Skip to main content
Privacy & Legal

Data Privacy & User Consent

What Cromojo collects, and when you need consent

Written By David

Last updated 1 day ago

Cromojo Web Analytics is designed to be privacy-first. It helps you understand your traffic without building long-term profiles of individual people. This article explains, in plain language, what Cromojo collects, why a cookie banner usually isn’t required for basic analytics, and how to handle consent when it is.

Not legal advice. This article explains how Cromojo works and gives general, plain-language guidance. It is not legal advice. Privacy laws (GDPR, ePrivacy, UK GDPR, CCPA/CPRA, and others) vary by country and by your role. You are responsible for your own privacy policy, lawful basis, and any notices or consent your site needs. When in doubt, consult a qualified privacy professional.

How Cromojo analytics handles data

With the Cookie-free only option in First-party tracking:

  • Nothing is stored on the visitor's device. No cookies, no localStorage, no sessionStorage.

  • Visits are recognised for one day only. Our servers combine the website, the visitor's IP address and browser details with a secret that changes every day, and turn them into a one-way code. The code can't be turned back into an IP address, and because the secret changes daily, the same person looks new the next day.

  • IP addresses aren't stored. An IP address is used for a moment to create that code and to estimate the country and region. Only the country and region are kept.

  • Do Not Track and Global Privacy Control are respected. Visitors whose browser sends either signal aren't counted.

  • No cross-site profiles. Cromojo doesn't follow your visitors across other websites or sell data.

  • Retention. Raw events are kept for 180 days. The data behind your reports is kept for up to 5 years. Free plans can view the last 12 months.

If you choose Returning visitor tracking in First-party tracking (Pro and above), visitors who are recognised across days get an identifier stored on their device (a cookie and browser storage). The opt-in option only does this after the visitor accepts your cookie banner; the opt-out option does it unless they opt out. New websites start on the opt-out option. See First-party tracking.

Do you need a cookie consent banner?

This applies to the Cookie-free only option. The Returning visitor tracking options store an identifier on the device, so check the consent rules where your visitors live before using them.

For basic, cookieless analytics, many privacy regimes do not require a cookie consent banner, because Cromojo doesn’t store cookies on the visitor’s device for analytics. That’s one of the main benefits of a privacy-first tool.

However, “no cookie banner” is not the same as “no obligations.” Even without cookies, some of the data processed (like IP addresses) can still be personal data under laws such as the GDPR. So you should still:

  • Keep a privacy notice that mentions you use analytics, what is collected, and why.

  • Identify your lawful basis (for cookieless analytics this is often legitimate interest, but you must assess it for your situation).

  • Honour data subject requests (access, deletion) for data you control.

Important: two things can require consent: (1) enabling Revenue Attribution, which links payment data to visitors (see Revenue Attribution & Consent); and (2) local laws in your specific country. When in doubt, show a banner or get legal advice.

How to obtain consent from your users (when you need it)

If your jurisdiction, your setup, or your use of Revenue Attribution means you need consent, here’s the practical playbook:

  1. Add a clear line to your privacy policy describing Cromojo analytics: what’s collected, the purpose, the lawful basis, and how users can opt out.

  2. Show a consent banner before non-essential tracking loads, with a real “Reject” option that is as easy as “Accept.” Consent must be freely given, specific, and unambiguous.

  3. If you use Returning visitor tracking (opt-in), Cromojo reads consent from Google Consent Mode and IAB TCF banners automatically, or you can call window.CRMJ.setConsent('granted') or ('denied').

  4. Record the choice so returning visitors aren’t asked every time, and so you can demonstrate consent if asked.

Most consent-management platforms (CMPs) let you assign the Cromojo script to a category that only fires after consent. If you use Google Tag Manager, you can gate the Cromojo tag behind consent there.

What to tell your visitors

A simple, honest summary you can adapt for your privacy policy: “We use Cromojo, a privacy-first analytics tool, to understand how visitors use our site. It does not use tracking cookies and does not build advertising profiles. By default it stores nothing on your device."

Related articles

Was this helpful?

Still need help? Ask the team