.

* Service: https://www.exchangerate-api.com/
* Terms: https://www.exchangerate-api.com/terms
* Privacy: https://www.exchangerate-api.com/privacy

= USPS Shipping API =
Optional. Used by the order-tracking feature to fetch tracking events for shipments routed via USPS. Requests are sent to the USPS Web Tools API at secure.shippingapis.com with the tracking number. Off by default; only used when USPS credentials are configured in Settings → Shipping.

* Service: https://www.usps.com/business/web-tools-apis/
* Terms: https://www.usps.com/business/web-tools-apis/general-api-developer-guide.htm
* Privacy: https://www.usps.com/privacy-policy/

= AfterShip =
Optional. Used by the order-tracking feature to fetch tracking events across multiple carriers. Tracking number + carrier slug are sent. Off by default; only used when an AfterShip API key is configured in Settings → Shipping.

* Service: https://www.aftership.com/
* Terms: https://www.aftership.com/legal/terms-of-service
* Privacy: https://www.aftership.com/legal/privacy

= IndexNow (search-engine index notification) =
Optional. Used by the SEO tools to tell participating search engines (via the IndexNow protocol, used by Bing and Yandex) when your pages are published or updated, so they recrawl sooner. When an IndexNow key is configured in Settings, the changed page URLs, your site host, and that key are sent to api.indexnow.org. Off by default; nothing is sent unless an IndexNow key is set.

* Service: https://www.indexnow.org/
* Terms: https://www.indexnow.org/faq
* Privacy: https://privacy.microsoft.com/privacystatement

= Google (Sign in with Google, brokered by Instinctor Platform) =
Optional "Sign in with Google" on checkout and account pages. The OAuth handoff is brokered by the Instinctor Platform: the visitor is redirected through platform.instinctor.com/oauth/google/* rather than connecting to Google directly from your site. When enabled, the visitor's Google profile (name, email, profile picture) is returned to your site via the platform. Off by default; only used when the feature is enabled and the platform connection is granted.

* Service: https://developers.google.com/identity
* Terms: https://policies.google.com/terms
* Privacy: https://policies.google.com/privacy

= QR Code generator (goQR.me / api.qrserver.com) =
Used in the admin only. When an administrator opens the QR-code popup for a page, the plugin builds an `<img>` whose source points at api.qrserver.com to render a scannable QR code of that page's URL. The page URL text is sent to api.qrserver.com at the moment the QR popup is opened. No data is sent unless the popup is opened, and the QR feature is admin-side only.

* Service: https://goqr.me/api/
* Terms: https://goqr.me/legal/
* Privacy: https://goqr.me/privacy-safety-security/

= Google Maps / Places =
Optional. When a Google Places API key is configured in Settings, the checkout page loads the Google Maps JavaScript API from maps.googleapis.com to offer address autocomplete. The partial address the customer types is sent to Google to return suggestions. Off by default; only used when a Places API key is configured.

* Service: https://developers.google.com/maps
* Terms: https://cloud.google.com/maps-platform/terms
* Privacy: https://policies.google.com/privacy

= YouTube and Vimeo (video embeds) =
When a page author adds a video block with a YouTube or Vimeo URL, the front end embeds that video in an iframe from www.youtube.com or player.vimeo.com. The embed loads only on pages where a video block is present, and only when a visitor views that page.

* YouTube: https://www.youtube.com/t/terms, https://policies.google.com/privacy
* Vimeo: https://vimeo.com/terms, https://vimeo.com/privacy

= Outbound links (carrier tracking and social sharing) =
The order-tracking feature builds plain outbound hyperlinks to carrier tracking pages (UPS, FedEx, DHL, USPS, Amazon, Royal Mail, Canada Post, and others), and designer profile / share buttons build hyperlinks to social networks (X/Twitter, LinkedIn, WhatsApp). These are ordinary links the visitor may click. The plugin does not transmit any data to those destinations on its own.

= Instinctor Platform (platform.instinctor.com and instinctor.com) =
The plugin can connect to two Instinctor hosts: platform.instinctor.com for AI relays, transactional email and SMS, OAuth brokering, the section/shape libraries, plugin updates, and the designer marketplace; and instinctor.com for license validation, which is contacted at instinctor.com/wp-json/instinctor/v1/license. **All connections are OFF by default.** On first login an admin banner asks "Connect Instinctor to platform.instinctor.com?" with Connect / No thanks buttons; the plugin only contacts the platform after the site owner clicks Connect, or after they take an explicitly opt-in action (entering a license key, clicking Subscribe, submitting the registration email). Consent can be revoked any time in Instinctor → Settings → Privacy.

Every endpoint below sends the site URL plus, where noted, additional payload data. No call fires unless the user has opted in or taken the corresponding explicit action.

* `GET instinctor.com/wp-json/instinctor/v1/license`: License validation against the instinctor.com host. Sends: license key + site URL. Fires when the plugin validates an activated license key.
* `POST platform.instinctor.com/api/validate`: License key activation. Sends: license key + site URL. Fires when the admin enters and activates a license key.
* `POST /api/checkout`: Stripe checkout session creation. Sends: admin email + plan + billing interval + site URL. Fires when the admin clicks Subscribe / Upgrade.
* `POST /api/register`: Free license registration. Sends: email + site URL + plugin version. Fires when the admin submits the registration email in the admin banner.
* `GET /api/version`: Plugin update check. Sends: nothing beyond the request. Fires when WordPress checks for plugin updates (only after consent).
* `POST /api/relay/email`: Transactional email relay. Sends: recipient + subject + body. Fires when the store sends a transactional email (order confirmation, etc.) AND the relay mailer is selected. Optional.
* `POST /api/relay/sms`: Transactional SMS relay. Sends: recipient phone + message. Fires when SMS notifications are configured to use the relay. Optional.
* `POST /api/relay/ai-help`: Instagent help-mode AI query. Sends: user's question + editor context + license key. Fires when the editor user submits a question in the Help panel.
* `POST /api/relay/ai-help-chunk`: KB article fetch. Sends: article slug + license key. Fires when the editor user clicks a Help-panel topic.
* `POST /api/relay/<task>`: AI content/SEO/chat relay. Sends: task params + license key. Fires when the user invokes an AI feature (AI write, SEO suggestions, AI chat reply).
* `GET /api/graphics/sandbox-3d`: Curated 3D image library index for the hero sandbox. Sends: nothing. Fires when an editor user opens the hero-sandbox 3D picker.
* `POST /api/admin/library/sections/create`: Admin-only upload to the platform section library. Sends: element tree + HTML preview + platform token. Fires only when an admin clicks "Push to library".
* `GET /api/sections`, `GET /api/shapes`: Template/shape library index reads. Sends: nothing. Fires when the user opens the corresponding picker.
* `POST /api/report`: Migration / support ticket relay (marketing site only). Sends: email + site URL + message. Fires when a visitor submits the migration form.
* `POST /api/public/subscribe-solo`: Self-serve signup. Sends: email + chosen slug + referral code. Fires when a visitor submits the signup form on the marketing site.
* `GET /api/public/designer/<slug>`: Designer profile read. Sends: nothing. Fires when a designer's public profile page is viewed.
* `POST /api/referral/apply`, `GET /api/referral/stats`: Affiliate signup + stats. Sends: form values / referral code. Fires only when the partner-program admin uses those screens.
* `POST /analytics_ping`: Anonymous daily usage ping. Sends: PHP version + WP version + plugin version (no user data). Fires once per day **only if** the admin has separately opted into "Help improve Instinctor" in Settings → Privacy AND the platform consent above is granted.

* Website: https://instinctor.com
* Privacy policy: https://instinctor.com/privacy
* Terms of service: https://instinctor.com/terms

== Changelog ==

= 2.0 =
Initial public release.

== Upgrade Notice ==

= 2.0 =
Initial public release.
