Aggregate-only conversion matching

Advertisers bring their own consented first-party records. Identifiers are hashed in the browser, matched against an exposure cohort inside the enclave, and only aggregates come back. Requests that would re-identify a person — device IDs, social accounts, row-level egress, or a join to raw camera detections — are refused by the policy engine before any matching runs.

Match request

Advertiser

Identifier class

Declared purpose

Output

Exposure corridor

The advertiser attests documented consent covering analytics matching, under an executed data sharing agreement.Also join these records to raw camera detections at the site (always refused — try it)

Advertiser records (one per line)

0 records · hashed with SHA-256 in your browser before anything is sent. Minimum 50 required.

Policy engine decision

Submit a request to see every rule evaluated, with the basis it is enforced on.

Released aggregates

k ≥ 50

Nothing released yet. Blocked requests produce no output at all.

Matching request audit

Every request — allowed or blocked — is recorded with the rules applied. Signed-in sessions persist to the append-only audit log; this session's activity is shown below.

No matching requests this session.