@cross-deck/web-lite

A 5 KB, consent-first build of the Crossdeck web SDK, for paste-in sites.

Web SDK documentation · Consent and privacy

⚠️ This is not the full Crossdeck SDK. It is the deliberately privacy-restricted, consent-first build for marketplace / guest installs (Webflow, Wix, Squarespace, WordPress, …). If you're adding Crossdeck to your own site and want automatic analytics, automatic identity, error tracking and the Trust panel, install @cross-deck/web instead — the full SDK.

What "consent mode" means

@cross-deck/web-lite behaves the way a guest on someone else's site must:

• Autocapture is OFF until the visitor consents. No page views, sessions, clicks or device info leave the SDK until the consent widget grants it.
• Identity is explicit opt-in only. The visitor turns on "Recognize me" in the consent widget — nothing is ever scraped from the host page's DOM or storage.
• No host-global patching. It never wraps fetch, XHR, or history.
• Host-scoped identity storage, and query strings / fragments / referrers are stripped from analytics.
• The branded Crossdeck Consent widget is bundled in, and it defers to any existing consent tool on the page (GPC, IAB TCF/GPP, Google Consent Mode, Cookiebot, OneTrust, …) — never a second banner.

Usage

One call boots Crossdeck in the guest posture and wires the consent widget:

<!-- Pinned, integrity-hashed hosted script (what a marketplace connector registers) -->
<script
  src="https://unpkg.com/@cross-deck/[email protected]/dist/crossdeck-lite.umd.min.js"
  integrity="sha384-…"
  crossorigin="anonymous"></script>
<script>
  Crossdeck.startConsentMode({
    publicKey: "cd_pub_…",        // client-safe, ingest-only
    appId: "app_…",
    policyUrl: "https://your-site.example/privacy",  // the SITE OWNER's policy
  });
</script>

Or on npm:

npm install @cross-deck/web-lite

import { startConsentMode } from "@cross-deck/web-lite";

startConsentMode({ publicKey: "cd_pub_…", appId: "app_…", policyUrl: "…" });

Withdrawal: the widget disappears after a choice (no floating pill). Add a reopen affordance anywhere in your footer/menu — any element with data-crossdeck-consent, or call Crossdeck.consent.open():

<a href="#" data-crossdeck-consent>Privacy choices</a>

Want the full product?

The marketplace build is the acquisition path — it's intentionally minimal. The Direct install (@cross-deck/web) unlocks automatic analytics, automatic identity, error tracking, the Trust panel and the full cross-surface moat, with the site owner taking consent responsibility. See cross-deck.com.

MIT · Part of the Crossdeck SDK family. Consent-mode surface only; the full API lives in @cross-deck/web.

Support

Issues and feature requests: this repository's issues. Anything account-related — contact us.

Security: report vulnerabilities privately to [email protected] — see SECURITY.md.

Crossdeck is an independent product created and operated by Cross Constellation.