The JavaScript snippet

One script tag in your root layout lets Checkbox see what real visitors see on your pricing and checkout pages — including A/B variants — and re-check when a page changes.

The snippet is a small script (/s.js) you put in the <head> of every page. On your own pages it captures the compliance-relevant parts of what visitors actually see — the pay button, the terms near it, consent checkboxes, cancellation links — so Checkbox notices when a deploy or an A/B test changes them, and re-scans.

<script async src="https://app.checkbox.site/s.js" data-key="pk_6ea05a319dc611d8ce3327fe" data-api="https://app.checkbox.site"></script>

Your site's exact tag is in install.script_tag on the site object. checkbox init (CLI) and the setup_checkbox MCP flow add it to your root layout for you, between checkbox:snippet:start / checkbox:snippet:end markers (a JSX comment, an HTML comment, a Nuxt client plugin or the Next.js pages-router _document, depending on the framework), and reports where with snippet_installed_in.

#What it sends, and what it never does

• After load, and again after significant DOM changes (debounced, at most 5 sends per page view, skipped when nothing changed), it extracts the page and sends it to https://app.checkbox.site/ingest/<key> with sendBeacon.
• No cookies, no storage, no form-field values. Personal data is redacted before sending.
• It is wrapped so it can never throw into your page, and it loads async.
• data-sample="0.1" captures only that fraction of page views.

#Consent receipts

Once receipts are turned on for your account, add data-receipts="1" and your publishable key (data-publishable-key="pk_…") to the tag to record a consent receipt when a checkout form is submitted: one structured snapshot of the disclosure next to the button (never field contents or keystrokes). It loads a separate script, /r.js.

#How the captures are used

Snippet captures are unauthenticated (anyone could post to an ingest URL), so the rules engine treats them as corroboration: they never make a check pass on their own, and with scanner coverage a snippet-only failure is needs_review. They are still valuable: a changed checkout page triggers a page_changed re-scan, and A/B variants the synthetic shopper did not see become visible. To prove a capture came from your own server-rendered page, sign the tag (data-sig, set up in the dashboard under Site → Install).

#Rendering the disclosure

With data-disclosure="1" on the tag, the snippet also loads a renderer that fills [data-checkbox-disclosure] placeholders with your verified renewal terms — a no-build way to show the disclosure, opt-in from Site → Fixes. For new work, prefer Checkbox Elements, which also records consent.

#Content-Security-Policy

Allow script-src https://app.checkbox.site and connect-src https://app.checkbox.site.

Checkbox is compliance software, not a law firm; nothing in these docs is legal advice (details). You remain solely responsible for your subscription program, and Checkbox takes on no legal liability for it (Terms). Checkbox is a System1 company; Trust center · Status. For AI agents: every page is available as Markdown at the same URL plus .md; the index is /llms.txt.