diff --git a/Docs/PADDLE_SANDBOX_CHECKOUT.md b/Docs/PADDLE_SANDBOX_CHECKOUT.md
new file mode 100644
index 0000000..0fe6618
--- /dev/null
+++ b/Docs/PADDLE_SANDBOX_CHECKOUT.md
@@ -0,0 +1,44 @@
+# Paddle sandbox checkout
+
+Rsync Studio's licensing site now hosts a Paddle sandbox checkout at:
+
+- `https://rsync.stage.absdev.net/buy`
+
+The macOS app opens this page from the Licence and General settings screens.
+
+## Stage environment
+
+The stage `.env` must contain:
+
+```dotenv
+PADDLE_CLIENT_SIDE_TOKEN=test_...
+PADDLE_ENVIRONMENT=sandbox
+RSYNC_STUDIO_PURCHASE_URL=https://rsync.stage.absdev.net/buy
+RSYNC_STUDIO_PORTAL_URL=https://rsync.stage.absdev.net/portal
+RSYNC_STUDIO_SUPPORT_URL=https://rsync.stage.absdev.net/support
+```
+
+Keep `PADDLE_API_KEY` server-side. It must never be added to the macOS app or browser JavaScript.
+
+The four Paddle catalog IDs remain configured through `PADDLE_PERSONAL_*` and `PADDLE_PROFESSIONAL_*` variables.
+
+## Checkout behavior
+
+- Paddle.js is initialized with the sandbox client-side token.
+- Prices are localized with `Paddle.PricePreview()` when available, with the agreed GBP prices as a fallback.
+- Each plan opens Paddle's overlay checkout using the configured price ID.
+- All plans advertise the configured 7-day Paddle trial.
+- A successful Paddle subscription webhook provisions the licence and creates the encrypted delivery outbox record.
+- After webhook processing, pending licence keys are sent by email on a best-effort basis without rolling back the verified webhook if mail delivery is temporarily unavailable.
+
+## macOS stage configuration
+
+The app is configured for:
+
+- API: `https://rsync.stage.absdev.net/api/`
+- Buy: `https://rsync.stage.absdev.net/buy`
+- Portal: `https://rsync.stage.absdev.net/portal`
+- Support: `https://rsync.stage.absdev.net/support`
+- The current stage Ed25519 licence public key is embedded in `Info.plist`.
+
+The signing private seed remains server-only.