- About 4 kB gzipped, no dependencies.
- Renders in a Shadow DOM, so your CSS can’t break it and its CSS can’t leak into your page.
- Keyboard accessible: Escape closes it and focus stays inside the card while it’s open.
- Never asks the same browser twice. Closing the card counts as an answer for that purpose.
The snippet and the REST API need the Growth plan or higher. The 14-day signup trial includes them.
1. Create a publishable key
In Settings → API keys, create a key of type Publishable and list every origin it may be used from, for examplehttps://app.yourproduct.com. Publishable keys (pk_live_…) are safe in the browser because they can only:
- create responses (they can never read data),
- from the origins you listed (any other
Origingets403), - at most 10 submissions in a burst, then one every 6 seconds, per key and visitor IP (
429withRetry-Afterafter that).
2. Add the script
identify as soon as you know who the user is. userId is sent as external_id, which is the most reliable way to match the answer to a Stripe customer (see How revenue is matched).
Options
string
required
Your
pk_… key.string
Overrides the question set in Settings → General (default “How did you hear about us?”).
string[]
The quick-pick chips. By default, up to six of your most-answered channels in respondent-friendly words (“ChatGPT or another AI”, “A podcast”…). Respondents can always type their own answer.
"bottom-right" | "bottom-left"
default:"bottom-right"
Where the card appears.
"light" | "dark" | "auto"
default:"light"
auto follows the visitor’s operating-system setting.string
Defaults to the origin the script was loaded from. Only set it if you self-host the script.
When to ask
Rumorly.ask() takes one option, trigger:
Rumorly.reset() forgets that this browser was asked, which is useful while testing.
What gets sent
Besides the answer and the identity you passed, the snippet sends the UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the referrer and the landing page from the visitor’s first visit, stored in local storage at that visit. Reports use them to compare what customers said with what click-based attribution says. Every submission carries an Idempotency-Key, so a flaky connection never creates duplicates.