=== StayCrypto ===
Contributors: alekssuh1981
Tags: cryptocurrency, payment gateway, woocommerce, usdt, crypto
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 0.9.28
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Accept USDT and USDC payments in WooCommerce directly to your own wallet — non-custodial, no intermediary server, no registration.

== Description ==

StayCrypto is a non-custodial crypto payment gateway for WooCommerce. Buyers pay in USDT or USDC straight to the store owner's own wallet address — there is no intermediary, no custodial server, and no account to register anywhere. The plugin itself watches the blockchain and matches incoming transfers to orders awaiting payment.

**Supported networks and coins:**

* BNB Chain (BEP-20) — USDT, USDC
* Polygon — USDT, USDC (both native USDC and bridged USDC.e are recognized)
* Ethereum (ERC-20) — USDT, USDC
* Tron (TRC-20) — USDT

**How it works:**

1. The buyer selects crypto payment at checkout and picks a network and coin.
2. The plugin shows the exact amount (with a unique decimal "tail" that identifies the order), the wallet address, and a QR code.
3. The plugin scans the blockchain via a public RPC node. When the transfer is found and confirmed, the order is completed automatically through the standard WooCommerce flow.
4. If a payment arrives with a wrong amount or cannot be matched to an order, nothing is credited automatically — the store owner gets a notification and decides manually.

**Features:**

* Non-custodial: funds go directly from the buyer to your wallet.
* Works with both the classic checkout and WooCommerce Checkout Blocks; HPOS (custom order tables) compatible.
* Automatic exchange-rate conversion for stores that use a non-USD currency, with a plausibility check and a manual fallback rate.
* Optional Telegram notifications about received and unmatched payments (you create your own bot; disabled until you configure it).
* Redundant public RPC endpoints per network with automatic failover; you can set your own node.
* A background cron safety net re-checks pending orders every 2 minutes in case the buyer closes the payment page early.
* Order-page widgets for manually confirming or rejecting unmatched payments, plus an "Unassigned payments" list so no transfer is forgotten.
* By default, uninstalling the plugin keeps your data; full cleanup on uninstall is a separate opt-in setting.

**Requirements:** WooCommerce 7.0+ and the PHP extension `bcmath` (the plugin checks for it and explains what to do if it is missing).

== External services ==

The plugin connects to the following external services. No personal buyer data (name, e-mail, address) is ever sent to any of them.

**1. Public blockchain RPC nodes (required)**

To find incoming payments, the plugin queries public JSON-RPC endpoints of the supported blockchains. It sends: the store wallet address you entered in settings, block numbers, and standard read-only blockchain queries. This happens while an order is awaiting payment and during the periodic background check.

Each network has several endpoints. They are tried in the order listed below, and the next one is used only when the one before it does not answer, so on a normal day a store contacts the first one or two. If you enter your own node on the StayCrypto → Status page, it is queried first and these remain as fallbacks.

BNB Chain:

* rpc-bsc.48.club — 48 Club ([service](https://48.club)) — [terms of use](https://docs.48.club/terms-of-use). No separate privacy policy is published; how request data is handled is stated inside those terms.
* public-bsc.nownodes.io — NOWNodes ([service](https://nownodes.io)) — [terms of use](https://nownodes.io/assets/data/TOS.pdf), [privacy policy](https://nownodes.io/assets/data/privacy-pol.pdf). A separate [service agreement](https://nownodes.io/assets/data/service-agreement.pdf) covers account holders; this plugin uses the public endpoint without an account.
* bsc-rpc.publicnode.com — [service](https://publicnode.com) — [privacy policy](https://publicnode.com/privacy)
* bsc.rpc.blxrbdn.com — bloXroute Labs ([service](https://bloxroute.com)) — [terms of use](https://bloxroute.com/wp-content/uploads/2025/11/bloXroute-Labs-Inc-Terms-of-Use_11_21_2025.docx.pdf), [privacy policy](https://bloxroute.com/wp-content/uploads/2021/12/bloXroute-Privacy-Policy-04-01-2019-Final.pdf)

Ethereum:

* ethereum.publicnode.com — [service](https://publicnode.com) — [privacy policy](https://publicnode.com/privacy)
* mainnet.gateway.tenderly.co — [service](https://tenderly.co) — [terms of service](https://tenderly.co/terms-of-service)
* eth.drpc.org — [service](https://drpc.org) — [terms of service](https://drpc.org/terms)
* public-eth.nownodes.io — NOWNodes ([service](https://nownodes.io)) — same as the NOWNodes endpoint under BNB Chain above.
* 0xrpc.io — [service](https://0xrpc.io) — [privacy policy](https://0xrpc.io/privacy). No separate terms of use are published.

Polygon:

* polygon.gateway.tenderly.co — [service](https://tenderly.co) — [terms of service](https://tenderly.co/terms-of-service)
* polygon.drpc.org — [service](https://drpc.org) — [terms of service](https://drpc.org/terms)
* rpc.sentio.xyz — Sentio XYZ Inc. ([service](https://www.sentio.xyz)) — [terms and privacy](https://www.sentio.xyz/terms/), published as one combined page
* polygon-bor-rpc.publicnode.com — [service](https://publicnode.com) — [privacy policy](https://publicnode.com/privacy)

Tron:

* tron-evm-rpc.publicnode.com — [service](https://publicnode.com) — [privacy policy](https://publicnode.com/privacy)
* api.trongrid.io — [service](https://www.trongrid.io) — [terms of use](https://www.trongrid.io/terms)
* tron.api.pocket.network — Pocket Network ([service](https://pokt.network)) — [terms of use](https://pokt.network/terms-of-use/)
* tron-rpc.publicnode.com — [service](https://publicnode.com) — [privacy policy](https://publicnode.com/privacy)
* tron.drpc.org — [service](https://drpc.org) — [terms of service](https://drpc.org/terms)

**Every endpoint above publishes terms you can read**

That is a checked fact rather than an assumption, and it was wrong here until 19 September 2026.

Until that day this section named three providers as publishing nothing that could be linked to, and one of the three — NOWNodes — does publish both, at the links given above. The pages were looked for on 15 September and not found; they were found on the second look. The other two providers, Fastnode and MEV-X, publish nothing readable, and the directory requires the terms of every API a plugin uses to be verifiable, so their endpoints were removed from the plugin rather than explained away. A store that had already saved either of them has it taken out of its list on upgrade.

What reaches the nodes that remain is the same as it ever was: the store wallet address from your settings, block numbers, and read-only blockchain queries. No order data, no buyer data, no site address, no account and no API key — these requests carry the plugin's own user-agent string, not the WordPress default one that names your site.

If you would rather choose the node your store talks to, enter your own on the StayCrypto → Status page: it is then queried first, ahead of every endpoint listed here.

**2. Exchange-rate services (used only if the store currency is not USD)**

To convert the order total to USD, the plugin fetches the current rate in the background, roughly once or twice a day. Only the store currency code is sent — no order or buyer data, and no site address: like every other request this plugin makes, it carries the plugin's own signature rather than the WordPress default one, which names the site it is sent from.

The timing follows whichever source answered: the primary one states in its reply when its figure is next recalculated, and the fallback publishes on the European Central Bank's timetable (working days, around 16:00 CET). The second source is contacted only when the first one does not answer.

* Primary: [open.er-api.com](https://open.er-api.com) — [Terms of use](https://www.exchangerate-api.com/terms)
* Fallback: [api.frankfurter.app](https://frankfurter.dev) — an open-source service publishing European Central Bank reference rates. These cover about thirty major currencies; for a store priced in any other currency (the Kazakhstani tenge, for example) set a fallback rate on the StayCrypto → Status page. No terms-of-use or privacy page is published; the project states that the API itself collects no personal data, and that the public instance runs behind Cloudflare, which records basic request information. Source code: [github.com/lineofflight/frankfurter](https://github.com/lineofflight/frankfurter).

**3. Telegram Bot API (optional, disabled by default)**

If — and only if — you enter your own Telegram bot token and chat ID in the settings, the plugin sends notifications through api.telegram.org: order numbers, payment amounts and admin links for paid or unmatched payments. Nothing is sent until you configure this yourself, and these requests carry the plugin's own signature rather than the WordPress default one that names your site. [Telegram Terms of Service](https://telegram.org/tos), [Privacy Policy](https://telegram.org/privacy).

== Third-party libraries ==

* [QR Code Generator for JavaScript](https://github.com/kazuhikoarase/qrcode-generator) by Kazuhiko Arase — MIT license, bundled unminified in `assets/js/qrcode.js`. The full licence text, including the permission notice the MIT licence requires to travel with every copy, is in `assets/js/qrcode.LICENSE.txt` next to it.

== Wallet recommendations and affiliate disclosure ==

The admin-only "Wallets and recommendations" page describes several hardware wallets and links once to staycrypto.money, the plugin author site, where those wallets can be bought. Those links carry the author referral parameters and may earn a commission at no extra cost to you; the plugin itself carries none, and nothing about your store or your buyers is sent when the page is opened. The plugin is fully functional without ever visiting this page.

== Installation ==

1. Install and activate WooCommerce (7.0 or newer).
2. Install the plugin through the WordPress "Plugins → Add New" screen, or upload the `staycrypto` folder to `/wp-content/plugins/`.
3. Activate the plugin.
4. Go to WooCommerce → Settings → Payments → StayCrypto, enable the method and enter your wallet address for each network you want to accept.
5. Check the StayCrypto → Status page: exchange rate, RPC nodes, and the cron safety net status are all shown there.
6. (Recommended) Configure an external cron trigger for `wp-cron.php` so the background payment check runs reliably on low-traffic stores.

== Frequently Asked Questions ==

= Is this custodial? Do you ever hold my money? =

No. Payments go from the buyer's wallet directly to the wallet address you configured. The plugin only reads the blockchain to detect them; it has no access to your funds or keys.

= Which wallet address should I use? =

A dedicated address used only for store payments, ideally from a hardware (cold) wallet. The plugin matches payments to orders by amount, so unrelated transfers to the same address can cause confusion.

Use one address for one store only. Two stores sharing an address do not know about each other: both may issue the same amount at the same time, and one payment would then mark an order as paid in each of them.

= The payment method does not appear at all. Why? =

Your hosting is probably missing the `bcmath` PHP extension. The plugin shows an admin notice saying so; ask your host to enable it.

= Why is the amount a little higher than the price? =

Every invoice gets a unique "tail" of a few cents on top of the converted price, so that each order's payment can be told from the others by amount alone. The tail is up to 0.60 USD and usually around 0.15 USD, and it stays with the store. Because that is a noticeable share of a very small price, the method is not offered for orders under 1 USD.

= What happens if the buyer sends the wrong amount? =

Amounts are matched to the cent: a payment equal to the expected amount, or above it by less than one cent, counts as exact. One that is short, even slightly, does not — only a millionth of a unit is forgiven, which is what a wallet or exchange may trim off the last decimal place. Anything further off is not credited automatically. You get a notification, and the order page shows the expected and received amounts with buttons to confirm or reject the payment manually.

= What happens if the buyer sends a different coin than the invoice asked for? =

The plugin looks for the coins that waiting orders have asked for, and for half an hour after an order closes. So a transfer in a different coin — even for exactly the same amount — is normally not seen: it does not pay the order, does not appear on the "Unassigned payments" page and sends no notification. If, at that moment, another order is waiting for that same coin, the plugin does see the transfer; when the amount is exactly right, it is held on the order for you to decide, and you are notified. Either way the money is on your wallet, and the payment page tells the buyer to pay in the chosen coin only. If a buyer says they paid and nothing shows up, check the wallet on a block explorer.

= Does the plugin watch my wallet all the time? =

Only while at least one order is waiting for payment. If there are no pending crypto orders at all, the background scan pauses to avoid hammering RPC nodes for nothing; it resumes as soon as the next order is created, starting from the current blockchain height. Any transfer sent to your wallet during a pause without a matching order (for example, testing, or a mistaken transfer) will not be picked up automatically and will not appear on the "Unassigned payments" page — check your wallet's history on a block explorer directly if you send funds outside of a normal checkout.

= What is deleted when I uninstall the plugin? =

By default only temporary technical flags. Wallets, settings and payment history are kept unless you enable the "Delete all StayCrypto data" option in settings before uninstalling.

== Changelog ==

= 0.9.28 =
* First release in the WordPress.org plugin directory.
* Accepts USDT and USDC on BNB Chain, Polygon, Ethereum and Tron, paid straight to the shop's own wallet — non-custodial, with no intermediary server and no registration anywhere.
* Works with the classic checkout and with Checkout Blocks, and with both of WooCommerce's order storage schemes.
* Tells the shop owner when money needs attention: an amount that did not match, a payment that arrived while the order stayed unpaid, a transfer nobody was waiting for, exchange-rate sources going quiet, and the background payment check falling behind or losing its schedule.
* Warns on the Status screen when the shop sends its e-mail from a domain other than its own — a default that quietly sends payment notices to the buyer's spam folder.
* Warns on the Status screen when a network is left with a single node address: nearly every check the plugin makes against a node that answers wrongly is a second node, and with one address there is nothing to compare against.
* Notifications by e-mail and Telegram.

Versions 0.9.0 to 0.9.27 were never published; their development history is kept in CHANGELOG-PRERELEASE.md in the plugin's source repository, out of the shipped package.

== Upgrade Notice ==

= 0.9.28 =
First release in the directory — there is no earlier version to upgrade from.
