the product
Consent records
Every choice a visitor makes lands as a tamper-evident record: the proof you would show a regulator that consent existed before a tracker ran. You never need to touch this page for the banner to work, and that is the point.
the recordWhat one record contains
When a visitor decides (accepts everything, rejects everything, saves a selection, changes their mind later, or has the browser's Global Privacy Control speak for them), CookieCrumbs stores: when it happened, what was chosen, which categories ended up allowed, which banner version and language the visitor actually saw, which rule set applied, and a pseudonymous visitor ID. No IP address, user agent or page address is stored beside a consent record.
The visitor ID is the consent ID the banner can show visitors (32 letters and numbers). A visitor exercising their rights quotes it, and the subject page shows every choice attached to it.
the chainTamper-evidence in one paragraph
Each record carries a hash of its own content and the hash of the record before it, so the records for a site form a chain. Alter or remove any record and every later hash stops matching. "Check nothing was altered" recomputes the chain on demand and tells you, in one sentence, whether it holds. A record's detail view is rendered as a receipt with the chain status on it, because a till receipt is what it legally is.
exportsSigned exports
An export bundles records as JSONL or CSV, and audit bundles add the declarations, rule sets, version config and rendered screenshots that were in force. Every export is signed with an Ed25519 key; the download carries the content hash and signature, and the public verification keys are published at a well-known address so a third party can verify an export without trusting us. Keys rotate by adding a new key ID; old exports stay verifiable against the old public keys for ever, which is the only honest way to rotate.
Scheduled exports deliver to your own S3-compatible storage on a cadence. A destination is verified with a real test write before it is trusted, and every run is logged with the object key, size and content hash.
erasureThe right to be forgotten
An erasure request handles a visitor's data in one of two ways: blank replaces the pseudonymous ID so the statistical shape of the record survives with no way back to the visitor, or delete removes the records outright and leaves a dated tombstone, so the gap in the chain is itself documented rather than silent. Which one is right depends on your obligations; the page explains both without deciding for you.
retentionHow long records are kept
Records are kept for the retention period of your plan, with custom retention available on higher plans, and are purged on schedule after it. Everything lives in eu-central-1 (Frankfurt); see Security & data.