The chat widget — Where the chat came from (2)

The query string is dropped unless you ask for it. Plenty of real URLs carry a session token, a sign-in link or a customer's email address after the ?, and copying that into a ticket table — and into the notification emails about it — is not a thing to do by accident. Turn it on when you need it, on the widget that needs it. One honest limit. The chat window runs on RowFold's origin, so it cannot see the page around it; your site tells us, which means the address is reported by the page rather than proven. The one thing we can check is the site the browser loaded the chat from, and where that disagrees with the reported address the thread says so and stops offering it as a link.