MontraFolio

MontraFolio gives every user of the site an image portfolio of their own, and lets staff run shared portfolios — events, trips, campaigns — with designated contributors.

• Portfolio, collection, image. A portfolio has one owner and any number of collections; each collection holds images and can be visible or hidden.
• Private by construction. Nothing goes to the Media Library. Files live in a folder the web server does not serve; the plugin checks who may see each image before delivering it.
• Mobile first. Camera and gallery uploads from a mobile device, images resized on the device, reorder by touch, carousel by swipe. Folder drag-and-drop on a desktop feeds the same pipeline.
• A page for the portfolio, a gallery for each collection. The portfolio page presents the cover, the owner and a full description, then its collections as cards. Each collection shows its images as tiles or a carousel: visitors switch between the two, the collection decides which modes are available and which opens first.
• Chronological order. Images can be ordered by their original capture time, across contributors.
• Owners and contributors. One owner administers a portfolio; contributors publish in the collections they were given, or in all of them.
• Limits at four levels. The site sets what a new portfolio and a new collection are born with; from there the portfolio carries its own storage and image ceilings, a collection may narrow them, and each contributor may be narrowed further. No level ever grants more than the level above it, and lowering one deletes nothing — it only narrows the next upload.
• Videos in a collection. Paste the address of a video on YouTube, Vimeo, Dailymotion or TikTok and it takes its place among the images, in the same order, with the same caption and observation. Only its thumbnail is stored here; by default the public page contacts nobody until a visitor presses play.
• Videos on networks that answer nobody. Instagram, Facebook and LinkedIn answer no plugin about an address, so nothing is asked of them: you paste the address, choose the picture the card will show, and the card opens the video in a new tab. Those networks are never contacted by this site — not when you add the video, not when a visitor looks at the collection.
• No telemetry, ever. Sign-in with WordPress accounts; optional single sign-on through any plugin that hooks the WordPress login. The only requests that ever leave the site are the ones videos need, listed under External services.

• Interface in English, Portuguese and Spanish, independently of the WordPress language.

• In any page of the theme. Three blocks, each with a shortcode: a collection with its lightbox, the collections of a portfolio, and the descriptions of either.

• Personal data under control. Images are stored without camera metadata; the personal data export of WordPress includes the plugin’s data; a retention rule can remove unused personal portfolios, warning their owners a long time before and letting them keep them with one button; the privacy policy paragraphs are suggested under Settings → Privacy.
• Accessible. Keyboard, screen readers, reduced motion and AA contrast on the public pages and in the portfolio area.

Everything described above is in this version and covered by tests: the portfolio area (sign-in, content terms, portfolios, collections, contributors, uploads, limits), the private storage and the image delivery, the public pages and the three blocks with their shortcodes, the wp-admin management screens (the portfolios list with its filters, creation of assigned portfolios, editing, owner change, rename with redirect, contributors, limits, suspension, deletion, storage report, regeneration of the derived sizes), the permissions by role, the personal data exporter and eraser, the retention rule with its notice, and the accessibility and performance passes.

External services

This plugin connects to four video services, and only when somebody uses the video feature. Nothing else on the site ever contacts them, and with every service switched off in Settings → Videos no request is made at all.

When an owner or a contributor adds a video by pasting its address, the site asks that service’s public oEmbed endpoint about the address, to learn the title and the address of the thumbnail. What is sent is the address that was pasted and the site’s own address, in the request; the thumbnail is then downloaded once and stored on this site. Nothing about the visitor is involved: this happens while somebody is administering a collection.

When a visitor presses play on a video, that visitor’s browser loads the player from the service, which receives their IP address and whatever their browser sends, and may set cookies. Until play is pressed nothing is requested, unless the site turns Load the video only when the visitor presses play off.

Linked videos contact nobody. The networks the Link a video feature points at — Instagram, Facebook, LinkedIn, and whichever else a site adds to the list — are not external services of this plugin: no request is ever made to them, at any moment, by the site or by the pages it serves. The address is stored as text and the picture is one the site uploaded itself. A visitor who presses the link goes there under their own steam, exactly as they would follow any link written in any post.

The services, with their terms and their privacy policies:

• YouTube (https://www.youtube.com/oembed, player on youtube-nocookie.com or youtube.com) — terms https://www.youtube.com/t/terms · privacy https://policies.google.com/privacy
• Vimeo (https://vimeo.com/api/oembed.json, player on player.vimeo.com) — terms https://vimeo.com/terms · privacy https://vimeo.com/privacy
• Dailymotion (https://www.dailymotion.com/services/oembed, player on geo.dailymotion.com) — terms https://legal.dailymotion.com/en/terms-of-use/ · privacy https://legal.dailymotion.com/en/privacy-policy/
• TikTok (https://www.tiktok.com/oembed, player on tiktok.com) — terms https://www.tiktok.com/legal/terms-of-service · privacy https://www.tiktok.com/legal/privacy-policy

Source code

Everything this plugin ships is its source. The JavaScript and the CSS under assets/ are written
by hand and served exactly as they are written: there is no build step, no bundler and no minifier,
so what runs in a browser is the file you can open in the plugin’s folder. Nothing here is generated
from something kept elsewhere. The only compiled files are the two third-party libraries below, and
each is named with the address of its own source.

The translations are not carried in the package: WordPress.org delivers them as language packs, and
a site that wants a language nobody has published yet drops the catalog into
wp-content/languages/plugins.

Third-party code

• The QR code component uses qrcode-generator by Kazuhiko Arase (MIT license). The plugin ships the minified build; the unminified source is available at https://github.com/kazuhikoarase/qrcode-generator
• HEIC photos are decoded on the device by libheif (LGPL-3.0), in the WebAssembly build published as libheif-js version 1.23.2. The plugin ships assets/vendor/libheif/libheif.js (Emscripten glue, minified) and assets/vendor/libheif/libheif.wasm (the compiled library); the sources are at https://github.com/strukturag/libheif and the build that produces these files at https://github.com/catdad-experiments/libheif-js