Zenovay Help Center

Learn how Zenovay handles IP addresses and configure anonymization to meet your privacy requirements.

Default IP Handling

How IPs Are Used

Geolocation: Determine country, region, city
Visitor ID: Create anonymous identifier
Bot Detection: Identify automated traffic
Discarded: IP is not stored after processing

Default Process

Incoming Request
      ↓
IP Address (e.g., 203.0.113.50)
      ↓
┌─────────────────────────────┐
│  Geolocation Lookup         │
│  → Country: United States   │
│  → Region: California       │
│  → City: San Francisco      │
└─────────────────────────────┘
      ↓
┌─────────────────────────────┐
│  Visitor ID Generation      │
│  Hash(IP + UA + Salt)       │
│  → v_abc123def456           │
└─────────────────────────────┘
      ↓
IP Address Discarded
(Only hash and geo stored)

Anonymization Options

Full Anonymization

Complete IP anonymization - IP never used for identification.

Enable in Settings → Privacy → IP Address Handling → Full Anonymization.

What this means:

IP used only for geolocation
Visitor ID uses random value
No cross-session tracking
Maximum privacy

Partial Anonymization

Last octet zeroed before processing.

Enable in Settings → Privacy → IP Address Handling → Partial Anonymization.

Example:

Original:   203.0.113.50
Anonymized: 203.0.113.0

This:

Reduces precision
Still enables approximate geolocation
Maintains some visitor tracking
Meets many privacy requirements

No Anonymization (Default)

IP hashed but used for visitor identification. This is the default when no anonymization setting is changed in the dashboard.

Note: Even without explicit anonymization:

Raw IP is never stored
Only hash is retained
Hash cannot be reversed to IP

Impact on Analytics

Feature Comparison

Feature	No Anon	Partial	Full
Country	✓	✓	✓
Region/State	✓	✓	Limited
City	✓	Limited	✗
Returning visitors	✓	✓	✗
Session continuity	✓	✓	Limited
Unique visitor count	Accurate	Accurate	Inflated

Geolocation Accuracy

Full IP (203.0.113.50):
└── Country: United States
    └── State: California
        └── City: San Francisco

Partial IP (203.0.113.0):
└── Country: United States
    └── State: California
        └── City: (less accurate)

Full Anonymization:
└── Country: United States
    └── (no further detail)

Dashboard Settings

Configure via Dashboard

Go to Settings → Privacy
Find IP Address Handling
Select option:
- Default (hashed, used for visitor ID)
- Partial Anonymization
- Full Anonymization
Save changes

Per-Website Settings

Different settings per website:

Website: Marketing Site
IP Handling: Full Anonymization

Website: App Dashboard
IP Handling: Default (hashed)

API Configuration

Set via Dashboard

IP anonymization is configured in the dashboard:

Go to Settings → Privacy → IP Address Handling
Select your anonymization level: None, Partial, or Full
Save changes

This can be set per-website from each website's settings page.

Server-Side Tracking

Forwarding IP

When tracking server-side, forward the client IP:

// Express.js example
app.post('/track', (req, res) => {
  const clientIP = req.headers['x-forwarded-for'] || req.socket.remoteAddress;

  await fetch('https://api.zenovay.com/e/YOUR_TRACKING_CODE', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Forwarded-For': clientIP  // Forward for geolocation
    },
    body: JSON.stringify({
      type: 'page_view',
      url: 'https://yoursite.com/page',
      // IP will be handled per your anonymization settings
    })
  });
});

Anonymizing Before Sending

If you want to anonymize before reaching Zenovay:

function anonymizeIP(ip) {
  if (ip.includes(':')) {
    // IPv6: zero last 80 bits
    return ip.split(':').slice(0, 3).join(':') + '::';
  } else {
    // IPv4: zero last octet
    return ip.split('.').slice(0, 3).join('.') + '.0';
  }
}

const anonymizedIP = anonymizeIP(clientIP);

IPv6 Handling

IPv6 Anonymization

For IPv6 addresses:

Level	Example	Anonymized
Full	`2001:db8:85a3::8a2e:370:7334`	Random ID
Partial	`2001:db8:85a3::8a2e:370:7334`	`2001:db8:85a3::`

Process

IPv6 Address: 2001:db8:85a3::8a2e:370:7334

Partial Anonymization:
├── Keep first 48 bits (network)
├── Zero remaining bits
└── Result: 2001:db8:85a3::

Compliance Considerations

IP addresses are personal data under GDPR:

Use anonymization if relying on legitimate interest
Full anonymization removes GDPR concerns
Document your approach

CCPA

IP addresses are personal information:

Disclosure in privacy policy required
Anonymization recommended

Recommendations by Region

Region	Recommended Setting
EU (strict)	Full Anonymization
EU (with consent)	Partial or Default
California	Partial minimum
Other US	Default acceptable
Global sites	Full Anonymization

Technical Details

Hash Algorithm

When IP is used for visitor ID:

Visitor_ID = SHA-256(
  IP_Address +
  User_Agent +
  Daily_Salt
)

Example:
SHA-256("203.0.113.50" + "Mozilla/5.0..." + "2025-01-15-random")
= "a3b8c9d4e5f6..."

Properties:

Irreversible (cannot get IP from hash)
Consistent within day (same visitor = same hash)
Changes daily (not permanent tracking)

Geolocation Database

We use MaxMind GeoIP2:

Updated weekly
Accuracy varies by region
City-level may be approximate

Troubleshooting

No Geographic Data

If geolocation isn't working:

Ensure IP forwarding configured (behind proxy)
Check if full anonymization enabled
Verify not using localhost IP

Inaccurate Location

Geolocation can be wrong due to:

VPN usage
Mobile carriers
Corporate proxies
Database lag

Visitor Counts Inflated

If using full anonymization:

Same visitor = multiple random IDs
Unique visitor count will be higher
Use sessions for engagement metrics

Best Practices

Choose Based on Needs

Need accurate visitor counts? → Use default or partial
Maximum privacy required? → Use full anonymization
Need city-level data? → Default only
Operating in EU without consent? → Full anonymization

Document Your Choice

Include in privacy policy:

Whether IPs are collected
How they're used
How they're protected

IP Address Handling