Toss

Terms of service and privacy policies for Craft CMS — generated from a questionnaire, kept current as the law moves, and actually wired into your site.

Toss is the Craft answer to Auto Terms of Service and Privacy Policy on WordPress, and it takes that plugin's real lesson seriously: the documents are the easy half. What sites need is the other half — links people can find, a notice when something changes, a consent panel that genuinely holds tags back, an FTC disclosure on the post rather than on a page nobody opens, and a record of who agreed to which version.

US and English first: CalOPPA, CCPA/CPRA, the state privacy wave, COPPA, DMCA §512, CAN-SPAM, and the FTC endorsement guides. If you need a German Impressum and a DSGVO-shaped privacy policy, that is a different plugin — Jack — because a document written for the DSGVO and one written for the CPRA are not translations of each other.

Requirements

Craft CMS 5.3.0 or later, PHP 8.2 or later.

Installation

composer require justinholtweb/craft-toss
php craft plugin/install toss

The idea

A policy is a projection, not a document. Nobody should write a privacy policy. You answer questions about your business — who you are, what you collect, who you hand it to, where your customers live — and the policy follows, from a clause library that ships inside the plugin and is stamped with a date.

The compiler is a pure function of those inputs. That is not tidiness, it is the feature: because the output is a function of the input, Toss can tell you when a published policy no longer matches what it would say now, and it can tell you why — a clause the library reworded, an answer you changed, a vendor you added. A text diff shows you that something moved; a stamp shows you what moved it.

A published policy is a contract with a date on it. Publishing writes an immutable version. Every acceptance — a registration checkbox, a checkout, a form — binds to one exact version id, so two questions stay answerable years later: what did this customer agree to on the day they signed up, and who has not accepted the current terms.

Editions

Lite is free and not a trial: a privacy policy and terms of service, on your primary site, with the whole clause library, footer links and a cookie notice.

Pro is a one-off $79 with a $59/year renewal. It adds every other document type, all sites and languages, cookie consent with script gating, the acceptance record and its CSV export, update notices, endorsement disclosures, clause overrides and custom sections, version history, diffs and drift detection, and the console commands.

Editions gate creating and editing. They never gate rendering — see What Toss will not do.

What it makes

Privacy Policy	free
Terms of Service	free
Cookie Policy	Pro
Disclaimer	Pro
Return and Refund Policy	Pro
Shipping Policy	Pro
Acceptable Use Policy	Pro
DMCA Policy	Pro
End User License Agreement	Pro
Affiliate Disclosure	Pro
Custom legal pages	Pro

The kits

Each one is independent, each one can be placed automatically or by hand from Twig.

• Footer links — links to your published legal pages at the bottom of every page. Only published ones: a footer link to a draft is a 404 in the first place a regulator looks.
• Update notices — a bar for a few days after you republish, which then takes itself down. Dismissal is remembered per version, so dismissing April's notice does not suppress May's.
• Cookie notice — a plain informational bar. Tells people; does not ask them.
• Cookie consent — the one that matters. Non-essential tags are held as data and reach the browser only once their category has been granted. A banner that sets a cookie and lets Google Analytics fire anyway is worse than no banner: it makes a promise, in writing, on every page, that the site does not keep.
• Endorsement disclosures — the FTC wants a material connection disclosed near the claim, so this goes on the post, not only on a linked page.
• Agreement checkboxes — {{ craft.toss.agreement('terms') }}, signed so a posted acceptance cannot be forged, and recorded against the version that was actually on screen.

Twig

{# Link and render #}
{{ craft.toss.url('privacy-policy') }}
{{ craft.toss.render('privacy-policy') }}
{{ craft.toss.effectiveDate('terms-of-service')|date('j F Y') }}

{# Kits, placed by hand #}
{{ craft.toss.footerLinks() }}
{{ craft.toss.disclosure() }}
{{ craft.toss.agreement('terms-of-service') }}

{# Consent #}
{% if craft.toss.allows('analytics') %}{# your own tag #}{% endif %}

{# Hold every iframe in existing content until consent arrives #}
{{ entry.body|tossGate('marketing') }}

Console

craft toss/policies              # what exists, and its state
craft toss/policies/compile      # rebuild everything, publish nothing
craft toss/policies/check        # exits non-zero if a policy is out of date — put this in CI
craft toss/policies/refresh --publish
craft toss/consent/scripts       # the tag inventory and what gates each one
craft toss/consent/prune

toss/policies/check is the closest thing there is to a test for "is our privacy policy still true", and it is the reason the compiler is pure.

What Toss will not do

• It is not a lawyer. It generates text from what you tell it. Have a qualified lawyer read anything you publish and rely on.
• It will not guess at your markup. The endorsement kit inserts after the first <h1> or before the last </article>. If your template has neither, it inserts nothing and says so in the audit rather than picking a <div> and hoping.
• It will not blank a published policy when a licence lapses. Editions gate creating and editing. A privacy policy that 404s over billing is worse than anything the licence protects, and a consent kit that stopped gating on expiry would fire every vendor tag on a site that had promised not to.

Licence

Commercial. See LICENSE.md.