People Should Get A Receipt

Consent Receipts

When you buy a coffee, you get a receipt. When an app asks for something personal, you tap “I agree” and get nothing back. There is no other way in. The app then sends your data where it needs to go, to an AI model or a partner, under terms it wrote and can change. If anyone later asks what left and on what terms, the only record belongs to the company.

People who will never read a privacy policy do this. We do this, and we should not have to. Someone is usually keeping track, and it is rarely the person who agreed.

We think people should get a receipt.

How it got this way

Nobody planned it. It grew out of the habits of building apps: software offered free and paid for with data, consent folded into one tap at sign up, terms that change after you have agreed, partners the person never sees. Each habit made sense to someone at the time. Together they leave the person with the least information and the least say, at exactly the moment their most sensitive information changes hands.

What a consent receipt is

A consent receipt is a short record of what you agreed to share, with whom, and on what terms. Before anything leaves your phone, the app shows the agreement in plain words: who receives your data, what they receive, and what they keep. If you approve, your phone writes the receipt and signs it. If something is not on the agreement, you have not agreed to it.

A fingerprint of that receipt then goes to a public ledger. We chose a public ledger because no single company runs it, so neither you nor we control the record, nobody can quietly change the fingerprint afterwards, and anyone can read it. The fingerprint reveals nothing about you, and you need no wallet: the app’s operator pays the fee. Later, anyone holding the receipt can check that it existed when the fingerprint was recorded and has not been changed since.

What a consent receipt does not do

A receipt does not stop your data leaving, and it cannot prove a company kept its word afterwards. It records the promise and the request, so the promise can be checked. The record is no longer one-sided.

The first company it holds to account is ours.

Our bet

We think much of this exchange will soon happen between software. An assistant acting for you will ask a clinic, an insurer or a pharmacy for what it needs, and answer their requests in return. It will do this many times a day, with no one watching each step. If those exchanges inherit today’s habits, nobody will be able to say afterwards what was shared or on what terms. We think every one of them should carry its terms and leave a receipt the person keeps and anyone can check. It no longer takes a large company to build that, so we are building it.

Where it stands

Regal Pines is building consent receipts first into Flair Health, our health app, now in TestFlight on iOS. Your health data stays on your phone until you approve an agreement to send it, and every request Flair makes to an AI model produces a signed receipt. Anchoring runs in our test build on Solana’s devnet, its test network, and reaches users when we move to mainnet. We chose Solana because each record costs a fraction of a cent and is confirmed in seconds, which is what it takes to give a receipt for every exchange. The Solana side is open source: github.com/reubensoh/consent-receipts.

If you build apps that handle personal data and want to try consent receipts, write to us: info@regal-pines.com.