PagePin: Visual Client Feedback & Bug Reporting

Descripció

PagePin is a visual feedback plugin for WordPress. Your team and your clients mark problems directly on the live page, either as annotated screenshots for bug reports (Pinshots) or as comment threads pinned to page elements (Pinpoints). Screenshots, comments and guest accounts stay in your own WordPress database and uploads folder. There is no SaaS account to create, clients can take part without a WordPress account, and the plugin makes no external requests unless you turn on a CAPTCHA or add a webhook endpoint.

Many visual feedback tools for WordPress connect your site to an external service that stores the feedback. PagePin is the complete tool inside WordPress: capture, discussion, notifications and the admin overview run on your server.

How it works

1. Pin: Press Ctrl+Alt+F (Cmd+Option+F on Mac) or click the floating feedback button.
2. Capture: Place markers, add notes, and PagePin takes the screenshot with page URL, time, browser, operating system and viewport size.
3. Ship: The Pinshot is saved in WordPress and goes out by email with one click in the Pinshot list, or the discussion continues in a Pinpoint thread.

Pinshots: annotated screenshots for bug reports

A Pinshot is a screenshot of the current page with numbered markers and notes, saved in WordPress and sent by email to the people who fix the problem.

• Three marker types: Negative (red) for bugs, Positive (green) for approvals, Note (orange) for comments. Keys 1, 2 and 3 switch between them.
• Context included: page URL, time, browser with operating system, viewport size and device pixel ratio are recorded with every Pinshot.
• Two capture methods: the Screen Capture API of the browser (it asks for permission first) and html2canvas as fallback.
• Email delivery: up to 5 recipients and a custom subject line, the screenshot is attached. Pinshots from your team are sent from the Pinshot list, public feedback goes out right away.
• Watermark and compression: optional watermark text on every screenshot, image quality from 10 to 100 percent.
• Undo and redo: Ctrl+Z and Ctrl+Y (Cmd+Z and Cmd+Shift+Z on Mac). Markers can be dragged to a new position, on touch screens too.
• Status tracking: the Pinshot list in the admin has paging, filters, status and bulk actions.
• Assignee, priority and due date: assign a Pinshot to an administrator, set its priority and a due date. Overdue Pinshots are marked in the list.

Pinpoints: comments pinned to page elements

A Pinpoint is a comment thread attached to one element of a page, comparable to comments in a shared document, but on the live website.

• Click to comment: click any element to start a thread on it. Numbered badges on the page show where threads are.
• Element matching: a thread finds its element again by CSS selector, XPath and text preview. If the element is gone, the thread is marked instead of being attached to the wrong place.
• @mentions: mention team members or guests to notify them by email.
• Resolve and reopen: close a thread when the change is done, reopen it when needed.
• Assignee, priority and due date: set them right in the thread. The assigned person gets an email, overdue threads are marked in the sidebar, the list and the editor metabox.
• Internal comments: tick «Internal comment» and only your team sees the reply. Guests, guest emails and share links never get it.
• Sidebar: all Pinpoints of the site in a slide-out list with unread badges.
• Tags: Bug, Design, Content, Urgent or your own tags, each with its own color.
• Editor metabox: the post and page editor shows how many Pinpoints a page has.

Guests and collaborators without a WordPress account

A collaborator is a person without a WordPress account who gets access to selected Pinpoints through a personal magic link. Collaborators are off by default; turn them on under PagePin > Settings > Collaborators.

• Invite by email or link: the share dialog sends a magic link by email or creates a link you pass on yourself.
• Reuse guests: give an existing guest access to more Pinpoints without a new link.
• Mention to invite: mentioning a guest with @ grants access to that thread if they do not have it yet.
• Notifications: everyone in a thread, guests included, is notified of new comments.
• Link expiry: magic links do not expire by default, or expire after 7, 30 or 90 days.
• Share links for single threads: optional. Anyone with such a link can read and reply in that thread.

Guests can read and reply in the threads they were given and use @mentions. They cannot open new threads, and the @mention list does not show them user logins or the email addresses of other guests. They do not see internal comments, the assignee, the priority or the due date.

Public feedback from visitors

Public feedback mode lets visitors without an account send Pinshots from your site. It is off by default.

• The visitor gives an email address (required by default) and agrees to the processing of the data before sending.
• Spam protection: honeypot field, a minimum time before sending, a limit of submissions per hour and IP address (10 by default).
• Optional CAPTCHA: Google reCAPTCHA v2 or v3, hCaptcha or Cloudflare Turnstile.

Privacy and accessibility

PagePin is built for GDPR: all data is processed and stored on your own server.

• No external requests: no CDN, no external fonts, no tracking, no analytics. The only exceptions are a CAPTCHA provider and webhook endpoints, both only when you set them up yourself.
• No Gravatar: avatars are local initials. Email addresses typed into the invite search stay on your server.
• IP addresses: public reports are rate limited with a keyed hash of the IP address, kept in a transient for at most one hour and never stored with the feedback.
• Screenshots: stored in /wp-content/uploads/pagepin/, not in the Media Library.
• Clean uninstall: deleting the plugin removes its tables, options and screenshot folder.
• Keyboard and screen readers: dialogs open and close with the keyboard, Esc closes them, the focus stays inside and returns to the button that opened them. Markers work with Enter and Space.
• Contrast: contrast and focus rings follow WCAG 2.2 AA.

For agencies and developers

PagePin fits agencies that collect client feedback during a website project, and developers who need bug reports with the context to reproduce them.

• Roles: Pinshots for Administrators by default, other roles can be added. Pinpoints have separate create, view and resolve rights per role.
• Admin overview: dashboard with key numbers, your open assignments, overdue items and the latest Pinshots and Pinpoints, an admin bar counter, and a Next steps checklist after activation.
• Filters and sorting: both lists filter by assignee («Assigned to me», «Not assigned»), priority and due date, and sort by priority and due date.
• Collaborator and tag management: guest list with type, inline email editing and access control; tags with colors and usage counts.
• Webhooks: up to 10 HTTPS endpoints receive signed JSON for new, changed and deleted Pinshots and Pinpoints and for changes of assignee, priority and due date, with an event filter, a test button, retries and a delivery log. Internal comments are only sent to endpoints where you allow it. A Slack compatible text format works with Slack and Discord.
• Developer hook: the pagepin_event action fires for every event, with or without webhooks.
• Proxy support: the pagepin_trusted_proxy_headers filter names the header your reverse proxy or CDN sets.
• Languages: English and German included, ready for translation.
• Code quality: WordPress Coding Standards (WPCS 3.0) and PHPStan level 5.

What PagePin does not do

PagePin does not record video and has no built-in connectors for project management tools. Feedback stays in WordPress and reaches you by email, in the admin and, if you set them up, through webhooks to an endpoint of your choice.

More at pagepin.io.

Support

• Website: pagepin.io
• Support: service@pagepin.io

External services

PagePin connects to an external service ONLY when you turn on CAPTCHA protection for public feedback and select a provider, or when you add a webhook endpoint. The provider’s script then loads in the public feedback dialog, and the visitor’s answer is checked on the provider’s server when the feedback is sent.

Webhook endpoints

When you add an endpoint under Settings > Webhooks, PagePin sends the events you select to that address: page URL, screenshot URL, message, markers, status, tags, author name, browser and viewport, and author email addresses only if you turn that on. The service behind the address is chosen by you; its privacy policy and terms apply.

Google reCAPTCHA (v2 or v3)

When enabled, user interaction data is sent to Google for spam verification.
* Service: https://www.google.com/recaptcha/
* Privacy Policy: https://policies.google.com/privacy
* Terms of Service: https://policies.google.com/terms

hCaptcha

When enabled, user interaction data is sent to hCaptcha for spam verification.
* Service: https://www.hcaptcha.com/
* Privacy Policy: https://www.hcaptcha.com/privacy
* Terms of Service: https://www.hcaptcha.com/terms

Cloudflare Turnstile

When enabled, user interaction data is sent to Cloudflare for spam verification.
* Service: https://www.cloudflare.com/products/turnstile/
* Privacy Policy: https://www.cloudflare.com/privacypolicy/
* Terms of Service: https://www.cloudflare.com/website-terms/

Important: No data is sent to external services unless you explicitly enable CAPTCHA or add a webhook endpoint in the plugin settings. Without them, the plugin operates entirely on your own server.

Privacy

Data Collection

This plugin collects and stores the following data locally on your WordPress server:

For authenticated users (logged-in):
* User ID (WordPress user reference)
* Feedback content (screenshots, markers, messages)
* Page URL where feedback was submitted
* Timestamp
* Browser name with major version and operating system, viewport size and device pixel ratio (Pinshots only, the full user agent string is not stored)

For public/anonymous feedback (when enabled):
* Email address (if provided by the visitor)
* IP address (for rate limiting only, kept as a keyed hash in a transient and never stored with the feedback)
* Session token (anonymous identifier)
* Feedback content (screenshots, markers, messages)
* Page URL and timestamp
* Browser name with major version and operating system, viewport size and device pixel ratio

For assignments:
* User ID of the assigned person, priority and due date of a Pinshot or Pinpoint
* The assigned person receives an email with the page URL, priority and due date

For external collaborators (when enabled):
* Display name
* Email address (optional, for Magic Link invitations and @mention notifications)
* Authentication token (for session-based access)
* Access grants (which pinpoints the collaborator can view)
* Last access timestamp

Data Retention

• Feedback data: Stored until manually deleted by an administrator
• Rate limiting data (IP hash): Kept in a transient that expires at most one hour after the last attempt.
• Screenshots: Stored until feedback is deleted
• Collaborator data: Stored until manually deleted by an administrator

Data Location

• Database: WordPress database tables (prefixed with your WordPress table prefix)
• Screenshots: /wp-content/uploads/pagepin/ directory

GDPR Compliance

• All data is stored locally on your server
• No analytics or tracking is performed
• No data is shared with third parties (unless CAPTCHA is enabled or a webhook endpoint is added)
• Feedback, comments and collaborators can be deleted in the WordPress admin
• IP addresses are pseudonymized (keyed hash) before they are stored for rate limiting

Consent

For public feedback mode, we recommend:
* Linking to your privacy policy in the feedback form
* Informing visitors about data collection in your site’s privacy policy