Short answer: not in cookieless mode. Cookieless mode is the pre-selected choice when you add a website, so unless someone chose the first-party cookie mode at that moment, your tracker sets no cookies. Older websites keep whatever mode they were set up with, so check the setting rather than assuming. In cookieless mode the tracker sets no first- or third-party cookies and does not write to localStorage or IndexedDB.
One sessionStorage entry is the exception: sites using Zenovay's exit-intent widgets get a __zv_widget_shown_session marker so the same popup is not shown twice in a session. It is written in cookieless mode too, and it is gone when the tab closes.
What we use instead
In cookieless mode, the tracker creates a window-scoped, in-memory visitor ID that exists only for the lifetime of the browser tab. When the tab closes, the ID is gone. The server derives the visitor identifier it stores from a one-way SHA-256 hash of the visitor's IP address, the website ID, and the calendar date. Your analytics tables hold that hash, not the address.
The result:
- No persistent identifier on the device
- No cross-site tracking
- The visitor identifier rotates every day, so it does not link the same person across days
- A hash that approximates "unique visitor today" without putting the address in your analytics
Two details worth knowing. The raw address is still used at request time for geolocation, rate limiting, and abuse detection before it is hashed, and it exists in bounded form in a few operational places: IP Address Handling lists all of them. And B2B company identification uses a separate, deliberately stable hash so that visits from the same company network can be correlated over time.
What that means for compliance
ePrivacy Article 5(3), and its national versions such as TDDDG §25 in Germany and FMG Art. 45c in Switzerland, turns on whether something is stored on or read from the visitor's device. In cookieless mode the tracker does not do that, apart from the widget marker described above.
GDPR still applies to the server-side processing, because a hashed identifier is pseudonymous personal data, so your privacy policy should disclose that you use Zenovay and on what basis. What that means for your own banner depends on your jurisdiction and on what else your site loads. See Do I need a cookie consent banner?.
When does Zenovay set cookies?
Only on app.zenovay.com itself, for things like keeping you signed in to your own dashboard. Those cookies never appear on your visitors' browsers.
Can I switch back to cookies?
Cookieless mode is a per-website setting. Open your website's dashboard, go to Settings → Advanced, and find the Privacy & Cookies section. Turning the Zero Client-Side Storage Mode toggle off lets the tracker set a visitor cookie, which can measure long-window unique visitors with higher accuracy. You can choose the Visitor Cookie Lifetime there too (30 days by default, up to 1 year). Switching to cookies puts a stored identifier on the visitor's device, which is exactly what consent rules are written around, so review your banner setup at the same time.
Switching does not backfill. Cross-day visitor identity only builds forward from the moment you turn the cookie on, so expect returning-visitor numbers to climb over the following days rather than jump.