Data Privacy & User Consent
What Cromojo collects, and when you need consent
Written By David
Last updated 24 days ago
Cromojo Web Analytics is designed to be privacy-first. It helps you understand your traffic without building long-term profiles of individual people. This article explains, in plain language, what Cromojo collects, why a cookie banner usually isn’t required for basic analytics, and how to handle consent when it is.
Not legal advice. This article explains how Cromojo works and gives general, plain-language guidance. It is not legal advice. Privacy laws (GDPR, ePrivacy, UK GDPR, CCPA/CPRA, and others) vary by country and by your role. You are responsible for your own privacy policy, lawful basis, and any notices or consent your site needs. When in doubt, consult a qualified privacy professional.
How Cromojo analytics handles data
Cromojo’s tracking script is lightweight and built around data minimisation:
No tracking cookies for analytics. The script stores nothing persistent on the visitor’s device for basic analytics. It uses sessionStorage, which the browser clears when the session ends. There is no long-lived cookie following people around.
No cross-site profiles. Cromojo doesn’t follow your visitors across other websites or sell data to third parties.
Each visitor is counted using a random ID that is generated in their own browser and resets every day. It is not based on the IP address or a device fingerprint, and it never builds a permanent personal profile.
Aggregated reporting. Your dashboards show totals and trends like page views, sources, and conversions, not a file on each named person.
Cromojo does not store your visitors’ IP addresses. An IP is used only briefly when an event is received, to estimate approximate location (country, region, city); only that derived location is kept, never the raw IP. Raw analytics events are then automatically deleted after 60 days.
Do you need a cookie consent banner?
For basic, cookieless analytics, many privacy regimes do not require a cookie consent banner, because Cromojo doesn’t store cookies on the visitor’s device for analytics. That’s one of the main benefits of a privacy-first tool.
However, “no cookie banner” is not the same as “no obligations.” Even without cookies, some of the data processed (like IP addresses) can still be personal data under laws such as the GDPR. So you should still:
Keep a privacy notice that mentions you use analytics, what is collected, and why.
Identify your lawful basis (for cookieless analytics this is often legitimate interest, but you must assess it for your situation).
Honour data subject requests (access, deletion) for data you control.
Important: two things can require consent: (1) enabling Revenue Attribution, which links payment data to visitors (see Revenue Attribution & Consent); and (2) local laws in your specific country. When in doubt, show a banner or get legal advice.
How to obtain consent from your users (when you need it)
If your jurisdiction, your setup, or your use of Revenue Attribution means you need consent, here’s the practical playbook:
Add a clear line to your privacy policy describing Cromojo analytics: what’s collected, the purpose, the lawful basis, and how users can opt out.
Show a consent banner before non-essential tracking loads, with a real “Reject” option that is as easy as “Accept.” Consent must be freely given, specific, and unambiguous.
Only load the Cromojo script (or enable attribution) after the user accepts, for example by adding the script through your consent tool’s analytics category.
Record the choice so returning visitors aren’t asked every time, and so you can demonstrate consent if asked.
Most consent-management platforms (CMPs) let you assign the Cromojo script to a category that only fires after consent. If you use Google Tag Manager, you can gate the Cromojo tag behind consent there.
What to tell your visitors
A simple, honest summary you can adapt for your privacy policy: “We use Cromojo, a privacy-first analytics tool, to understand how visitors use our site. It does not use tracking cookies and does not build advertising profiles. You can opt out at any time.”