Cookies · CEVO

In short

Cookies that keep you signed in, protect your forms and remember your cookie choice always run. They need no permission.
CEVO's own visit measurement shows how visitors find the site and which steps they reach. In the United States, and elsewhere after you accept the cookie banner, it sets two CEVO cookies with random IDs, __Host-cevo_vid and __Host-cevo_sid. Otherwise it only counts visits anonymously, with no cookie and no ID. You can switch it off in Cookie settings, and Global Privacy Control switches it off for you.
CEVO runs no Meta pixel or other ad tag. Meta advertising tools are not in use yet; before we turn them on, we will add them to this page.
If you came from a Google ad, our server tells Google Ads once when you unlock your free readout and once when you pay for a report. In the United States this is on unless you switch it off in Cookie settings or your browser sends Global Privacy Control. Everywhere else, and when we cannot tell your country, the cookie banner asks you first, and until you accept, the click ID is held only in the page. No Google tag runs on CEVO pages.
No ad tag runs on the questionnaire, the scan, checkout or your report. The scan makes no third-party requests.
Your photos, face data, answers, ancestry and body-fat answer never go to any ad platform.
To decide whether to show the cookie banner, our own server looks up only the country of your IP address. The IP address is not stored for this.
Partner links work without a cookie.
We honour Global Privacy Control. You can change your choice at any time.

What cookies and pixels are

A cookie is a small file a website stores in your browser. A pixel is a piece of code from another company that runs on a page and reports what happens there, such as a page view or a purchase. Both store or read information on your device, so the law treats them the same way (ePrivacy Directive Art. 5(3)). So does your browser's session storage, which keeps information for one tab and clears it when you close that tab. CEVO runs no pixel.

Strictly necessary

These run without asking, because CEVO cannot work without them. They keep you signed in, protect your forms against misuse, and remember the cookie choice you made. They are never used for advertising.

The questionnaire and the free scan keep your answers, your consent receipt, the tier you chose and your unlock step in this tab's session storage, so a refresh does not lose them. Ancestry and body fat are kept there only while their own box is ticked. Photos, face points and measurements are never stored there.

When you pay, you leave for Stripe's checkout page, and Stripe sets its own fraud-prevention cookies there. When you sign in with Apple, or continue with Google, you do it in their own window, and they set cookies on their own sites under their own policies. CEVO loads no Google script on its pages.

Analytics

CEVO uses no third-party analytics tool. Our own visit measurement, on CEVO's server, shows how visitors find the site, which steps they reach and where people stop. It works in two ways: an anonymous daily count of every visit and, in the United States and elsewhere after you accept the cookie banner, a record of your visits linked to two first-party cookies.

What it measures

Each time a page reaches one of these steps, your browser tells our server:

a page opened: for example the homepage, the questionnaire, the scan page or the page after payment;
each questionnaire step reached: about you, goal, routine, hair type, hair length, style, body fat and consent;
a scan started (camera, upload or phone), a photo taken (and whether it passed the photo checks) or accepted, the free readout shown;
an unlock or sign-in, with Google or by email;
the prices seen, a report tier picked (and which one), checkout opened. Choosing to take a new photo from the price page instead of buying is a step too. The prices seen, the tier picked and that choice also say how many of the 10 free front measurements the photo got, as a band (1 to 4, 5 to 9, all 10, or not certain).

Visit records and their cookies

In the United States, and everywhere else only after you accept the cookie banner, our server sets __Host-cevo_vid, a random visitor ID kept for 400 days and renewed when you come back, and __Host-cevo_sid, a random session ID that ends after 30 minutes without activity. Both are first-party cookies that scripts on the page cannot read, and no other company receives them. With them our server records each step with its time; the address of the first page of each visit, without anything after a "?"; where you came from: the site and page that linked to you, the campaign tags and ad click IDs in the link (such as utm_source, gclid or fbclid) and a partner code; phone, tablet or computer, and your browser and operating system family (never the full browser string); and your country. When you unlock your free readout or sign in, your visits are linked to that unlock or account, including its email address, and your orders from then on (tier, amount, payment) are added to them. Each step and arrival is deleted 25 months after it is recorded. Your visitor ID, with its device, country and email link, is deleted 25 months after your last visit or order (checked daily).

Anonymous counts

A count holds only the step, the day (never the time), and whether the device is a phone or a computer. For those three price-page steps it also holds that band. Only if Google Ads measurement or visit records are on for you, and your browser sends no Global Privacy Control signal, does it also say whether you came from a Google ad: yes or no, never the click ID. Where visit records are not on, only these counts are made: no cookie, nothing stored on your device and no ID. Counts are deleted after 400 days (about 13 months).

What it never records

your answers, including sex, age, ancestry, body fat, goal, routine, hair type, hair length, morning time and style;
your photo, face data or measurements;
free text you type;
your IP address: it is used only in our server's memory, to stop floods of fake counts and to tell your country, and is never written to a log or database, not even as a hash.

Counts and visit records are never sent to another company: visit measurement runs only on cevolab.com, and everything stays on CEVO's own server in Helsinki, Finland, hosted by Hetzner.

Turning it off

Visit measurement is on by default. To turn it off, open "Cookie settings" in the footer of the cevolab.com homepage or scan page, or at the top of the questionnaire ("Cookies" on phones), and switch off "Measure my visits". That stops the counts and the visit records in that browser, and our server expires both ID cookies. The choice is kept in the cevo_consent cookie, so it lasts 182 days in that browser. If your browser sends a Global Privacy Control signal, visit measurement is off automatically. Outside the United States, refusing in the cookie banner keeps visit records off. Visit records linked to your email are deleted on request to privacy@cevolab.com. Because no count carries an ID, we cannot find or delete the counts from your earlier visits.

The anonymous counts do not ask first, because they only measure CEVO's own audience, keep nothing that could identify you and can be switched off at any time. In the UK, the law allows anonymous statistics about how a site is used without consent, as long as you are told and can switch them off (PECR reg. 6 as amended by the Data (Use and Access) Act 2025). In the EU, the counts are built to the conditions that regulators such as France's CNIL set for audience measurement that needs no consent. Outside the United States, visit records, which use cookies with an ID, start only after you accept the cookie banner. If we ever add another analytics tool, it will appear in the list below, with how to switch it off, before it goes live.

Advertising

We measure whether our Google ads lead to sign-ups and purchases, from our server only. No ad tag, pixel or ad cookie runs on any CEVO page.

Google Ads

If you arrive from a Google ad, the link carries a click ID (gclid, gbraid or wbraid). In the United States it is saved in this tab's session storage under cevo.click.v1, unless you have switched Google Ads measurement off in Cookie settings or your browser sends a Global Privacy Control signal. Everywhere else, and when we cannot tell your country, until you choose in the cookie banner, it is kept only in the page's memory and in the link from our homepage to the questionnaire, never saved on your device, and it is saved under cevo.click.v1 only if you accept advertising cookies. It is not a cookie, and it is gone when you close the tab.
When Google Ads measurement is on for you, our server tells Google Ads, once, when you unlock your free readout, that a sign-up came from that ad. It sends the click ID, the time your sign-up was stored, a fixed value of 5.00 USD, a random transaction ID and a signal that ad measurement is allowed. If you pay for a report, it also sends one purchase conversion: the click ID, the amount paid in USD, the payment time and a transaction ID. Add-ons and scans are not reported.
If you unlock with an email address, nothing is sent unless you later continue with Google in a browser that came from a Google ad with Google Ads measurement on; then that browser's click ID is sent. Otherwise the conversion is dropped after 7 days.
Once the upload has finished or failed, we delete the click ID from your sign-up record and keep only a keyed hash of it (a one-way code). Where visit records are on, they keep the click IDs in the link you arrived with, on CEVO's server only (see analytics).
No Google tag or Google cookie runs on CEVO pages. Enhanced conversions are switched off, so Google receives no email address or phone number, hashed or not.
If you switch it off, send a Global Privacy Control signal, refuse or have not yet chosen in the cookie banner, or did not come from a Google ad, Google Ads receives nothing about you.

In Washington and Nevada, the conversion sent to Google Ads counts as sharing consumer health data under those states' laws. You can switch it off at any time in Cookie settings, and a Global Privacy Control signal switches it off for you.

Under California law, letting Google measure ads this way counts as "sharing" personal information for advertising. You can opt out at any time by switching off "Measure Google ads" in Cookie settings, and Global Privacy Control opts you out for you (see when we ask first).

Partner links

Some websites link to CEVO with a partner code in the address, for example cevolab.com/?via=partner. The code applies the partner's discount and tells us who to pay a commission to.

We carry the code through to checkout in the page address and store it with your order on our server and, where visit records are on, with your visit record. The code is not put in a cookie or stored on your device. Where visit records are on, a partner whose link you followed is credited if you buy within 60 days, even if you come back without the link; otherwise only the code in the link you check out from counts.

The scanner that partners can embed on their own sites sets no cookies and loads no ad tags.

Full list

Name	Type	Purpose	Kept for	Set by	Consent
__Host-cevo_session	Strictly necessary	Keeps you signed in	30 days	CEVO	No
__Host-cevo_cap	Strictly necessary	Links the photos you took in this scan to you once you sign in	24 hours	CEVO	No
__Host-cevo_oauth	Strictly necessary	Links a Google sign-in in progress to your browser; used once	10 minutes	CEVO	No
cevo_csrf	Strictly necessary	Protects your forms	Browser session	CEVO	No
cevo_consent	Strictly necessary	Remembers your cookie choice, including whether visit measurement is off	182 days (6 months)	CEVO	No
__cf_bm	Strictly necessary	Blocks automated traffic	30 minutes	Cloudflare	No
__stripe_mid, __stripe_sid	Strictly necessary	Fraud checks at payment	1 year; 30 minutes	Stripe	No
Sign-in cookies	Strictly necessary	Apple or Google sign-in, in their own window on their sites	Their policy	Apple, Google	No
cevo.funnel.v1, cevo.consent.v1, cevo.tier, cevo.unlock.v1, cevo.pair.v1, cevo.cap.v1, cevo.intent.v1	Strictly necessary (session storage)	Keeps your answers, consent receipt, tier and unlock step through a refresh, a phone-to-computer pairing in progress, the link your phone uses to add a photo to your order, and which free test you arrived for (for example the face symmetry test) so the scan shows that result first	Until you close the tab	CEVO	No
cevo.resume.v1, cevo.resume.left; browser database cevo-resume	Strictly necessary (session storage; IndexedDB)	While you sign in to unlock the free readout: an encrypted copy of your free scan in this browser, the key to it in this tab and the Google sign-in tab it opened only, and a note that you left the scan page	Until the readout opens, you discard the photo, exit or start over, or you come back to the scan after leaving it; otherwise until the next time you open the CEVO questions or scan once 30 minutes have passed	CEVO	No
cevo.paid.v1; browser database cevo-paid	Strictly necessary (session storage; IndexedDB)	From the moment you press Pay: an encrypted copy of your front photo and its landmarks in this browser, so it reaches your paid order even if the scan tab is closed or reloaded, and the key to it in the tab you paid from and its payment tab only	Until CEVO has the photo, you discard the photo or start over, you exit the scan with no payment open, or the payment is cancelled or expires; otherwise until the next time you open the CEVO questions, scan or order page once 2 hours have passed	CEVO	No
__Host-cevo_vid	Analytics	A random visitor ID, so CEVO's server can link your visits, where they came from and the steps reached, and later your sign-up	400 days, renewed on each visit	CEVO	US: on by default, off in Cookie settings or with GPC. Elsewhere or country unknown: only after you accept
__Host-cevo_sid	Analytics	A random session ID that groups the steps of one visit	30 minutes, renewed while you browse	CEVO	US: on by default, off in Cookie settings or with GPC. Elsewhere or country unknown: only after you accept
Visit counter	Analytics (no cookie, nothing stored on your device)	Counts, anonymously, how many visitors reach each step of the site	Counts: 400 days (about 13 months)	CEVO's server	No: on by default; off in Cookie settings or with Global Privacy Control
cevo.click.v1	Advertising (session storage, not a cookie)	Keeps the Google ad click ID you arrived with	Until you close the tab	CEVO	US: on by default, off in Cookie settings or with GPC. Elsewhere or country unknown: only after you accept
Google Ads conversions	Advertising (server to server, no cookie)	Tells Google Ads once when a visitor from one of its ads unlocks the free readout, and once when they pay for a report	Google's policy	CEVO's server	US: on by default, off in Cookie settings or with GPC. Elsewhere or country unknown: only after you accept
Country check	Strictly necessary (server, no cookie)	Decides from the country of your IP address whether to show the cookie banner	Not stored	CEVO's server	No
Partner code (via)	No cookie	Stored with your order and, where visit records are on, with your visit record; not on your device	As the order; visit records 25 months	CEVO	n/a

What never reaches an ad platform

No tag, and no server event sent to an ad platform, ever carries:

your photos, the 478 landmark points or any other face data;
your measurements, report text, renders or report links;
your questionnaire answers, including age band, reference baseline, ancestry and body fat;
your name, email address or phone number, hashed or not (Google's enhanced conversions are switched off);
your goal, the name of the report you picked, or whether you start a scan;
any page address that contains any of the above.

Ancestry and body-fat answers are sensitive data under GDPR Art. 9 and several US state laws, and body-fat is consumer health data under Washington's My Health My Data Act. We never sell any of it or share it for advertising.

When we ask first

On your first visit from outside the United States, or when we cannot tell your country, a small card in the corner of the page says "We use cookies to measure our ads and visits. You can change this anytime." Its Details link opens the full notice in place, which names Google Ads and explains what it receives, why and how to withdraw. The card offers "Accept" and "Reject" as buttons of equal size, with nothing pre-selected. Accepting also turns on visit records, which use two CEVO cookies. Before you choose, nothing runs except the strictly necessary cookies and the anonymous visit counts, which set no cookie (see analytics). If you came from a Google ad, its click ID is kept only in the page's memory and is not saved. It reaches Google Ads only if you accept; until then our server receives it with the visit counts and discards it.

Visitors in the United States see no banner. For them Google Ads measurement is on, as described under advertising, until they switch it off in Cookie settings, and a Global Privacy Control signal switches it off automatically.

How we tell your country

Our server looks up the country of your IP address in a copy of the DB-IP Lite database kept on CEVO's own server, so no other company is asked. Only the country is used, and only to decide whether to show the banner; the IP address is not stored for this. The legal basis is our legitimate interest in showing each visitor the right cookie choice (GDPR Art. 6(1)(f)). IP geolocation by DB-IP.

EU and UK

Advertising measurement needs your consent first (ePrivacy Directive Art. 5(3); UK PECR reg. 6). Refusing has no effect on what CEVO does for you.

United States

There is no cookie banner. Google Ads measurement is on until you switch off "Measure Google ads" in Cookie settings. "Cookie settings" is in the footer of the homepage and the scan page and at the top of the questionnaire; the "Do Not Sell or Share My Personal Information" link there opens the same Cookie settings; on other pages it brings you to this section.
If your browser sends a Global Privacy Control signal, we treat it as that opt-out straight away: no conversion is sent to Google for that browser, and one not yet sent is cancelled. Visit measurement is switched off as well.
We never sell your personal information.

Changing your choice

Use the "Cookie settings" link in the footer of the homepage or the scan page, or at the top of the questionnaire ("Cookies" on phones). In the United States it opens the "Measure Google ads" switch; elsewhere it reopens the banner. Switching off is as easy as switching on.
When you withdraw, nothing more is sent to Google Ads: a conversion not yet sent is cancelled, and the click ID is deleted from your sign-up record and removed from this tab.
In Cookie settings on the homepage, the questionnaire or the scan page, switch off "Measure my visits" to stop visit measurement in that browser; our server then expires its two ID cookies.
You can also block or delete cookies in your browser settings, or turn on Global Privacy Control.
Google's My Ad Center, in your Google account, controls how Google uses what it already holds.

What Google receives, and your other rights over your data, are set out in the privacy policy.

Updates and contact

When we add, change or remove a cookie or tag, we update the list on this page and its date first. Questions go to privacy@cevolab.com.

Cookies and pixels