Cookieless heatmaps

Cookieless heatmaps, and a straight answer on consent.

Maximizii doesn’t set cookies or store IP addresses, and what people type never leaves the page. Whether you need consent is a separate question, so here’s what we do about that too.

Create an account See how it works

Maximizii overview dashboard for a sample site: views, visitors, clicks, a traffic flow chart and top pages — The real dashboard, on sample data from a made-up coffee shop.

In short

Maximizii sets no cookies, stores no IP addresses and never collects form values. Being cookieless doesn’t by itself remove the need for consent in Europe, so by default visitors in the EEA, UK and Switzerland aren’t counted until your site says they’ve agreed.

What’s collected, and what isn’t

What Maximizii collects and what it does with it
Item	What happens
Cookies	None set
IP address	Used in memory for a daily visitor count, then discarded. Never stored
Daily visitor hash	Deleted after two days, along with its salt
Tab id	Random, in session storage, so it’s gone when the tab closes
Form values, emails, long numbers	Never leave the page
Query strings	Never recorded
Page text in pictures	Kept, unless you turn on “Mask all text” or mark the element with `data-mz-mask`
Recordings of visitors	None. There’s no session replay

How consent works

“No cookies” is often sold as “no banner needed”. We don’t say that. EU rules on storing or reading things on a device aren’t limited to cookies, and any analytics may be personal data. Your own legal situation is for you and your lawyer to judge, so we’ve made the cautious choice the default and left you in control:

Consent settings for the Maximizii snippet
Setting	Who waits for consent
Default	Visitors in the EEA, UK and Switzerland
`data-consent="required"`	Everyone, wherever they are
`data-consent="none"`	Nobody. That decision is then yours

JavaScript

// When your consent banner gets a yes
maximizii.consent(true)

// When someone says no, or changes their mind
maximizii.consent(false)

We also check on the server: anything from those countries with no sign of consent is dropped. Visitors with Global Privacy Control or Do Not Track turned on aren’t tracked at all, and maximizii.optOut() gives you an opt-out link. For California, we don’t sell personal data or share it for advertising. See our privacy page and subprocessors.

Questions

Is a cookieless heatmap GDPR compliant?

No tool is compliant on its own: it depends on how you use it. Maximizii collects little and supports consent, access and deletion, but you’re the controller for your visitors, and you should check your own situation with a lawyer.

Do I need a cookie banner for Maximizii?

It sets no cookies, so there’s nothing for a cookie banner to list. But you may still need consent in Europe for analytics in general. By default, Maximizii waits for it there.

How do you count visitors without cookies?

With a hash of the IP address, the browser and a salt that changes every day. It’s only good for one day, so someone who returns tomorrow counts as a new daily visitor, and the hash is deleted after two days.

Where is the data held?

In the United States, on AWS. Our privacy page covers how transfers from Europe are handled.

Keep reading

Find out where they click.

Create an account See how it works