- Zenovay's default cookieless tracking stores nothing on the device (no cookies, localStorage, IndexedDB), avoiding consent and deletion obligations.
- Visitor identity is computed server-side using SHA256 of IP subnet (not full IP), user agent, and a daily salt that rotates at midnight UTC, ensuring privacy by expiration.
- The daily salt rotation causes overcounting of unique visitors across multi-day ranges and inability to compute returning visitor rates, but within-day analytics (sessions, funnels, revenue) work normally.
- Revenue attribution survives cookieless mode because at conversion, users identify themselves, anchoring the journey to a real account for accurate attribution.
- Zenovay rejected heavier fingerprinting methods and a weekly salt to maintain a bright line on privacy; it accepts bounded collisions (e.g., two people in same office merging for a day).
- A toggle allows switching to first-party cookie mode for cross-day stability, shifting consent obligations to the user.