Privacy and consent

Grain is cookieless by default. Without consent it identifies a visitor with an ID that rotates every day, and it stores nothing in the browser. This page holds every privacy fact of the product: the consent modes of the Grain Tag and Analytics Web, the data Grain keeps, the rights of your users, the processors, and the dashboard controls.

What Grain stores

Grain keeps an ephemeral session ID in memory until a visitor grants consent. The data Grain collects depends on the consent state:

State	Identifier	Data
Before consent	Daily rotating ID, in memory only	Page path without query parameters, timestamp, basic metadata. No cookies, no `localStorage`.
After consent	Persistent user ID in `localStorage` or a cookie	Full tracking across sessions.

Grain strips query parameters from the page path before consent. A query string can carry personal data. Every event carries a _consent_status property with the value granted or pending, so the dashboard can separate the two states. Consent also gates the automatic properties, for example the referrer, the page title, and the UTM parameters. Read Automatic tracking. Read Automatic properties. Each SDK has a consentMode configuration value. The default mode of both SDKs needs no consent banner. The TypeScript types of the published packages win over this page when they disagree.

Grain Tag

`consentMode`	What it does
`auto` (default)	Cookieless analytics with daily rotating IDs. No consent is required.
`opt-in`	No tracking until the visitor grants consent. Use it for EU visitors and strict GDPR compliance.
`opt-out`	Tracking with persistent IDs by default. The visitor can revoke consent. Use it for CCPA compliance.

The instance exposes three consent calls:

Call	What it does
`consent.grant(categories?)`	Grants consent. Grain switches to a persistent ID in `localStorage`.
`consent.revoke(categories?)`	Revokes consent. Grain clears the stored ID and returns to cookieless mode.
`consent.status()`	Returns the `ConsentState` (`granted`, `categories`, `timestamp`, `version`), or `null`.

The categories are necessary, analytics, functional, and marketing.

<script>
  const grain = GrainTag.getInstance();
  grain.consent.grant(['analytics']);
  const status = grain.consent.status();
  grain.consent.revoke();
</script>

Analytics Web

`consentMode`	What it does
`COOKIELESS` (default)	Daily rotating IDs. No consent is required.
`GDPR_STRICT`	Explicit consent is required for a permanent ID. Without consent the SDK falls back to cookieless mode.
`GDPR_OPT_OUT`	Permanent IDs by default. The SDK switches to cookieless mode when the user opts out.

The waitForConsent configuration value applies to GDPR_STRICT only. When it is true, the SDK holds events in a queue until the user grants consent, then sends them.

Call	What it does
`grantConsent(categories?)`	Grants consent. The SDK switches from cookieless mode to a permanent ID.
`revokeConsent(categories?)`	Revokes consent for the given categories, or for all of them. The SDK returns to cookieless mode.
`hasConsent(category?)`	Returns `true` when the user granted consent, for one category or in general.
`getConsentState()`	Returns the `ConsentState` (`granted`, `categories`, `timestamp`, `version`), or `null`.

onConsentChange(listener) and offConsentChange(listener) subscribe to changes of the state. The SDK stores the consent preference itself in localStorage. This storage holds the preference only, not a tracking identifier.

const grain = new GrainAnalytics({
  tenantId: 'your-tenant-id',
  consentMode: 'GDPR_STRICT',
  waitForConsent: true,
});

grain.grantConsent(['analytics']);
const granted = grain.hasConsent('analytics');

IP anonymization

IP masking removes the last octet of the address before storage:

192.168.1.xxx -> 192.168.1.0

Enable it in the dashboard under Privacy Settings.

Data retention

Grain deletes events after the retention period. You can export the data of a user before Grain deletes it.

Limit	Value	Where
Retention period	30 to 365 days	Dashboard, Privacy Settings

User rights

The privacy endpoints take the tenant alias in the path and the API key in the X-API-Key header. Read Authentication. The export returns JSON with every event, every property, and the consent history of the user.

curl -X GET https://queryapis.grainql.com/v1/privacy/your-tenant-id/export-user/user_123 \
  -H "X-API-Key: $GRAIN_API_KEY"

curl -X POST https://queryapis.grainql.com/v1/privacy/your-tenant-id/data-deletion \
  -H "X-API-Key: $GRAIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "user_123",
    "deleteEvents": true,
    "deleteProperties": true
  }'

Anonymization

Anonymization replaces the user ID with a random UUID. The aggregated analytics stay intact.

curl -X POST https://queryapis.grainql.com/v1/privacy/your-tenant-id/anonymize-user \
  -H "X-API-Key: $GRAIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "user_123",
    "anonymizeEvents": true,
    "anonymizeProperties": true
  }'

The dashboard offers the same three operations under User Data Tools. Under CCPA, these endpoints cover the right to know, the right to delete, and the right to opt out.

Data residency

Grain stores all analytics and configuration data in EU data centers by default. Xreos, the company behind Grain, is based in the US.

Item	Value
Primary region	Europe (West), Frankfurt, Germany (Azure `westeurope`)
Architecture	Dual-plane storage: Cassandra for management, ClickHouse for analytics
Encryption	AES-256 at rest, TLS 1.3 in transit
Replication	Multi-node with cross-region backup

A US (East) region in Virginia is planned. Region selection will be part of tenant creation.

Processors

Processor	Purpose	Data access	Region	Compliance
Azure	Cloud infrastructure	All data, encrypted	Germany (`westeurope`)	ISO 27001, SOC 1/2/3, GDPR
Auth0	Authentication	Email, name, login timestamps	US/EU	SOC 2 Type II, ISO 27001, GDPR
Cloudflare	CDN, DDoS protection	IP addresses, anonymized	Global edge	ISO 27001, SOC 2, GDPR
AWS SES	Transactional email	Email addresses, transient	EU (Ireland)	ISO 27001, SOC 1/2/3, GDPR
Stripe	Payment processing, optional	Billing information, tokenized	US/EU	PCI DSS Level 1, SOC 2, GDPR
Intercom	Customer support, optional	Name, email, conversations	US/EU	SOC 2 Type II, ISO 27001, GDPR

Grain gives 30 days of notice before a change to this list. Enterprise customers can object to a new subprocessor.

Certifications

Standard	Coverage
GDPR	Data minimization, consent, user rights, breach notification
CCPA	Right to know, delete, opt out, and non-discrimination
SOC 2 Type II	Through the Azure and Auth0 infrastructure
ISO 27001	Through the Azure and Auth0 infrastructure

Security measures

Layer	Measure
Network	TLS 1.3 on all public endpoints. Cloudflare WAF with automatic DDoS mitigation. Plan-based API rate limits.
Application	JWT validation of the Auth0 issuer and audience. SHA-256 hashing of API keys. Role-based access control per tenant.
Database	AES-256 at rest, managed by Azure. TLS 1.3 in transit. No public database exposure. Tenant isolation by UUID partitioning.

Incident response

Severity	Internal	Customer	Regulatory (GDPR)
Critical (data breach)	Immediate	24 to 48 hours	72 hours to the supervisory authority
High (partial outage)	4 hours	12 to 24 hours	Only when personal data is affected
Medium (degradation)	12 hours	Proactive update	Not required

Topic	Address
Security and data breach	security@grainql.com
Privacy requests	privacy@grainql.com

Dashboard privacy controls

The privacy settings are at https://grainql.com/dashboard/privacy:

Control	What it sets
Consent mode	Opt-in, opt-out, or disabled
Data retention	The deletion period, 30 to 365 days
IP anonymization	IP masking on or off
Cookie controls	The cookie consent requirements
User data tools	Export, anonymize, or delete the data of one user
Consent audit	The audit trail of consent events

Read Install Grain for the code that installs the SDK and the consent calls.

Start here

Install without code

Install with code

Track events

Dashboard

Remote configuration

Guides

React

Advanced

What Grain stores

Grain Tag

Analytics Web

IP anonymization

Data retention

User rights

Anonymization

Data residency

Processors

Certifications

Security measures

Incident response

Dashboard privacy controls

​What Grain stores

​Consent modes

​Grain Tag

​Analytics Web

​IP anonymization

​Data retention

​User rights

​Access (GDPR Article 15)

​Erasure (GDPR Article 17)

​Anonymization

​Data residency

​Processors

​Certifications

​Security measures

​Incident response

​Dashboard privacy controls

What Grain stores

Consent modes

Grain Tag

Analytics Web

IP anonymization

Data retention

User rights

Access (GDPR Article 15)

Erasure (GDPR Article 17)

Anonymization

Data residency

Processors

Certifications

Security measures

Incident response

Dashboard privacy controls