=== Permitly ===
Contributors: ostaraventures, freemius
Tags: photo consent, youth, media library, privacy, compliance
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.6.3
License: GPLv2 or later

Photo and media consent for organizations that feature children. Every photo knows which children are in it and what their parents agreed to, and anything without consent stays off your site.

== Description ==

Camps, schools' partners, youth sports, YMCAs, churches and nonprofits run on photos of the kids they serve. Using a child's image without a parent's consent is a lawsuit and a broken trust waiting to happen. Permitly keeps a record of every family's choices, ties them to every photo and video on your site, and hides anything that is not cleared, automatically.

Ready for California AB 2007 (Business and Professions Code Section 18985, in effect January 1, 2027): standalone consent, consent by type of use, revocation by email for up to a year after a child leaves, and no conditioning enrollment on consent.

* Consent registry: one minimal record per child, with a yes or no for website, social, email, print and video.
* Media tagging: source, identifiable minor, which children are in frame, program and location.
* Statuses: Cleared, Needs review, Blocked, Out of scope, Revoked.
* Enforcement: uncleared images are swapped for a placeholder on in-scope pages and left out of the media picker.
* Revocations: the website stops showing the child's images at once, and staff get a dated checklist for other channels.
* Whole-site picture: how many images are live across the site, how many are cleared and how many still need review.
* Wide scan: page and post content, featured images, galleries, CSS background images, images inserted by URL, page builders, widgets, menus, theme settings, block templates, synced patterns and common sliders.
* Safe whole-site switch: before enforcing everywhere, see exactly how many images would be hidden on how many pages, and confirm. While review is in progress you can choose to hide only confirmed problems.
* Nightly check with a circuit breaker and an audit log.

Safety: new installs start in watch-only mode, scoped to test pages. Permitly never deletes, moves or edits an image or a page, so pausing or deactivating it restores the site instantly. No facial recognition. Consent data stays in your own WordPress database.

Permitly Pro adds a standalone parent consent form in 18 languages, kept in step with your English by automatic translation, that fills the registry automatically, a printable paper form with a QR code, an evidence report for every child, a revocation checklist for every channel an image was used on, one shared registry across all your sites, review of embedded YouTube and Vimeo videos, roster import, registry and audit exports, and cleanup tools for large libraries: bulk tagging, page-by-page review, stock auto-sort, staff batches and progress by location. The free plugin is complete on its own and never limits or disables any of its features.

Licensing and optional usage data are handled by Freemius. Nothing is sent unless you opt in, and consent records are never sent anywhere.

== External services ==

Permitly Pro's automatic translation uses the Ostara translation service (translate.ostaraventures.co), run by Ostara Ventures LLC, which translates with Anthropic's Claude. It is used only when you change the English wording of your consent form or turn on a new form language, and only on Pro sites. What is sent: the English lines that changed, the language code, and this site's license install ID with a signature. No family, child or consent information is ever sent. You can turn automatic updates off on the Form languages screen. The service keeps a copy of each translated line so the same text is never translated twice, and a monthly usage count per site. Anthropic privacy policy: https://www.anthropic.com/legal/privacy.

Permitly Pro's optional people check uses the same Ostara service and Anthropic's Claude. It runs only after an administrator turns it on in Settings and agrees to it. What is sent: a downsized copy (768 pixels or smaller) of each image that is live on your website and still needs an answer, plus this site's license install ID with a signature. The AI answers only whether the image shows any person; it does not identify anyone or estimate age. The service keeps no images, only a one-way fingerprint of each file with its answer, and a monthly usage count per site. You can turn it off at any time in Settings.

Not legal advice.

Terms: by downloading, installing, buying or using Permitly you agree to the Permitly Terms of Service and License at https://ostaraventures.co/permitly/terms/. The plugin code is licensed under the GPL (GPLv2 or later), and nothing in the terms limits your rights under the GPL. User manual: https://ostaraventures.co/permitly/manual/.

== Changelog ==

= 0.6.3 =
* Consent Guard is now Permitly. Same plugin, same settings and records; only the name and logo change.
* New logo: a Polaroid with a check, shown beside the wordmark and in the admin menu.
* The parent consent form shortcode is now [permitly_form]. The old [consent_guard_form] keeps working.
* Updated Terms of Service and License; administrators are asked to review them once.

= 0.6.2 =
* People check: error messages no longer repeat "Your images stay in review."

= 0.6.1 =
* The wordmark is now fully blue.

= 0.6.0 =
* Review images now opens on Needs a decision: only images on your website that still need an answer. Images not used on any page, and graphics, sit in their own groups.
* Graphics are sorted automatically: SVG and icon files, very small images, and PNG, GIF or WebP files named like logos or icons. Photos are never sorted by name. Anything sorted automatically can be put back with one click.
* Pro: the people check (optional, AI) sorts out live images that show no person at all, so staff only review images with people. It never estimates age or identifies anyone. Spot-check and Put back are built in.
* Pro: Quick sort shows images with people one at a time, with No people, Adults only, Has kids and Skip buttons, keyboard keys and undo.
* Updated Terms of Service; administrators are asked to agree again.

= 0.5.6 =
* Pro plans now include a number of children in the consent registry: Starter up to 50, Organization up to 300, Association no limit. The Dashboard and Registry show where you stand.
* Over the limit, nothing changes for 14 days. After that, Pro staff tools pause until you upgrade. Hiding photos, the parent form, revocations, the evidence report and every export always keep working.
* The wordmark accent is now blue.

= 0.5.5 =
* Links to the Permitly Terms of Service and License and the user manual on every Permitly screen. Administrators are asked once to agree to the terms; the agreement is recorded in the Activity log.
* Uninstall with "Delete all consent data" now also removes the Parents only page setting.

= 0.5.4 =
* Refreshed wordmark colors.

= 0.5.3 =
* Pro: automatic translation. When you change your English wording, only the lines that changed are translated into every language on your form, with progress on screen. Translated lines are marked "Updated by AI" until a fluent speaker reviews them.
* Turning on a new language fills in any lines that do not match your English yet.
* Lines whose English goes back to the built-in wording go back to the built-in translation with no translation call.
* Built-in monthly limits for every site, shown on the Form languages screen. If a limit is reached or the service is unavailable, the form keeps working with its current wording and the lines stay flagged.
* Turn automatic updates off at any time and update languages with one click instead.

= 0.5.2 =
* Pro: edit the English wording of the consent form, emails and paper form on the Form languages screen, so it matches what your counsel wants. Your wording is kept through plugin updates and can be restored to the built-in wording at any time.
* When the English changes, every translation reviewed before the change is flagged "English changed since review", and reviewers see your current English next to each line.

= 0.5.1 =
* Pro: the consent form now comes in 18 languages: English, Spanish, Chinese (Simplified and Traditional), Vietnamese, Tagalog, Korean, Arabic, Farsi, Russian, Ukrainian, Armenian, Somali, Hmong, Khmer, Haitian Creole, Portuguese and French. Arabic and Farsi read right to left.
* Pro: new Form languages screen. Choose which languages your form offers, review each translation line by line next to the English, fix any wording, and mark it reviewed. Your wording is kept through plugin updates.
* Families pick their language from a list at the top of the form; their emails and the paper form follow. The exact wording in their language is stored with their consent.
* Shortcode option lang="vi" (or any language code) opens the form in that language.

= 0.5.0 =
* Pro: Evidence report. One printable page per child (or save it as a PDF): what the parent agreed to and when, the exact form wording they saw, every change, each tagged photo with when it stopped showing, and the revocation checklist.
* Pro: Spanish consent form. Families switch between English and Español on the form, and their confirmation and receipt emails come in the same language.
* Pro: Printable paper consent form in English or Spanish, with the same wording as the online form and a QR code that opens it on a phone.
* Pro: Share one registry across sites. One site keeps the registry and the parent form; branch or camp sites follow it, sync every hour and update right away when consent changes. Parent names and emails stay on the main site.
* Pro: Embedded videos. Review the YouTube and Vimeo videos on your pages and hide any that show a child without consent.
* Videos in the Media Library are tracked and hidden like photos.
* New [cg_quote child="R-1001"] shortcode: a child's quote, name or story shows only while that child has consent.
* Log a revocation from an email: find the child, record what the parent asked for and the day the email arrived.
* Revocation window: record when a child left the program; the Registry shows until when the family can revoke.
* Parents only pages: photos are not hidden on password-protected or private pages marked Parents only.
* New setting: whether photos of children no one can identify count as Cleared (your counsel's call).
* Changing consent rules in Settings rechecks every photo right away.

= 0.4.2 =
* Whole-site protection now covers every page visitors can reach: the blog index, archives, categories, search results, shop pages, RSS feeds and "load more" content.
* Hidden images are left out of the WordPress REST API, oEmbed cards and Yoast and Rank Math image sitemaps, so they stop appearing in search engines.
* Page caches and CDNs are purged when an image's status changes (WP Rocket, LiteSpeed, W3 Total Cache, WP Super Cache, WP Fastest Cache, SiteGround, Breeze, Nginx Helper, WP Engine, Kinsta, Cloudflare plugin).
* Images served from a CDN, Jetpack or a WebP converter are recognized.
* Hidden photos no longer reveal anything in the page code: status, titles and captions next to them are removed for visitors.
* Children tagged on a photo always decide its status, even if the photo is later tagged as stock or not identifiable.
* New: choose how long consent lasts (until revoked, the program year, or a number of months) and ask families to sign again when the form wording changes.
* Parent form: changes to a child already on file apply only after the parent confirms from their email. Forms that match a roster record go to a new Needs matching list for staff. A "no to everything" that cannot be matched alerts staff right away.
* Parents get an emailed copy of their choices. Every record keeps a full consent history, including the exact form wording the parent saw.
* Taking back consent (Declined after Active, or removing every use) is recorded as a revocation. Removing some uses opens a checklist for those channels.
* Undoing a revocation needs an administrator and a reason. A new revocation gets a new date and reopens its checklist.
* Editing a record only changes the fields you edit, so parent details and form versions are never wiped.
* Registry: delete and merge records, paging for large registries, and an optional retention period.
* Circuit breaker compares against last night and no longer turns the site off: Revoked and Blocked images stay hidden while a large change is held for review.
* Replacing an image's file starts its review over. Deleting an image or page cleans up its links.
* Faster on large libraries: status checks and page scans run in batches, and image lookups are cached.
* Exports are for administrators only, stream in batches with no size limit, and protect against spreadsheet formulas.
* Make permanent keeps block formatting intact.
* Uninstall cleans up fully, including multisite and the demo. Settings has a Remove the demo button.
* Note: Permitly controls what your pages show. A direct link to an image file in your uploads folder still opens that file.

= 0.4.1 =
* New installs start with empty Programs and Locations instead of sample names, so no real photo gets tagged with a placeholder.
* New: a Finish setup card on the Dashboard until your programs and locations are added, with one button straight to the right place in Settings.
* Menus with nothing in them now say so ("No programs yet") and link to Settings. Administrators also get Edit programs and Edit locations shortcuts in the bulk action menu.
* The parent consent form hides the Program field until you have added programs.
* Sites still using the old untouched sample lists are cleared automatically.

= 0.4.0 =
* Pro: Swap photo. On any hidden photo, pick a Cleared photo from the media library to show in its place, on every page that uses the original or on one page only. Best matches (same program, same location, same shape) come first, and only Cleared photos can be chosen.
* Pro: stand-ins are safe by design. The page and the original file are not changed, a stand-in shows only while it is itself Cleared, and the original returns by itself once its consent clears.
* Pro: Make permanent writes the new photo into one page for good, after saving a revision so it can be undone.
* Pro: Swap photo and Remove on every card in Review images.
* New: choose your own placeholder image (for example your logo) in Settings, instead of the gray box.

= 0.3.7 =
* Plugin and author links now point to ostaraventures.co.

= 0.3.6 =
* Publisher is now Ostara Ventures LLC. Plugin and author links point to the Permitly page.

= 0.3.5 =
* Pro: when a parent fills in the consent form again (same registration ID and email), their child's existing record is updated, so every photo already tagged to that child follows the new choices right away.
* Pro: a parent who switches every answer to No after saying Yes is recorded as a revocation, with the checklist and alert email.
* Pro: a form that reuses a registration ID with a different parent email is saved separately and flagged in the activity log, so no one can change another family's choices.
* Pro: roster imports update children already on file (matched by registration ID) instead of adding duplicates. An import never undoes a revocation unless the file says so.
* Fix: roster files without a Status column now import correctly.

= 0.3.4 =
* The Pro tag stays beside the wordmark on phones.
* Centered selection checkboxes on Review images.

= 0.3.3 =
* Demo builder now uses realistic AI-generated example photos (no real children).

= 0.3.2 =
* New look: crisp white screens with one clear job per color. Status colors are tuned for contrast and mean only their status.
* Neutral gray placeholder for hidden images, so it fits any site.
* Small wording fixes.

= 0.3.0 =
* Whole-site picture on the Dashboard.
* Wider scan: CSS background images, images inserted by URL, lightbox links, widgets, menus, theme settings, block templates, synced patterns and sliders.
* Enforcement also swaps background images and linked images, not just image tags.
* Safe whole-site switch with a confirmation screen, and an option to hide only confirmed problems while review is in progress.

= 0.2.0 =
* The parent consent form, revocation checklist, roster import and exports move to Permitly Pro.
* Everything in this plugin is free with no limits.

= 0.1.1 =
* Demo builder: mock photos, fake consent records and password-protected test pages, from Settings.

= 0.1.0 =
* First working build.
