Short answer: No. Zenovay's tracker runs in cookieless mode by default. We do not set any first- or third-party cookies, and we do not write to localStorage, sessionStorage, or IndexedDB.
What we use instead
In cookieless mode, the tracker creates a window-scoped, in-memory visitor ID that exists only for the lifetime of the browser tab. When the tab closes, the ID is gone. The server then derives a stable visitor identifier from a one-way SHA-256 hash of the visitor's IP-subnet, User-Agent, and a salt that rotates daily. The raw IP and User-Agent are never stored.
The result:
- No persistent identifier on the device
- No cross-site tracking
- No ability to re-identify a visitor 24+ hours later
- A daily-rotating, salted hash that approximates "unique visitor today" without storing PII
What that means for compliance
Because nothing is stored on the visitor's device, the tracker does not require prior consent under ePrivacy Article 5(3) (TDDDG §25 in Germany, FMG Art. 45c in Switzerland). You can load it before a consent banner is answered.
GDPR still applies to server-side processing (hashed identifiers count as personal data), so your privacy policy should disclose that you use Zenovay. But you do not need a cookie banner solely to load the tracker.
When does Zenovay set cookies?
Only on app.zenovay.com itself, for things like keeping you signed in to your own dashboard. Those cookies never appear on your visitors' browsers.
Can I switch back to cookies?
You can disable cookieless mode in Settings → Tracking if you specifically need a 30-day visitor cookie (for example, to measure long-window unique visitors with higher accuracy). If you do that, you take on the obligation to obtain consent before the tracker loads.