=== PrivacyHood Payments for WooCommerce ===
Contributors: privacyhood
Tags: woocommerce, payments, crypto, privacy, usdg, stablecoin, web3
Requires at least: 6.0
Tested up to: 6.6
Requires PHP: 7.4
WC requires at least: 7.0
WC tested up to: 9.3
Stable tag: 1.0.0
License: MIT
License URI: https://opensource.org/licenses/MIT

Accept private USDG payments on Robinhood Chain. Customers pay through a shielded pool, so their wallet is never linked on-chain to your payout address.

== Description ==

PrivacyHood Payments adds a private crypto checkout to your WooCommerce store. When a customer chooses it, they are sent to a hosted PrivacyHood checkout, pay in USDG (a USD-pegged stablecoin), and the funds route through a shielded privacy pool before landing at your payout address — so there is no on-chain link between your customer and you.

Your order is marked paid automatically by a **cryptographically signed webhook**. No polling, no manual reconciliation, and no funds ever touch your server — the plugin only speaks HTTPS to the PrivacyHood API and verifies one signature.

**What you need**

* A payout address (any 0x wallet on Robinhood Chain).
* A merchant API key — mint one for free at https://www.privacyhood.org/merchant (no signup, no KYC).
* A store reachable over public HTTPS (webhooks can't reach localhost).

**How it works**

1. At checkout the plugin creates an invoice on the PrivacyHood API for the order total.
2. The customer is redirected to the hosted checkout and pays in USDG.
3. PrivacyHood sends a signed `invoice.paid` webhook; the plugin verifies the signature against that invoice's secret, re-checks the amount, and completes the order.

Full API reference: https://www.privacyhood.org/docs

**Currency (v1):** USDG is a USD-pegged stablecoin and is charged 1:1, so this version supports **USD stores only** — on any other store currency the method is hidden at checkout rather than mis-charging. Orders must be between 1 and 10,000 USDG.

**Security:** the API key is stored server-side and never sent to the browser. The webhook secret is per-invoice, stored on the order, and every webhook is verified with a constant-time HMAC-SHA256 check before an order is ever completed. The plugin re-checks the settled amount and recipient against what it recorded — an order is never fulfilled on an event's word alone.

== Installation ==

1. In WordPress admin: Plugins → Add New → Upload Plugin, and upload the plugin ZIP. Activate it.
2. Go to WooCommerce → Settings → Payments → PrivacyHood → Manage.
3. Enable it, paste your **API key** and your **payout address**, and save.
4. Place a test order to confirm the redirect and the paid-status webhook.

The webhook URL is configured automatically (it is your store's `?wc-api=privacyhood` callback) — it is shown on the settings screen for reference. Nothing to paste on the PrivacyHood side.

== Frequently Asked Questions ==

= Do I need a PrivacyHood account? =
No. Mint an API key at privacyhood.org/merchant — there is no signup or KYC.

= Where do the funds go? =
Directly to the payout address you configure. The customer covers the network fee, so a 25 USDG order pays you a full 25 USDG.

= Can I test on a local store? =
You can reach the checkout, but the paid webhook cannot be delivered to localhost. Use a public HTTPS URL (a tunnel like ngrok works) to test the full flow.

= What if the customer never pays? =
The order stays "pending payment" and no webhook fires. Nothing is fulfilled.

== Changelog ==

= 1.0.0 =
* Initial release: offsite USDG checkout, signed `invoice.paid` webhook with amount + recipient re-checks, classic and block checkout support, HPOS compatible.
