Retention for React

Keeping consent records forever is its own compliance problem. The backend deletes records older than retentionMonths whenever you run prune, and logs how many it removed.

The period

createConsentBackend({ /* … */ retentionMonths: 24 });

The default is 24 months: long enough to answer a question about a decision after the consent cookie, which lasts a year, has expired and been renewed. The minimum is 12, the cookie's lifetime, so a visitor's current decision is never deleted while their cookie still holds it.

The age is counted from received_at, your server's clock, so a visitor's device clock cannot keep a record longer or shorter.

Run it

Any one of these:

npx cookieyes-backend prune --config ./lib/consent-backend.ts
curl -X POST https://shop.example.com/api/consent/prune -H "Authorization: Bearer $CONSENT_OWNER_KEY"

const deleted = await backend.prune();

Schedule it

Cloudflare Workers

Add a scheduled handler next to fetch in your Worker, creating the backend the same way, and crons = ["0 3 * * *"] under [triggers] in your Wrangler config:

async scheduled(_event, env, ctx) {
  backend ??= createConsentBackend({ /* as in fetch */ database: d1Store(env.DB) });
  ctx.waitUntil(backend.prune());
},

A plain server

# crontab -e: every day at 03:00
0 3 * * * cd /srv/shop && npx cookieyes-backend prune --config ./lib/consent-backend.ts

Check it works

1. Run prune once by hand. It prints Removed N records.
2. In your logs, each run writes Pruned N records received before <date>.

Next steps

• What gets stored, and why
• Answer a request to see or delete data