CookieFlow™

GDPR-compliant cookie consent, CMP & privacy solution for Webflow. 100% free — forever.

Used on 0 sites 🙌

/* ============================================================
   1️⃣  CREATE TABLES
   ============================================================ */

-- Create the main consents table (idempotent)
create table if not exists public.consents (
  id              serial primary key,
  consent_id      text       not null,
  anonymized_ip   text,
  action_date     timestamptz default now(),
  page_url        text       not null,
  user_agent      text,
  consent_method  text,
  modal_text      text,
  button_clicked  text,
  consents        jsonb      not null,
  geo_region      text
);

/* ============================================================
   2️⃣  ROW-LEVEL SECURITY (RLS)
   ============================================================ */

-- Enable RLS on the consents table
alter table public.consents enable row level security;

-- Allow anonymous INSERTs only (no SELECT/UPDATE/DELETE)
do
$$
begin
  if not exists (
    select 1
    from pg_policies
    where schemaname = 'public'
      and tablename  = 'consents'
      and policyname = 'Allow public inserts'
  ) then
    create policy "Allow public inserts"
      on public.consents
      for insert
      with check (true);
  end if;
end
$$;

/* ============================================================
   3️⃣  QUERY HELPER FUNCTION
   ============================================================ */

-- Use a wrapper so clients can only read whitelisted columns
create or replace function public.get_consent_by_id (p_consent_id text)
returns table (
  consent_id  text,
  action_date timestamptz,
  consents    jsonb
)
language sql
stable
security definer
set search_path = public
as
$$
  select consent_id, action_date, consents
  from   public.consents
  where  consent_id = p_consent_id
  order  by action_date desc
  limit  1;
$$;

-- Revoke direct table SELECT, grant function EXECUTE
revoke select on public.consents from public;
grant  execute on function public.get_consent_by_id(text) to public;

/* ============================================================
   4️⃣  HEARTBEAT FUNCTION (keep-alive for Supabase Free plan)
   ============================================================ */

create or replace function public.heartbeat ()
returns void
language sql
stable
set search_path = public
as
$$
  select 1;
$$;

-- Grant execution to the anonymous role so an external cron
-- can ping /rest/v1/rpc/heartbeat using only the anon key
grant execute on function public.heartbeat() to anon;

/* Optional: Lock down visibility of heartbeat to everyone else */
revoke all on function public.heartbeat() from public;

/* ============================================================
1️⃣ CREATE TABLES
============================================================ */-- Create the main consents table (idempotent)
create table if not exists public.consents (
id serial primary key,
consent_id text not null,
anonymized_ip text,
action_date timestamptz default now(),
page_url text not null,
user_agent text,
consent_method text,
modal_text text,
button_clicked text,
consents jsonb not null,
geo_region text
);/* ============================================================
2️⃣ ROW-LEVEL SECURITY (RLS)
============================================================ */-- Enable RLS on the consents table
alter table public.consents enable row level security;-- Allow anonymous INSERTs only (no SELECT/UPDATE/DELETE)
do
$$
begin
if not exists (
select 1
from pg_policies
where schemaname = 'public'
and tablename = 'consents'
and policyname = 'Allow public inserts'
) then
create policy "Allow public inserts"
on public.consents
for insert
with check (true);
end if;
end
$$;/* ============================================================
3️⃣ QUERY HELPER FUNCTION
============================================================ */-- Use a wrapper so clients can only read whitelisted columns
create or replace function public.get_consent_by_id (p_consent_id text)
returns table (
consent_id text,
action_date timestamptz,
consents jsonb
)
language sql
stable
security definer
set search_path = public
as
$$
select consent_id, action_date, consents
from public.consents
where consent_id = p_consent_id
order by action_date desc
limit 1;
$$;-- Revoke direct table SELECT, grant function EXECUTE
revoke select on public.consents from public;
grant execute on function public.get_consent_by_id(text) to public;/* ============================================================
4️⃣ HEARTBEAT FUNCTION (keep-alive for Supabase Free plan)
============================================================ */create or replace function public.heartbeat ()
returns void
language sql
stable
set search_path = public
as
$$
select 1;
$$;-- Grant execution to the anonymous role so an external cron
-- can ping /rest/v1/rpc/heartbeat using only the anon key
grant execute on function public.heartbeat() to anon;/* Optional: Lock down visibility of heartbeat to everyone else */
revoke all on function public.heartbeat() from public;

Watch Tutorial

Disclaimer: This tool has been designed with input from a GDPR specialist and is based on our own requirements and implementation approach. It does not constitute legal advice and does not guarantee compliance with any specific law or regulation. It is your responsibility as the website owner to consult your own legal advisors, applicable laws, and regulatory guidance, and to determine whether this tool and its configuration, as described in our documentation, meet your compliance requirements. Reform Digital® accepts no liability for compliance outcomes or legal obligations arising from the use of this tool. If you have questions or need clarification, you are welcome to reach out through our Slack community.

Tracking: We track product installations anonymously by logging the installation date and root domain. No personally identifiable data is collected. This data is recorded solely for internal reference and does not impact product functionality or user privacy. Tracking installations helps us understand which tools are used most, allowing us to prioritize our resources for better support and scalability based on demand. We also present the number of installations transparently on our website as above.