The chat widget — Good to know

• Chat is rate-limited per IP address at 60 requests a minute and 300 an hour — generous for a real conversation behind an office connection, deliberately short of a grind. • A visitor's conversation stops being readable from their browser 30 days after it starts, and the instant they end it. • Every page in RowFold refuses to be framed except the public form and widget paths, so the app itself cannot be embedded in your site. • An origin list restricts who may FRAME the widget, which is the attack that matters — it is not a list of who may call the endpoints, because every call comes from RowFold's own iframe and so always carries RowFold's origin, never yours.