Consent
Check a consent receipt
Type a receipt id. Your own browser looks it up in a published snapshot of our consent chain and checks that the chain around it links up. Nothing you type is sent to us, and no account is needed.
What the published snapshot holds
0
0 · None Receipts published under the two rules below.
Two rules decide what may appear here. The builder that writes the snapshot enforces both, and a receipt appears only if it passes both.
Every receipt records what we told the person we would do to their footage, and that sentence is hashed into the record. Receipts written under an earlier wording still carry it.
They cannot be corrected. Each record's hash covers that wording, and every later record's hash covers the one before it, so rewriting history is either a broken chain or a silent re-hash — which is exactly the tampering this ledger exists to expose. So they are excluded by what they contain, and no future change of date or mind can quietly let them through.
The builder reads receipts only from a consent ledger committed to our repository. A receipt from a local or test database cannot reach this page.
What this page can and cannot tell you
Four fields are held back from every published record, because they name a real person and the device they used.
It can check linkage. Each record carries the hash of the one before it. Your browser walks that sequence and reports any point where it does not hold. That needs none of the withheld fields.
It cannot recompute an individual record's hash. That calculation needs all the fields, the withheld ones included.
The exact fields, the order they are joined in, and the character between them are all carried in the snapshot itself, so the specification cannot drift from the code that implements it.
This snapshot was published on —. It carries — receipt(s).
The snapshot carries a SHA-256 digest over its entries. That lets you tell whether the file you are reading is the file we published, if you already know the digest.
It is not a signature. Nothing here is signed with a key, and nothing is anchored to an external timestamp — so the digest proves the file is internally consistent, and it does not prove that we produced it or when. Anyone who could replace the file could recompute the digest.