Privacy and consent

GrainQL is cookieless by default. Without consent it identifies a visitor with an ID that rotates every day, and it sets no cookies. This page holds every privacy fact of the product: the consent modes of the GrainQL Tag and Analytics Web, the data GrainQL keeps, the rights of your users, the processors, and the dashboard controls.

What GrainQL stores

GrainQL sets no cookies. Until a visitor grants consent, it identifies the visitor with an ID that rotates every day. The data GrainQL collects depends on the consent state:

State	Identifier	Data
Before consent	Daily rotating ID	Page path without query parameters, timestamp, basic metadata. No cookies.
After consent	Persistent user ID in `localStorage`	Full tracking across sessions.

The GrainQL Tag keeps a few values in the localStorage of the browser, under keys that start with _grain_<tenant-alias>_. None of them is a cookie.

Key	What it holds	When
`dsalt`	A random value that keeps the daily ID unique to this device	Always
`uid`	A lasting visitor ID	After consent, or from the start in opt-out mode
`consent`	The consent choice of the visitor	Once a choice exists
`first_touch`	The source, medium, and campaign of the first visit	Always
`journey`	Recent pages, used to credit campaigns	Unless the visitor refused consent
`seen_events`	A hashed list of events already sent, for repeat counts	Always
`ev_salt`	The salt for that hash	Always
`snapshots`	The pages whose layout was captured today	When heatmaps are on

GrainQL strips query parameters from the page path before consent. A query string can carry personal data. Every event carries a _consent_status property with the value granted or pending, so the dashboard can separate the two states. Consent also gates the automatic properties, for example the referrer, the page title, and the UTM parameters. Read Automatic tracking. Read Automatic properties. Each SDK has a consentMode configuration value. The default mode of both SDKs needs no consent banner. The TypeScript types of the published packages win over this page when they disagree.

GrainQL Tag

`consentMode`	What it does
`auto` (default)	Cookieless analytics with daily rotating IDs. No consent is required.
`opt-in`	No tracking until the visitor grants consent. Use it for EU visitors and strict GDPR compliance.
`opt-out`	Tracking with persistent IDs by default. The visitor can revoke consent. Use it for CCPA compliance.

The instance exposes three consent calls:

Call	What it does
`consent.grant(categories?)`	Grants consent. GrainQL switches to a persistent ID in `localStorage`.
`consent.revoke(categories?)`	Revokes consent. GrainQL clears the stored ID and returns to cookieless mode.
`consent.status()`	Returns the `ConsentState` (`granted`, `categories`, `timestamp`, `version`), or `null`.

The categories are necessary, analytics, functional, and marketing.

<script>
  const grain = GrainTag.getInstance();
  grain.consent.grant(['analytics']);
  const status = grain.consent.status();
  grain.consent.revoke();
</script>

Analytics Web

`consentMode`	What it does
`COOKIELESS` (default)	Daily rotating IDs. No consent is required.
`GDPR_STRICT`	Explicit consent is required for a permanent ID. Without consent the SDK falls back to cookieless mode.
`GDPR_OPT_OUT`	Permanent IDs by default. The SDK switches to cookieless mode when the user opts out.

The waitForConsent configuration value applies to GDPR_STRICT only. When it is true, the SDK holds events in a queue until the user grants consent, then sends them.

Call	What it does
`grantConsent(categories?)`	Grants consent. The SDK switches from cookieless mode to a permanent ID.
`revokeConsent(categories?)`	Revokes consent for the given categories, or for all of them. The SDK returns to cookieless mode.
`hasConsent(category?)`	Returns `true` when the user granted consent, for one category or in general.
`getConsentState()`	Returns the `ConsentState` (`granted`, `categories`, `timestamp`, `version`), or `null`.

onConsentChange(listener) and offConsentChange(listener) subscribe to changes of the state. The SDK stores the consent preference itself in localStorage. This storage holds the preference only, not a tracking identifier.

const grain = new GrainAnalytics({
  tenantId: 'your-tenant-id',
  consentMode: 'GDPR_STRICT',
  waitForConsent: true,
});

grain.grantConsent(['analytics']);
const granted = grain.hasConsent('analytics');

IP addresses and location

GrainQL reads the country, the region, the city, and the time zone from the request. It does not store the IP address with the event.

Remove query strings

Turn on Remove query strings in Settings, then Privacy and data, to drop everything after ? from every page URL. An email address or a token in a link then never reaches GrainQL.

Data history and retention

Your plan sets the data history: how far back the dashboard, Neo, and the Query API read your events. Read Plans and limits.

Plan	Data history	Where
No paid plan	3 months	Dashboard, Neo, Query API
Starter	12 months	Dashboard, Neo, Query API
Growth	24 months	Dashboard, Neo, Query API
Scale	36 months	Dashboard, Neo, Query API

The Retention policy of the workspace follows the plan by default. An admin can set a shorter or a longer period in Settings, then Privacy and data.

Limit	Value	Where
Retention policy	Follows the plan, or 30 days to 3 years	Settings, then Privacy and data

You can export the data of a user before the retention period ends. Read the next section.

User rights

The privacy endpoints take the tenant alias in the path and the API key in the X-API-Key header. Read Authentication. The export returns JSON with every event, every property, and the consent history of the user.

curl -X GET https://queryapis.grainql.com/v1/privacy/your-tenant-id/export-user/user_123 \
  -H "X-API-Key: $GRAIN_API_KEY"

curl -X POST https://queryapis.grainql.com/v1/privacy/your-tenant-id/data-deletion \
  -H "X-API-Key: $GRAIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "user_123",
    "deleteEvents": true,
    "deleteProperties": true
  }'

Anonymization

Anonymization replaces the user ID with a random UUID. The aggregated analytics stay intact.

curl -X POST https://queryapis.grainql.com/v1/privacy/your-tenant-id/anonymize-user \
  -H "X-API-Key: $GRAIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": "user_123",
    "anonymizeEvents": true,
    "anonymizeProperties": true
  }'

The dashboard offers the same operations under Data requests in Settings, then Privacy and data. Under CCPA, these endpoints cover the right to know, the right to delete, and the right to opt out.

Data residency

GrainQL stores and backs up analytics data in ISO 27001 certified data centers of Hetzner in Helsinki, Finland. Cybentis Oy, the company behind GrainQL, is a Finnish company.

Item	Value
Analytics data	Hetzner, Helsinki, Finland
Neo conversations, memories, and reports	Supabase, Frankfurt, Germany
Sign-in and identity	Auth0, European Union
Encryption	TLS on every connection. Encrypted backups.

Processors

The full list of the services that process data for GrainQL, with the purpose, the data, and the location of each, is at grainql.com/privacy. The privacy page, the privacy policy, and the security page show the same list. This page does not copy it. The main groups are:

Group	Services
Infrastructure and storage	Hetzner, Cloudflare, Vercel, Supabase
Neo and AI	OpenRouter, Google (Gemini), Anthropic (Claude), and the services that read your public pages during setup
Accounts, billing, and email	Auth0, Stripe, Shopify, Customer.io
Support and operations	Featurebase, Better Stack, New Relic

GrainQL gives 30 days of notice before it adds a subprocessor.

Certifications

GrainQL does not hold its own SOC 2 or ISO 27001 certificate. The data centers that store the analytics data are ISO 27001 certified. The data processing agreement covers GDPR processing and includes the EU Standard Contractual Clauses.

Security measures

Layer	Measure
Network	TLS on all public endpoints. Cloudflare at the edge, with DDoS protection. A rate limit on the Query API.
Application	Auth0 sign-in, with a role for every teammate. GrainQL stores no passwords. SHA-256 hashes of API keys.
Data	Every request is checked against its workspace. The data of each workspace is kept separate. No public database access.

Incident response

Event	Time	Where
Notice of a personal data breach to you	Within 48 hours	Data processing agreement
Confirmation of a security report	Within 48 hours	grainql.com/security

Topic	Address
Security and data breach	security@grainql.com
Privacy requests	privacy@grainql.com

Dashboard privacy controls

The privacy settings are in Settings, then Privacy and data, at https://grainql.com/dashboard/settings/privacy:

Control	What it sets
Consent mode	Cookieless, Ask first, or Track unless they opt out
Remove query strings	Drops everything after `?` from page URLs
Retention policy	Follows the plan, or a period from 30 days to 3 years
Privacy policy	The link to your own privacy policy
What the tag stores	The keys that the tag keeps in the local storage of the browser
Data requests	Export, anonymize, or delete the data of one user

Read Install GrainQL for the code that installs the SDK and the consent calls.

Start here

Install without code

Install with code

Track events

Dashboard

Remote configuration

Guides

React

Advanced

Privacy and consent

What GrainQL stores

GrainQL Tag

Analytics Web

IP addresses and location

Remove query strings

Data history and retention

User rights

Anonymization

Data residency

Processors

Certifications

Security measures

Incident response

Dashboard privacy controls

​What GrainQL stores

​Consent modes

​GrainQL Tag

​Analytics Web

​IP addresses and location

​Remove query strings

​Data history and retention

​User rights

​Access (GDPR Article 15)

​Erasure (GDPR Article 17)

​Anonymization

​Data residency

​Processors

​Certifications

​Security measures

​Incident response

​Dashboard privacy controls

What GrainQL stores

Consent modes

GrainQL Tag

Analytics Web

IP addresses and location

Remove query strings

Data history and retention

User rights

Access (GDPR Article 15)

Erasure (GDPR Article 17)

Anonymization

Data residency

Processors

Certifications

Security measures

Incident response

Dashboard privacy controls