FAQ

Is Toss free?

Lite is, and it is not a trial: a privacy policy and terms of service, on your primary site, with the whole clause library, footer links and a cookie notice, for nothing.

Pro is a one-off $79 with a $59/year renewal, and adds every other document type, all sites and languages, cookie consent with script gating, the acceptance record and its export, update notices, endorsement disclosures, clause overrides, version history and diffs, and the console commands.

Is this legal advice?

No. Toss is software that turns answers about your business into text, from a library written by a developer, not a lawyer. It cannot know your facts, and no plugin can promise that a generated document satisfies a particular regulator on a particular day.

Have a qualified lawyer read anything you publish and rely on. Toss's job is to make that review a short one instead of a blank page.

Which jurisdictions does it cover?

US and English first — CalOPPA, the CCPA as amended by the CPRA, the state privacy-law wave (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the rest), COPPA, DMCA §512, CAN-SPAM, and the FTC endorsement guides. There is a GDPR/UK and a PIPEDA layer for sites that reach further.

A business actually established in the EU wants a purpose-built GDPR document — that is a different plugin.

What documents does it make?

Privacy policy, terms of service, cookie policy, disclaimer, return and refund policy, shipping policy, acceptable use policy, DMCA policy, EULA, affiliate disclosure, and custom legal pages.

Do I have to write anything?

Only if you want to. Answer the questionnaire and the documents follow. You can override any clause's heading or wording, and add sections of your own — an override survives library updates, which is the trade for not getting the improvements to that clause.

What happens when the law changes?

The clause library ships inside the plugin and is stamped with a date, so composer update is how your texts get better. Toss then tells you which policies have fallen behind, and why — naming the clause that changed, or the answer you edited, rather than handing you a wall of diff.

This is the part the WordPress plugin Toss is modelled on does not do: it announces that you updated a page, but nothing updates the text.

Will it change my templates?

No. Policies render through Craft's normal routing, and Toss ships a plain fallback template so a published policy is never a 404. Override it by creating templates/toss/_render/policy.twig — Craft finds yours first.

Does the cookie banner actually block anything?

Yes, and that is the point. Non-essential tags never reach the browser as executable script: they are held as data and promoted only once their category has been granted.

A banner that sets a cookie and lets Google Analytics fire anyway is worse than no banner. It puts a promise in writing, on every page, that the site does not keep.

The caveat is honest: Toss can only gate the tags in its inventory. A snippet pasted into a template is outside it, and the audit says so.

Does it slow the site down?

The renderer never recompiles — it serves stored text. Kit markup is a string operation on the finished response, and the runtime is about 6 KB of inlined CSS and JavaScript with no dependencies. There are no outbound HTTP requests, ever.

Can I prove somebody accepted our terms?

That is what the acceptance record is for. Every acceptance points at one exact published version, with a timestamp, the user where there is one, an opaque browser token, and optionally a hashed IP — never the address itself.

So both questions stay answerable years later: what this customer agreed to on the day they signed up, and who has not accepted the current terms.

Does it work on a multi-site install?

Yes, on Pro. The global questionnaire is your business; a site holds only the answers that differ, so a translated site does not restate the address. Policies are localized elements, so each site has its own text, its own URL and its own version history.

What about GDPR consent records?

Consent decisions are logged against an opaque token with the category set, the revision, the source and a hashed IP. That shows consent was given and to what. It is not a full CMP, and Toss does not claim IAB TCF compliance.

Can I use it with an existing consent tool?

Yes — leave the consent kit off and Toss stops touching your tags entirely. You still get the documents, the cookie table generated from your inventory, footer links and the acceptance record.

What are the requirements?

Craft CMS 5.3 or later, PHP 8.2 or later. No other dependencies.

How do I try Pro?

Install Lite, then switch the edition in Settings → Plugins → Toss to try Pro locally. Craft handles the trial and the licence.