Joryio – Marketing Automation for WooCommerce

Changelog

1.6.41

• Signup forms now need the consent text to subscribe on any channel, email included – forms without it are listed on the Joryio page. A signup form (no consent checkbox) has a new switch, off by default: “Subscribe visitors when they submit this form (no consent checkbox)” – use it only if the form shows a sentence telling visitors they agree to receive messages. Off: the form saves the contact and records the Form Submitted event but subscribes nobody. On: its channels (or its list) and, right under them, “Consent text shown on this form (required)” – the exact sentence visitors see. With the text, every selected channel, email included, is subscribed and the text recorded as the proof (form text, not a ticked box); without it nobody is subscribed. SMS, WhatsApp and Viber still need a phone field. One rule for every channel, because the text is the proof of what the visitor saw and agreed to
• IMPORTANT for existing signup forms: the update turns the switch on for a signup form that has a consent text, or had “Also subscribe SMS / WhatsApp / Viber without a consent checkbox” on – its channels and text are kept (with that option off, its SMS, WhatsApp and Viber, which never subscribed, are taken out of its channels). A signup form with no consent text – including an email-only one that subscribed on every submission – is switched off and subscribes nobody until you turn it on and add the text. Each such form is named in an admin notice on the Plugins screen and the Joryio page, and each of its submissions is logged. A form whose switch is on but has no text gets a warning in its settings, the notice and a log line
• The “Also subscribe SMS / WhatsApp / Viber without a consent checkbox” option (1.6.39) is gone. A signup form with a list keeps the list
• Forms with a consent checkbox are unchanged: the ticked box is the consent and its label is the wording
• Web SDK: the site’s Web push setting is passed to the SDK (webPush), so a visitor’s push permission is reported to Joryio only on a site that uses web push
• Web SDK (in-app messages, web push): with the browser’s storage blocked, the tracker’s visitor id is a shared placeholder and the web SDK made up a new id of its own on every page – one empty profile per page view. It is no longer started when storage is blocked. And when the tracker starts a new visitor id (log out, another customer signs in), the running SDK is first reset (the previous person’s user id, attributes, in-app state and push binding are dropped, as before), then restarted with the tracker’s new id instead of keeping a random one of its own, so the two stay one visitor
• Readme: the install steps name the dashboard’s “Download zip” button and WordPress’s “Add New Plugin” screen

1.6.40

• The plugin’s name is now “Joryio – Marketing Automation for WooCommerce” (it was “Joryio”). It runs on any WordPress site as before, with or without WooCommerce. Nothing else changes: the same folder, settings, connection and updates
• Website forms: a consent box’s wording is cleaned with WordPress’s own wp_strip_all_tags() (WordPress Plugin Check). The text recorded is the same as before

1.6.39

• Website forms: a signup form (no consent box) can carry the consent line its visitors see – “Consent text shown on this form”. It is recorded as the consent wording with every subscription the form makes, marked as form text (consentMethod form_text; a ticked box is checkbox) on the consent record, the subscription history and the Form Submitted event, so the two kinds of proof can always be told apart
• New per-form option, off by default: “Also subscribe SMS / WhatsApp / Viber without a consent checkbox, using the text above as proof”. On, with a text entered, a signup form may subscribe the phone channels of a contact who never unsubscribed. A ticked box is the strong proof SMS and WhatsApp marketing require; text-only consent is weaker – Joryio cannot prove the visitor saw the text. Check the wording with your lawyer (in Israel, section 30A of the Communications Law; Meta’s WhatsApp opt-in policy)
• Unchanged: a phone is required; a form text never re-subscribes someone who unsubscribed and never lifts a STOP, a complaint, a hard bounce or a staff block; SMS double opt-in still applies; an opt-out made by another contact with the same email or phone is not lifted. Needs a Joryio release from 2026-11-09 or later: an older Joryio refuses a submission that carries the form text, and that submission is not recorded. A form without a text is sent exactly as before

1.6.38

• Website forms: consent now subscribes the contact on channels too. With a list, the consent covers the list’s channels exactly as the list is set up in Joryio (for example Email and SMS), and the form settings say “This list covers: …” so the two never disagree. With “No list”, choose the channels under “Consent subscribes to channels”: Email, SMS, WhatsApp, Viber (web push is not offered – browsers ask for it themselves)
• In “Only when a consent field is ticked” mode, ticking the box subscribes those channels; in “This is a signup form – always subscribe” mode, submitting does. SMS, WhatsApp and Viber need a phone field and a ticked consent field with its wording, so a signup form subscribes Email only
• Someone who unsubscribed (from the channel or the list) or whose email or phone is opted out and now ticks the consent field is subscribed again at once by default; the wording, page, time and IP address are recorded and the change is marked as a re-subscribe (channelsResubscribed, listsResubscribed). That proves the submission, not who typed the address; direct re-subscribe is the deliberate default (2026-11-09) and covers the contact’s own unsubscribe only – an opt-out recorded by another contact sharing the email or phone is never lifted by a form (Email gets the confirmation email, SMS, WhatsApp and Viber are not subscribed)
• New per-form option, off by default: “Send a confirmation email before re-subscribing someone who unsubscribed”. On: Email waits for a click on a confirmation email (at most one a day; channelsPending, reason confirmation_sent) and SMS, WhatsApp and Viber are not re-subscribed (needs_confirmation). A signed-in customer of your store (the form carries the plugin’s signed proof) is re-subscribed directly either way
• Never, whatever the option: a signup form (no consent box) re-subscribing anyone, or a form lifting an SMS STOP or other keyword opt-out, a spam complaint, a hard bounce or a block set by Joryio staff
• A list’s channels each go through the same checks; a double opt-in list’s confirmation email subscribes its Email channel only
• Each channel’s subscription history in Joryio shows the proof (wording, page, time, IP address), and the Form Submitted event carries channelsSubscribed, channelsPending, channelsPendingReason, channelsResubscribed and listsResubscribed. Needs a Joryio release from 2026-11-09 or later: an older Joryio refuses a submission that carries channels, and that submission is not recorded. A form with no channels chosen is sent exactly as before

1.6.37

• Website forms: pick instead of typing. Contact Form 7’s attribute box and Elementor’s new “Custom attributes” rows list your Joryio attributes with their type (names and types only, read from Joryio and kept for ten minutes); you can still type a new name. “Refresh lists and attributes from Joryio” (Contact Form 7) and “Refresh attributes from Joryio” (Elementor) read them again. When Joryio cannot be reached, the box is a plain text box, as before
• Elementor: each field box (Email, Phone, First name, Last name, Consent field ID, and each custom attribute’s Form field) lists this form’s own fields by label and type and stores the field’s ID; you can still type an ID. A form saved earlier keeps its field IDs exactly as they are
• “Suggest from this form” (Elementor) and “Suggest from the field types and names” (Contact Form 7) fill the empty boxes from the field types and labels (an email field as Email, a phone field as Phone, First name / Last name labels in English and Hebrew). Nothing is saved until you click Update or Save form settings
• Elementor: custom attributes are now rows (Joryio attribute + Form field). Lines saved before 1.6.37 keep working and are shown under “Custom attributes (saved as lines)” until you empty that box
• Contact Form 7: the mapping table shows each field’s type and placeholder next to its name
• Elementor: the Joryio action’s field IDs and attribute rows are cleaned when the page is saved (an ID keeps only letters, digits, _ and -; an attribute name follows the attribute name rule), and the row titles in the panel show them as text

1.6.36

• Website forms: a custom attribute’s name is now kept exactly as typed when it already is a valid Joryio attribute name (letters, digits and underscores, starting with a letter, at most 64 characters). Type it as Joryio shows it under Data > Attributes: vipTier now writes vipTier. Until now every name was lower-cased, so vipTier silently wrote a second attribute, viptier. Other text is still turned into a lower case name, as before (Company name becomes company_name)
• A Contact Form 7 mapping saved before 1.6.36 keeps working unchanged: it was saved in lower case and keeps writing the lower case attribute (viptier). Nothing is rewritten. To write the camelCase attribute instead, type the name again as Joryio shows it and click Save form settings
• Elementor reads its “Custom attributes” lines as typed on every submission, so a line written with capitals (vipTier = field_1) writes vipTier from this version on (it wrote viptier before). To keep writing the old attribute, type the name in lower case
• A custom attribute named email, phone, firstName or lastName (any case, with or without underscores) now maps the field to the contact’s own email, phone or name, the same as choosing it under “Send as”, instead of writing a second attribute. The email and phone rules are unchanged: a form only fills an empty email or phone of an existing contact (a signed-in customer may update their phone, as since 1.6.34)
• Names Joryio manages itself can no longer be written by a form: predictions (ml_…), activity and device fields (lastEventName, os, …), externalId, and any name starting with $. Contact Form 7 says which ones were not saved; Elementor skips them and notes it in the plugin log. Joryio also ignores these names from older plugin versions

1.6.35

• The web push service worker is now served by WordPress itself at the same address, /joryio-sw.js, generated from your settings. The plugin no longer writes any file to your site folder (WordPress.org review). Browsers that already subscribed keep working: the address is unchanged
• The joryio-sw.js file an earlier version wrote to your site folder is deleted once by this update, and only when it is exactly the file the plugin wrote; a file you changed is left alone
• Some web servers answer .js addresses themselves and never pass a missing file to WordPress. With web push on, the In-app & web push tab now checks the address and says so; ask your host to pass /joryio-sw.js to WordPress
• The storefront’s calls to your site (the typed email, the signed-in customer proof, the queued add-to-cart events) now also carry a WordPress nonce. It is never printed into the page, so full-page caches keep working: the tracking script asks for a fresh one when it needs it
• Saving a settings tab now needs the same permission that opens the page (Manage WooCommerce on a store), and the registration consent box checks the registration form’s own nonce
• The plugin’s admin notices (no API key saved, reconnect after WooCommerce was activated) now show only on the Plugins screen and the Joryio settings page, to users who can act on them. The reconnect notice can be dismissed; the choice is kept per user. Nothing else changes

1.6.34

• A signed-in customer can update their phone number through a website form. When a logged-in customer submits a Contact Form 7 or Elementor form, the plugin now sends a signed proof of who is logged in (the same signed proof the storefront sign-in uses, made on your server and good for that one submission only). When the form’s email belongs to that same customer’s contact in Joryio, the phone typed into the form replaces the contact’s phone; the email never changes this way
• A visitor who is not logged in changes nothing that is already there: the form fills an empty email or phone only, as before. The proof is sent only for a form submitted on your own site (a form posted from another site in the customer’s browser gets none)
• The form’s email and phone are kept on the Form Submitted event in Joryio, so a different phone a visitor typed is no longer lost; the event says whether the contact took it
• Needs a Joryio release later than 2026-11-03 (an older Joryio refuses the new field, and that submission is not recorded); nothing to configure
• A Contact Form 7 form that submits through the WordPress REST API without the REST nonce is seen by WordPress as logged out; it sends no proof and the visitor rule applies
• On a WordPress site without WooCommerce, the In-app & web push settings tab now says “your site” and “visitors” instead of “your store” and “shoppers”
• The “External services” section of the readme now lists everything sent: a ticked form consent box’s wording and the submitter’s IP address (since 1.6.31), the wording, page and IP address with an order’s consent, and the signed-in customer proof sent with a form (1.6.34)
• The “Allow HTML in-app messages” help text and the readme now say exactly what an HTML message can do: it is shown in a separate frame whose Content Security Policy blocks every script written into it; it can show images, fonts and video loaded over HTTPS, but cannot run code on your pages, fetch data or submit forms itself

Earlier versions: see changelog.txt in the plugin folder.