Visitor Identification

Identify and track individual users across sessions to understand user journeys and build complete user profiles.

Overview

Visitor identification allows you to:

• Link anonymous visitors to known users when they log in
• Track user behavior across multiple sessions and devices
• Build comprehensive user profiles
• Personalize experiences based on user history

Visits and tracking modes

Before anyone logs in, Zenovay counts anonymous visits and visitors. How a returning visitor is recognised depends on the tracking mode of your site.

Visits

A visit (session) ends after 30 minutes without activity. You can change this per site, from 5 to 120 minutes. With the same tracking code, a visit continues across subdomains, for example from example.com to docs.example.com.

Cookie mode

In first-party cookie mode, the tracker sets two cookies:

Cookieless mode

In cookieless mode, the tracker sets no cookies and writes nothing to localStorage. Turn it on with data-cookieless="true" on the script tag or with the cookieless setting in the dashboard.

• The server derives an anonymous ID from a hash of the IP subnet, the user agent and a daily rotating salt. The raw IP address is not stored.
• A visit still spans several pages, with the same 30-minute inactivity rule.
• The ID changes every day, so a returning visitor is not linked across days.

Cookieless until consent

With data-cookieless="until-consent", the tracker starts cookieless. When the visitor accepts your cookie banner, call zenovay('consent', 'granted'): Zenovay switches to its first-party cookie and keeps the IDs of the ongoing visit, so the visit is not split in two. zenovay('consent', 'denied'), also when consent is withdrawn later, removes Zenovay's cookies and storage and continues cookieless. On later pages the tracker starts in cookie mode if the visitor consented before. See Consent.

<script defer
data-tracking-code="YOUR_TRACKING_CODE"
data-cookieless="until-consent"
src="https://api.zenovay.com/z.js">
</script>

Which mode is active

An explicit data-cookieless on the script tag always wins over the dashboard setting. The dashboard follows what is really installed: if your installed script forces cookieless, the website's cookieless setting is switched on automatically, so the dashboard shows the mode that is actually active.

Basic Identification

Identify a user after they sign up or log in:

zenovay('identify', 'user_123', {
email: 'user@example.com',
name: 'John Doe',
plan: 'pro',
created_at: '2025-01-15T10:00:00Z'
});

User Traits

Include relevant user properties:

zenovay('identify', user.id, {
// Contact information
email: user.email,
name: user.name,
phone: user.phone,

// Account details
plan: user.subscription.plan,
status: 'active',
created_at: user.createdAt,

// Company information (B2B)
company: user.company.name,
company_size: '50-200',
industry: 'SaaS',

// Custom properties
lifetime_value: user.lifetimeValue,
total_purchases: user.totalPurchases
});

Anonymous to Identified

Track anonymous visitors and link them when they identify:

// Before login - track as anonymous
zenovay('track', 'page_view', {
path: '/pricing'
});

zenovay('track', 'button_click', {
button: 'sign_up'
});

// After login - identify the user
zenovay('identify', 'user_456', {
email: 'user@example.com',
name: 'Jane Smith'
});

// All previous anonymous events are now linked to this user

Identity status badges in the dashboard

Once visitors are identified, Zenovay automatically labels them in your dashboard with one of three status badges:

• Anonymous: a visitor that has not yet called zenovay('identify', ...). Tracked by an anonymous ID: the first-party cookie in cookie mode, or the server's anonymous daily ID in cookieless mode (no cookies, no localStorage).
• Identified: a visitor that has called zenovay('identify', userId, traits). The identity card on the visitor's session detail panel shows the email, name, plan, and any custom attributes you sent.
• Paying customer: a visitor whose record is linked to a paid subscription via Stripe, LemonSqueezy, Polar, or PayPal, OR whose total_revenue is greater than zero. The link is established automatically by your payment provider's webhook (no extra tracker call required).

Badges appear on:

• Globe markers — Paying customers get a green-glow crown icon, identified visitors get a blue-ringed user icon, anonymous visitors get the default value-score colour.
• Profiles list — Each row shows a coloured badge. Filter chips above the list narrow to one status.
• Live Analytics — Live rows show the badge inline.
• Visitor detail panel — Identity card section displays full identity attributes when present.

Edge cases

• A visitor who calls identify() with only a customer ID (no email) is still classified as Identified. The identity card renders ID only in the Email row.
• A visitor whose subscription is later cancelled BUT whose total_revenue > 0 remains classified as Paying — past lifetime value is still relevant to your team.
• A visitor identified across two different websites you track shows independently per website (data is scoped per website, never bled across).

Screenshot mode: blur identifiers

For demos, public screenshots, or screen-sharing in calls, you can mask all visitor emails and names across the dashboard:

1. Open Settings → Account → Preferences.
2. In the Display section, toggle Blur identifiers ON.
3. Emails render as ••••••@•••••• and names as J••• D•. Reload-persistent (per browser).

Public dashboards always blur

Identifiers are ALWAYS masked on a public dashboard share, regardless of the toggle state. The Globe API also omits identity_email / identity_name / identity_plan fields entirely from the shared response — the data is not just hidden in the UI, it is not transmitted.

React Example

In React applications:

import { useEffect } from 'react';

function UserProvider({ user, children }) {
useEffect(() => {
  if (user && window.zenovay) {
    // Use the global zenovay object from the tracking script
    window.zenovay('identify', user.id, {
      email: user.email,
      name: user.name,
      plan: user.plan,
      created_at: user.createdAt
    });
  }
}, [user]);

return <>{children}</>;
}

Privacy Compliance

Respect user privacy and comply with regulations:

GDPR Compliance

To delete all data for an individual visitor, use the request_data_deletion MCP tool in read-write mode. That is the route that exists for it: there is no dashboard button and no REST endpoint. If you cannot use MCP, contact support@zenovay.com. Account deletion is separate: triggered from Settings → Workspace → Billing & invoices or via API, it hard-deletes across all data stores immediately, with no grace period.

Opt-Out Tracking

// Disable tracking for a user who opts out
zenovay('disable');

// Re-enable tracking if user opts back in
zenovay('enable');

Session Management

Sessions are managed automatically by the Zenovay tracker. A new session starts when a visitor arrives or after 30 minutes of inactivity (configurable per site, 5 to 120 minutes). You can query session timing:

// Get time spent in current session (seconds)
const sessionTime = zenovay('getSessionTime');

// Get active engagement time (seconds)
const engagementTime = zenovay('getEngagementTime');

Best Practices

When to Identify

✅ Do identify users:

• After successful signup
• After login
• When user updates their profile
• When subscription changes

❌ Don't identify users:

• Before they've created an account
• With temporary or test data
• In development/testing environments

ID Format

Use consistent, immutable user IDs:

// ✅ Good: Use database IDs
zenovay('identify', 'usr_1234567890');

// ❌ Bad: Email addresses can change
zenovay('identify', 'user@example.com');

// ❌ Bad: Usernames can change
zenovay('identify', 'johndoe123');

Next Steps

Continue learning:

• Custom Events - Track user actions
• Privacy-first — cookieless mode, GPC and Do Not Track
• Visitor Value Scoring - AI-powered insights