consent receipt extension

Consent Receipts is a Chrome extension that:

Saves a receipt every time you click Agree, Accept all, Allow, or an "I agree" checkbox, including OneTrust, Cookiebot, and TrustArc banners. Each receipt records the site, URL, time, button text, policy links, and cookie categories.
Summarizes the terms in plain words with a Low, Medium, or High risk score and the reasons (data sold, tracking, location, biometrics, retention, arbitration, auto renewal, AI training on your content, terms can change).
Shows where each claim came from: every point in the summary expands to the exact sentence in the policy, so you can check the summary instead of trusting it blindly.
Optional Gemini summary: Gemini must cite a numbered policy sentence for every point. Points without a real source are dropped and lower a visible trust score, and rule based findings always stay, so the AI can add context but cannot hide a flagged clause.
Finance mode flags fees, interest rate changes, overdraft terms, and auto renewals in bank, loan, and subscription terms.
Checks your saved policies daily (or on demand), shows a diff of what changed, and notifies you.
Suggests what to do next for each receipt (opt out of data sale or AI training, opt out of arbitration, cancel before renewal, opt out of overdraft, request deletion), each with the cited sentence, a drafted request you can copy, and a link to the policy.
Listen to this receipt: one tap plays a short spoken summary of what you agreed to, written by Gemini from the cited policy sentences (the site, the biggest risks with specifics, money terms, and the best next step) and read aloud by ElevenLabs, for people who would rather hear terms than read them. Free with an account.
Terms change tracker: signed in extensions report policy changes, and the stored events carry no user id, account, or IP, stored in Tiger Data (Timescale). A public page at https://whatyousignupfor.us/changes shows what changed this week and whether risk went up or down, and receipts show how often a policy changed in the last 90 days.
Continue with Google through Auth0, linked to the same account and subscription.
Keeps receipts local in your browser. Export receipts as JSON or a printable receipt.

How it's built

Chrome extension, Manifest V3, plain ES modules with no dependencies (content script for consent detection, module service worker for policy fetches and scheduled checks, popup UI).
Rule based detectors for risk categories and finance terms, with tests.
Gemini API (gemini-3.5-flash-lite via generateContent, JSON output) for cited summaries, run on our server for Pro accounts, falling back to rules when the call fails.
Website at https://whatyousignupfor.us: free accounts that turn on Pro (Gemini summaries, Listen), the Pro summary API, and Stripe billing code kept for later but switched off, on a Vultr VM (Node, Express, SQLite, Caddy, Cloudflare).
ElevenLabs text to speech for Listen, called only from our server so the key never ships in the extension.
Tiger Data (Timescale) hypertable for anonymous policy change events behind GET /api/changes; accounts stay in SQLite.
Auth0 for Continue with Google (OAuth code flow with state and PKCE).
Each integration is off until its key is set, so the site never depends on it.
Receipts stay in local storage; the server only holds accounts, cached summaries, and anonymous change events.
51 node tests, plus an end to end run of the demo in Chrome with the extension loaded.