About this plugin
Finishcoat turns any WordPress site into a review page for your client. They open a review link, click a Suggestions tab, and leave notes right on the page. You read them in wp-admin, reply, and decide what changes.
Everything stays on your site. Finishcoat makes no outside requests: no account, no tracking, no fonts or scripts from anywhere else. Notes, replies, photos and settings are stored in your WordPress database and uploads folder, and email alerts go out through your site’s own mail.
What your client can do
- Leave a note on any page, or pin it to the exact spot it is about. Pins show as numbered dots.
- Reply to a note, and read your replies.
- Attach up to 3 photos to a note or a reply: a screenshot, a logo, a photo they want used.
- Try their own photo in any spot with “Try my photo here”. It shows in place right away, cropped like the original, and only in their browser. Nothing is uploaded until they press “Suggest this photo”, which turns it into a note pinned to that spot with a before and after pair.
What you get
- A Client notes menu with the list of notes, a Waiting view and a count bubble, so you see what needs an answer.
- A Photos screen with every photo, a Download original button and Delete.
- An email for each client note and reply, with photo thumbnails and a link that opens the note on the page.
- Studio mode: when you are logged in as an editor or administrator, you reply, set a status (New, Noted, In progress, Done) and delete right on the page.
Review codes keep it private
A visitor needs a review code to see or send notes. You get one code on activation and can add up to 10, each with a label such as “Client” or “Marketing lead”. The label shows next to each note, so you know who sent what.
Send each person their review link. Opening it saves the code in their browser for 90 days and removes it from the address bar.
Who sees the tab
Choose Everyone, Logged-in users only, or Only people who open the review link (the default, so a live site never shows the tab by accident). Skip pages by ID, or use the [finishcoat] shortcode. [finishcoat board="yes"] shows the board of every note where you place it.
Source code
Every file in the plugin is the original, human-readable source. Nothing is minified, compiled or bundled, and there is no build step: the JavaScript and CSS in the assets folder are the files we edit. com/wilder-labs/finishcoat.
Privacy
Finishcoat makes no outside requests and sends nothing to Wilder Labs or anyone else.
- What is stored: the name a visitor types, their message, the page address and title, where a pin sits, the label of the review code they used, and any photos they send.
- Where: in your WordPress database and in wp-content/uploads/finishcoat/.
- How long: until you delete it. Deleting the plugin keeps everything, unless you tick “Delete all notes and photos when the plugin is deleted” in Settings.
- IP addresses: used only as a one-way hash, for rate limits, kept in a transient for at most an hour. They are never stored with a note.
- In the visitor’s browser: their name, their review code (for 90 days) and whether the tab hint was shown, in localStorage. No cookies are set.
- Photos: display copies have location and camera data removed. Originals are kept as sent, so they can still hold that data, and only editors can download them.
Finishcoat adds a suggested paragraph to Settings > Privacy for your privacy policy.