Why this script tag is safe.
Adding third-party JavaScript should feel like a small trust exercise, not a leap of faith. Here is exactly what the Minyut widget does.
What the script does
The script downloads public/widget.js, creates a small launcher, and opens a chat panel when the visitor clicks it. The interface is rendered inside Shadow DOM, which keeps Minyut styles away from your site and your site styles away from the widget.
What data leaves the browser
The widget sends the chatbot identifier, the public embed token, and the question text the visitor types. It does not read unrelated forms, scrape your page, set cookies, or fingerprint the browser.
Where knowledge is stored
Uploaded files are stored privately in Supabase. Extracted text chunks and vector embeddings live in Postgres with row-level security. Model providers receive only the text needed for embedding or answering a question.
How to audit it yourself
Open https://minyut.com/widget.js in a browser, inspect the network requests in dev tools, or run the widget on a test page first. You should see calls only to widget config and query endpoints.
FAQ
Why is the script tag safe to paste on my website?
Short version: it draws a chat box and asks your documents questions. That's it. Technically: it loads the Minyut widget bundle, renders inside Shadow DOM, and talks to Minyut APIs using your chatbot embed token.
Does the widget track my visitors?
No. The widget does not set cookies, fingerprint users, or install advertising trackers.
What leaves the visitor's browser?
Only the chatbot ID, embed token, and the question text the visitor chooses to send.
Can it read the rest of my page?
No. The widget does not scrape the page or inspect forms. It only renders the chat UI and sends typed questions.
Where are document embeddings stored?
Embeddings and chunks are stored in Supabase with row-level security. Raw files stay in private storage until you delete them.
Can I audit the bundle?
Yes. The production bundle is served as public/widget.js and can be opened in a browser or inspected in dev tools.
What if my embed token leaks?
Regenerate the token from the dashboard and replace the script tag. Old tokens should stop working once rotated.
Does Minyut train models on my documents?
No. Your documents are used to answer your visitors' questions and are not used to train shared models.