Yindle Share Cart

Yindle Share Cart adds a Share Cart button to the WooCommerce cart. It

creates a link that carries only the products, variations and quantities that

were in the cart — never prices, coupons, customer details or session data.

Opening the link shows a preview built from the shop’s current catalogue:

today’s prices, today’s stock, today’s purchase rules. Nothing is added to the

recipient’s cart until they choose Replace my current cart or Merge with

my current cart and submit the form.

All free features listed below are included and enabled. There is no paid usage

quota, expiring trial, telemetry, Yindle account requirement or forced credit

link on your storefront. Short rate limits protect the public sharing endpoint

from abuse; they do not require payment to reset.

What it does

• Share Cart button on the classic cart and the WooCommerce Cart Block.

• Capability links. The public link is a 64-character random capability.

Only a purpose-separated HMAC-SHA-256 hash of it is ever stored, so a database

copy does not hand anyone a working link.

• Current-price preview. Prices and availability come from live product

objects at the moment the link is opened, not from the snapshot.

• Deliberate replace or merge. A GET request only ever renders the preview.

Importing needs a WordPress nonce, an explicit mode choice and a signed

single-use intent.

• Guest revocation. Creating a link also hands the sender a separate

management capability. It can revoke the link but cannot read the cart, and

the read capability cannot revoke anything.

• Expiry. 1–365 days, 30 by default, rechecked in the database on every

request rather than relying on a cron run.

• Atomic import. The whole plan is validated before the cart is touched. A

failure restores the previous cart, its coupons and its session data.

• Stock and purchase rules. Product existence, published state, variation

ownership, purchasability, sold-individually, maximum quantity and combined

merge quantities are all revalidated at import time.

• Privacy. Registered with WordPress’s personal-data eraser, and user

deletion removes the matching rows.

• Classic and Blocks. One server-side service behind both cart renderers.

Separate Pro plugin

Share Cart Pro by Yindle is a separate plugin available from Yindle, with named

saved carts, account management and printing. These implementations are not

included or locked inside this directory package. Existing published links and

shared data remain readable when switching editions.

Moving from Share Cart by Yindle 1.0.1

The directory name is now Yindle Share Cart and its folder is yindle-share-cart.

This is a manual replacement: the older share-cart-by-yindle installation

cannot receive an automatic update across the folder change.

• Back up your database and plugin files.

• In WooCommerce settings, turn off Delete data on uninstall before

removing the old installation. Keep it off when removing an older Pro

installation too; older uninstall scripts do not recognize this new folder.

• Install Yindle Share Cart, then deactivate the old Free copy without deleting

it and activate the new copy. If both remain active, the new copy stands by

until the old Free copy is deactivated. Pro takes precedence when active.

• Verify your existing share links and settings.

Delete it only after confirming deletion is disabled. Keeping it inactive is

also safe. Do not reset capability secrets or remove shared database tables.

When this new plugin is active it protects shared data during companion

uninstallation without changing the saved deletion preference. That protection

cannot run while it is inactive. Deactivation always preserves data.

Privacy

Share snapshots store product and variation IDs, selected attributes, quantities,

creation and expiry times, hashed link capabilities and, for signed-in creators,

their WordPress user ID. Prices, coupons, addresses, payment information and

WooCommerce session contents are not included in the shared snapshot.

The plugin uses the shop’s WooCommerce session to bind import confirmation to

the current visitor and may ask WooCommerce to create its session cookie when

opening a share preview. The creator’s browser stores one revocation capability

in local storage ( yindleCartManagementToken ); it is replaced by the next share

and removed when revoked or when the visitor clears site data.

Abuse prevention uses short-lived local counters keyed by a salted hash of the

visitor’s session/user identity and peer IP address, with a five-minute default

window. The raw IP address is not stored by this plugin. One-use import markers

expire after one day. Shared links expire after the configured 1–365 days

(default 30); scheduled cleanup removes expired records that are not referenced

by a retained saved cart.

WordPress’s privacy export includes your saved-cart names and owned product

selections without link tokens or keys. The eraser and user-deletion hooks remove

saved-cart relations and anonymise creator IDs. Network deletions use bounded

background jobs; per-site orphan cleanup retries when the plugin and cron are

available, including data from former memberships. Product selections may remain when another

saved cart references them. Store owners should describe this behavior in their

shop’s privacy notice.

Third-party assets

Plus Jakarta Sans and Geist Mono fonts are bundled under the SIL Open Font

1. Lucide icons are bundled under the ISC license. Their notices and

source provenance are included in assets/yindle/. Runtime JavaScript is

human-readable and uses WordPress/WooCommerce-provided libraries.

Translations

org

for PHP and Cart Block strings. It ships no bundled translation catalogues and

needs no custom translation loader. Until a language pack is available, English

source strings remain usable. Community translations are welcome.