Kurirko

Kurirko is software for online stores — it is not a courier service and does not carry, collect or deliver anything. It connects your WooCommerce store to Pošta Srbije / Post Express using your own contract and credentials. From an order you create a shipment in one click, print the official address label (“adresnica”) and the acceptance book (“prijemna knjiga”), and automatically validate the customer’s address — without retyping anything into a separate courier portal. The premium build then follows every parcel after handover: tracking, the delivery-status column, automatic completion and the customer e-mails.

The plugin’s interface is fully localized to Serbian (Latin and Cyrillic).

Independent plugin. Kurirko is an independent WooCommerce extension. It is NOT a courier, NOT a delivery company and NOT a shipping broker, and it is NOT affiliated with, endorsed by, certified by or a product of any courier company — including any company with a similar name. Kurirko is NOT an official product of JP “Pošta Srbije”; “Pošta Srbije” and “Post Express” are trademarks of their respective owners. Kurirko talks to the courier only through your own business contract and API credentials.

Which couriers are supported?

Today Kurirko ships with Pošta Srbije (Post Express) — fully implemented and tested end-to-end against Pošta’s official WSP WebApi, through the standard B2B onboarding flow under the merchant’s own contract. Kurirko is not certified, endorsed or approved by Pošta; as part of that onboarding Pošta reviews and approves the address label your store prints. Kurirko is built on a courier-agnostic core and further Serbian couriers are in preparation; each one is announced when it has been proven end-to-end, not when work on it starts. When a new courier is added it plugs into the same order workflow you already use.

Do I need a contract?

Yes. Kurirko uses your contract with Pošta and your access to the WSP WebApi service (credentials are requested from Pošta at b2b@posta.rs). Step 1 of the onboarding guide walks you through it. Until you enter credentials the plugin waits quietly — nothing breaks and no data is sent.

Premium

The free build covers the whole sending flow — creating the shipment, address validation, the label and the acceptance book. The premium build adds the volume tools a busy store needs and everything AFTER the parcel is handed over: auto-send when an order reaches “processing”, the “Slanje danas” batch screen that reviews and creates every ready shipment at once (with 4-per-A4 bulk labels or A6 for a thermal printer), several boxes on one order, optional courier services per shipment, parcel tracking with the courier’s delivery status in the orders list and automatic completion of delivered orders, the customer e-mails (tracking number, “your parcel is waiting”), “Spasilac paketa” reminders that chase a COD parcel waiting at the post office before it turns into a return, and a COD ledger that tracks what the courier still owes you. Details: https://kurirko.com

Documentation and troubleshooting: https://kurirko.com/pomoc

Features

• Send a shipment from an order — one click; auto-send on “processing” is available in the premium build.
• Address label (PDF) and acceptance book — print-ready, with barcode and full Cyrillic support.
• Address validation — recognizes and corrects Serbian addresses (Cyrillic/Latin, ordinal street names, ambiguous settlements) and offers one-click fixes.
• Cash on delivery (COD) and declared value — carried on the shipment automatically; optional services the merchant picks (SMS on delivery, return receipt) are available in the premium build.
• Order status at a glance — a traffic-light column in the orders list and the outcome of a send appearing in the order box without a manual refresh.
• Parcel tracking (premium) — hourly status checks, the courier’s delivery status in the orders list, automatic completion of delivered orders, and the customer email with the tracking number.
• Works with both checkouts — classic and Cart/Checkout Blocks — and with High-Performance Order Storage (HPOS).
• Latin and Cyrillic admin interface (a “Pismo/Script” setting).
• Diagnostics — connection test, system report, and a guided test → production onboarding flow.

External services

This plugin connects to external services. What each one does, when, and what data it sends is described below.

The plugin makes NO automatic call to any server of ours. It talks to your courier’s API with the credentials you entered yourself, and to nothing else: there is no phone-home, no analytics, no version ping, no service-health check and no telemetry of any kind. The only other outbound calls are ones you trigger by clicking, and Freemius’ licensing, which is opt-in.

1. Pošta Srbije — WSP WebApi (courier service)

The core function of the plugin. Kurirko contacts Pošta’s WSP WebApi to create shipments, calculate postage, validate addresses and check tracking status. This happens only for orders you act on (manually, or via auto-send that you enable).

• Endpoint (production): https://api.posta.rs/transakcija
• Endpoint (test): http://212.62.32.201/WspWebApi/transakcija
• Note: Pošta’s TEST server has no TLS (http), so test credentials travel unencrypted — use only disposable test accounts in test mode. The production endpoint is always https with certificate verification.
• When data is sent: on address validation (order create/edit), when a shipment is sent, and during periodic status checks (premium tracking).
• What data is sent: the shipment data required for delivery — recipient name, address (city, street, number, postcode), phone and e-mail, weight, declared value and COD amount, the parcel contents, plus the sender details from your settings and your API credentials.
• Terms / privacy policy: https://www.posta.rs/ (contact: b2b@posta.rs)

2. Kurirko support (kurirko.com)

On the Kurirko → Diagnostics page there is a “Copy report and report a problem” button that — and only when you click it — opens the support page in a new tab. There is no automatic call to this service; nothing is sent on page load.

• Address: https://kurirko.com/podrska
• When data is sent: never automatically — only when you click that button.
• What data is sent: only version numbers for support context — plugin, WordPress, WooCommerce and PHP versions — passed as URL parameters (ver, wp, wc, php, src), plus an optional kur parameter: an internal support reference code (order number + short hash); it contains no customer personal data. No personal data, customer data or order data is sent.
• Terms / privacy policy: https://kurirko.com/

3. Freemius (licensing and updates)

The plugin bundles the Freemius SDK, which powers licensing, the optional premium upgrade and update services. Freemius operates in WordPress.org-compliant mode: no usage data is sent unless you explicitly opt in on the one-time activation screen (you can click “Skip”). Freemius may contact its API to manage the opt-in, licenses and premium upgrade information.

• Service: Freemius, Inc. — https://freemius.com/
• Endpoint: https://api.freemius.com/
• When data is sent: when you interact with the activation opt-in, manage a license, or view upgrade/account screens. Anonymous usage data is sent ONLY after you explicitly opt in.
• What data is sent (only if you opt in): site URL, admin e-mail, and technical environment data (WordPress, PHP and plugin versions, active plugins/theme). No customer or order data is sent.
• Terms of Service: https://freemius.com/terms/
• Privacy policy: https://freemius.com/privacy/

Third-party code

Kurirko bundles the following third-party components. Each keeps its own license and copyright notices in the shipped files.

• Freemius WordPress SDK 2.13.4 (vendor/freemius/wordpress-sdk) — licensing, updates and the optional premium upgrade. License: GNU GPL v3.0 only (vendor/freemius/wordpress-sdk/LICENSE.txt). Copyright (c) Freemius, Inc. — https://freemius.com/ — Its bundled PHP API client (vendor/freemius/wordpress-sdk/includes/sdk/) carries its own GNU GPL v2 notice (includes/sdk/LICENSE.txt).
• Composer autoloader (vendor/autoload.php, vendor/composer/) — class autoloading, generated by Composer. License: MIT (vendor/composer/LICENSE). Copyright (c) Nils Adermann, Jordi Boggiano — https://getcomposer.org/
• tFPDF and TTFontFile (src/Pdf/Tfpdf.php, src/Pdf/TtFontFile.php) — PDF generation for the address label and the acceptance book. License: GNU LGPL. Copyright (c) Ian Back, Tycho Veltmeijer; TTFontFile is based on the ReportLab Open Source PDF library. The files are namespaced into Kurirko\Pdf and modified as documented at the top of each file; the original license headers are retained.
• DejaVu Sans / DejaVu Sans Bold (fonts/unifont/) — Cyrillic text rendering in the PDFs. License: Bitstream Vera Fonts Copyright (Bitstream, Inc.; Arev additions (c) Tavmjong Bah; DejaVu changes are in the public domain). The full license text ships with the fonts in fonts/unifont/DejaVu_LICENSE.txt.
• jQuery postMessage v0.5 (vendor/freemius/wordpress-sdk/assets/js/nojquery.ba-postmessage.js) — cross-frame messaging used by the Freemius checkout. Copyright (c) 2009 “Cowboy” Ben Alman, dual licensed MIT and GPL; non-jQuery fork by Jeff Lee. The notice is at the top of the file.
• Freemius Pricing app (vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js) — the React pricing screen inside the SDK. License: MIT. The bundle embeds React 17.0.2 and ReactDOM 17.0.2 (MIT, copyright (c) Facebook, Inc. and its affiliates), scheduler 0.20.2 (MIT), object-assign (MIT, Sindre Sorhus), is-buffer (MIT, Feross Aboukhadijeh) and Font Awesome Free 5.15.4 (icons CC BY 4.0, fonts SIL OFL 1.1, code MIT — https://fontawesome.com/license/free). All of these notices ship next to the bundle in vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js.LICENSE.txt.

Where the bundled minified files come from

Three shipped JavaScript files are compiled or minified. None of them is our code; each is maintained in a public repository, and this is where its source and build tooling live.

• vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js — a webpack build of the Freemius Pricing app. Source and build tools: https://github.com/Freemius/pricing-page (MIT). Its README states the app is shipped as part of the Freemius WordPress SDK from SDK version 2.9.0 onward, and it is built with npm install then npm run build, which writes the bundle into dist/; that output is what the SDK carries under assets/js/pricing/. The accompanying freemius-pricing.js.LICENSE.txt lists every library webpack inlined into it.
• vendor/freemius/wordpress-sdk/assets/js/jquery.form.js — a small helper that builds a hidden form for a redirect POST. It is maintained, in this exact form, in the Freemius WordPress SDK repository at the same path: https://github.com/Freemius/wordpress-sdk (GPL-3.0-only), tag 2.13.4. There is no separate build step; the SDK repository is the file’s development location.
• vendor/freemius/wordpress-sdk/assets/js/postmessage.js — the FS.PostMessage wrapper around nojquery.ba-postmessage.js. Same development location: https://github.com/Freemius/wordpress-sdk, tag 2.13.4, path assets/js/postmessage.js. The unminified companion it wraps ships beside it as nojquery.ba-postmessage.js.

The SDK is bundled through Composer (composer.json in the plugin root pins freemius/wordpress-sdk), so the exact commit that produced the shipped copy is recorded in vendor/composer/installed.json.

License of the combined work

Our own code — the plugin’s source, apart from the bundled third-party components listed above — is licensed under the GNU GPL, version 2 or later (https://www.gnu.org/licenses/gpl-2.0.html). That is what the license field of composer.json declares, and it is what makes the combination below possible.

What you install is that code together with the bundled Freemius SDK, which is GPL-3.0-only. GPLv2-or-later code combined with GPLv3-only code is distributable under version 3, so the plugin as distributed — the combined work in this ZIP — is licensed under the GNU GPL version 3 and cannot be offered as “version 3 or later”. That is what License: GPLv3 at the top of this readme and License: GPL-3.0 in the kurirko.php header both declare (the same license, two spellings), and a copy of the GPL v3 ships with the plugin as license.txt. Taken on its own, our code stays GPL-2.0-or-later.