Notification widgets grab attention, but hosted SaaS tools ship a “manual notification” box — and since 2024 the FTC’s reviews rule (16 CFR 465) and the EU Omnibus Directive make fake signals a real legal risk. This kit inverts the model: a 15 KB embed widget whose only data source is a feed worker on your own Cloudflare account, fed by HMAC-verified Shopify/Stripe webhooks. No name lists, no randomizer, no manual entry. One payment of $28 — then it’s yours forever.
Get the kit — $28The popup as your visitors see it — verified tag + real timestamp on every event. Demo feeds always wear the badge; it cannot be hidden.
One zip — code, integrations, compliance docs and a launch playbook. Nothing to install on your visitors’ browsers beyond one 15 KB file, and nothing phones home to a vendor.
Vanilla JS with Shadow DOM isolation, four corners, light/dark themes, pace and frequency caps, dismiss remembered per session. Configured via data-* attributes — no build step.
A single-file Cloudflare Worker receives Shopify orders and Stripe payments, verifies HMAC signatures, and serves the public JSON feed, an audit log and a dashboard. Free plan is enough.
Exact webhook setup guides for both platforms plus a Shopify theme snippet with settings for feed URL, language and position. Every payload mapped to visitor-safe display fields.
COMPLIANCE-2026.md summarizes FTC 16 CFR 465 (in force Oct 2024), the EU Omnibus review-transparency rules (since 2022), EmpCo context, plus a 10-point self-audit checklist for your store.
SETUP.md walks through D1 creation, worker deploy, webhook wiring and the embed snippet — with a verification step after every stage.
PLAYBOOK-14D takes the widget live and verified on your store in a fortnight, with a measurement baseline; pitch-and-pricing.md is a one-page agency pitch (EN).
Most tools ship a “create notification” form. This kit refuses to have one. Four structural guarantees — each enforced in code and re-checked by the kit’s own automated build tests:
There is no endpoint, form or API to invent an event. Shopify and Stripe payloads must carry a valid HMAC signature — unsigned or tampered requests are refused with 403.
The widget, worker and dashboard contain no Math.random, no name lists, no city lists — the build gate greps the shipped bytes and fails the build if any appear.
The built-in sample feed flags every event demo:true and the widget paints a loud “Demo — sample data” badge. There is no code path that hides the badge.
Each event keeps its source id, source platform, receive time and a dedupe key in a D1 database you own — so any notification on your site can be traced and proven.
About half an hour with the included SETUP.md. You need a (free) Cloudflare account and the ability to edit your site’s HTML or Shopify theme.
One wrangler command from the kit’s worker/ folder creates your feed, audit log and dashboard on your own Cloudflare account — free plan is enough.
npx wrangler deploy
Paste one webhook URL into Shopify, one into Stripe (guides included). Both are HMAC-verified — unsigned requests never reach the feed.
POST https://your-worker.workers.dev/hook/shopify/your-site
Add the embed to your theme. From then on, every popup corresponds to a real, auditable event in your own database.
<script src="/social-proof.js" data-feed="https://your-worker.workers.dev/f/your-site" async></script>
No tiers, no per-visitor meters, no account on anyone else’s server. You deploy it, you own it.
14-day money-back guarantee — email us within 14 days and you get a full refund, no forms, no interrogation.
Anything else? Email zicula06@gmail.com — every message gets a personal reply.
One zip, one payment, your own infrastructure — and every popup on your site traceable to a real event.