Embed Oravan on your site

An iframe, not a script running on your page

The widget loads inside a cross-origin iframe, the same browser mechanism that keeps a video embed or a payment form isolated from the page around it. That isn't a policy promise — it's the browser enforcing it. Your page's own scripts, analytics, and tag managers cannot read what a visitor types into the widget or observe anything happening inside it, because they run in a different origin's sandbox.

What the widget collects about your visitors: nothing

• Zero cookies. No response from the embed ever sets one.
• Zero third-party requests. Every asset the widget loads — fonts, styles, data — comes from Oravan's own origin. Nothing calls out to an ad network, an analytics vendor, or any other third party.
• ZIP code only. The representative-lookup widget never asks for a street address inside the iframe; a visitor who needs the more precise, split-district lookup is linked out to the main Oravan site for that step.
• No visitor data reaches Oravan beyond an ordinary page load. A ZIP code a visitor enters is used once, in memory, to answer that one lookup, and is never logged or stored.

These aren't claims made only in this copy — they're enforced by automated tests in Oravan's own public repository, on every change, before it ships.

Theming reference

Theming works the same on both widgets and is limited to three CSS custom properties, each validated on Oravan's server before it can reach a style: an accent color (a hex code), a corner-radius style (sharp, soft, or round), and a font (system or serif). There's no way to inject arbitrary CSS or JavaScript into the widget — that's a deliberate security boundary, not a missing feature.

Attribution

Every widget shows a small "Powered by Oravan" link, pointing back to the canonical page on oravan.org. The brandless option removes the Oravan name from the widget chrome (its accessible titles and fallback labels) but keeps that attribution link — it's how the free tier stays free. Removing attribution itself (data-attribution="none") is reserved for licensed partners: there's no technical lock yet, so we say it plainly — if you want it, write us for a license. The AI-content label is never removable, on any tier.

The loader script

The script tag your snippet includes is a single, dependency-free file under 5KB. All it does is create the iframe, size it to fit its content, and relay that size back — nothing is read from your page, and nothing is sent anywhere except the one request that loads the widget itself.