Cookie policy
What QRSalt stores in your browser and why. Most of it keeps you signed in. The only optional part is ad measurement and analytics, one choice for both, which stays off in Europe until you say yes.
Last updated 28 September 2026
What cookies are
A cookie is a small piece of text a website asks your browser to keep and send back on later visits. Local storage and session storage are similar, but stay in the browser and are not sent anywhere on their own; session storage is cleared when you close the tab. This policy covers all three, and calls them all "cookies" where the difference does not matter.
Some are strictly necessary: the site cannot work without them, or they only remember a choice you made here, so the law does not require consent for them. The rest are analytics or advertising, and those are optional. Cookies we set are first-party; cookies set by another company under its own name are third-party, and are marked as such below.
Your current choice
Checking which rules apply to you…
You can also reopen this choice at the foot of every page. Changing your mind is one click, the same as deciding the first time. The control is called Cookie settings, except in the United States, where it is called Your privacy choices, because that is the name US state privacy laws give the control that turns sharing off. It is the same button and it does the same thing.
Do not sell or share my personal information
We do not sell personal data for money. When ad measurement and analytics are on, the Google tag on our public pages tells Google Ads and Google Analytics about your visit, and that can count as "sharing" for cross-context behavioural advertising under California's CPRA and the laws modelled on it. Rejecting above, or in Your privacy choices at the foot of any page, is your opt-out of that sharing: the tag is told to stop, Google is told to restrict processing, and the cookies listed below are deleted from our domain. It is remembered in this browser for about 6 months. Global Privacy Control does the same thing without a click, in every browser that sends it. See the privacy policy for the rest of your state rights and how to use them.
How the choice works
- In the EEA (including Norway), the UK and Switzerland, and in the Channel Islands, the Isle of Man and Gibraltar, the Google tag (Google Ads and Google Analytics) does not load and sets nothing until you accept. If you reject, or never answer, it stays off.
- Everywhere else, including the United States, ad measurement and analytics load with the page and there is no banner: nothing interrupts you, and you switch them off whenever you like from the foot of any page. In the United States that control is named Your privacy choices, and switching them off is your opt-out of "sharing" under US state privacy laws.
- Global Privacy Control is honoured everywhere. If your browser sends it (as a
Sec-GPCheader or through the setting pages read), the Google tag is not put on the page at all: no cookies, nothing sent to Google, nothing about your visit shared with ad partners, and we do not ask you again. - We work out which rules apply from the country Cloudflare reports for your connection. We do not store it. If it cannot be worked out, we assume the European rules.
- We remember your answer for about 6 months, then ask again.
- The signed-in dashboard, our admin area, and the pages people reach by scanning a customer's code (redirects, hosted pages, menus, forms, contact cards and files) never load ad or analytics tags at all. They only use strictly necessary cookies. That is still true of a QR Menu that appears in search results: being listed changes what search engines are told about the page, and nothing about what runs on it.
Strictly necessary
These make the site work or remember a choice you made on it, so they do not need your consent and cannot be switched off. None of them is used for advertising or shared with anyone.
| Name | What it does | Set by | Lasts |
|---|---|---|---|
__Host-qr_sessioncookie | Keeps you signed in. Holds a random token; we store only a hash of it. Not readable by scripts. Browsers that signed in before the name changed may still hold it as qr_session; it is moved to the new name on your next visit, and the old name is not accepted after 12 October 2026. | QRSalt | The browser keeps it up to 400 days, but the sign-in stops working after 30 days without use, or when you sign out |
qr_signed_incookie | Lets the public site show "Dashboard" instead of "Sign in". Holds only "1" and grants no access. | QRSalt | Up to 400 days; removed when you sign out |
qr_knowncookie | Remembers that this browser has had an account here, so buttons that need one open sign-in rather than sign-up. Holds only "1" and grants no access. Kept when you sign out; removed when you delete your account. | QRSalt | 400 days |
__Host-qr_signincookie | Links the two steps of a password sign-in: the password, then the emailed or authenticator code. Not readable by scripts. | QRSalt | 10 minutes |
qr_pendingcookie | The email address you are signing in with, so the code page can show it without putting it in the address bar. | QRSalt | 15 minutes |
qr_nextcookie | Where to take you after you sign in. | QRSalt | 10 to 15 minutes |
qr_g_state, qr_g_nonce, qr_g_verifier, qr_g_modecookie | Protect a Sign in with Google against forgery and replay. | QRSalt | 10 minutes |
qr_restorecookie | Set only if you sign in to an account that is scheduled for deletion, so we can ask whether to restore it. Not readable by scripts. | QRSalt | Until the account can no longer be restored, 30 days at most |
qr_draft_logocookie | Set only if you add a logo in the free generator and then choose to sign up: a signed reference to that logo so it is waiting in your new account. It does not contain the picture. Not readable by scripts. | QRSalt | 24 hours, or until your new account picks up the logo |
qr_draft_pdfcookie | Set only if you choose a PDF on the PDF to QR code page and then choose to sign up: a signed reference to that file so it is waiting in your new account. It does not contain the file. Not readable by scripts. | QRSalt | 24 hours, or until your new account picks up the PDF |
qr_draft_bulkcookie | Set only if you choose dynamic codes in the free bulk generator and press Continue: a signed reference to the rows of your list that are to be dynamic, so they are waiting in the importer in your account. It does not contain the list. Not readable by scripts. | QRSalt | 24 hours, or until your account picks up the list |
qr_wscookie | Which of your workspaces you last opened. | QRSalt | 1 year |
qr.invite, qr.backupcodes, qr.importskipcookie | Show something once, right after you create it, and only on the page that needs it: a team invitation link, new authenticator backup codes, or the rows a bulk import skipped. Not readable by scripts. | QRSalt | 5 minutes |
qr_consentcookie | Remembers your cookie choice, so we do not ask on every page. | QRSalt | About 6 months |
qr_theme, qr.themecookie and local storage | Remembers whether you chose the light theme, the dark theme or your device’s setting. Holds only that word. | QRSalt | 1 year (cookie); until you clear it (local storage) |
qr.draftsession storage | Keeps a half-designed code while you create an account, so you do not lose it. | QRSalt | Until you close the tab; ignored after 24 hours |
qrsalt:routing-draft:…local storage | Keeps unsaved changes to a code’s routing rules in the dashboard, so a reload does not lose them. | QRSalt | Until you save or discard the changes |
qrsalt:celebrated:…local storage | Remembers that the thank-you animation for a purchase has been shown, so it is not shown again. Holds only a time. | QRSalt | Until you clear it |
qr.exitSurveylocal storage | Remembers that we showed you the short survey we sometimes ask as people leave, so we do not ask again. Holds only which version you saw, whether you answered or closed it, and when. | QRSalt | Until you clear it; ignored after 180 days |
qr.exitSurveyVisitsession storage | For that same survey: remembers when this visit started and whether you looked at our prices, so it waits a little and asks the right question. Only set for visitors who have not been asked and are not signed in. | QRSalt | Until you close the tab |
Set by Cloudflare
Cloudflare sits in front of the site to protect it. It may set these, only for security, under its own cookie policy. They are strictly necessary.
| Name | What it does | Set by | Lasts |
|---|---|---|---|
__cf_bmcookie | Tells people from automated traffic. | Cloudflare | 30 minutes |
_cfuvidcookie | Applies rate limits fairly to visitors who share an internet connection. | Cloudflare | Until you close the browser |
cf_clearancecookie | Set only if Cloudflare shows you a security check, to record that you passed it. | Cloudflare | Usually 30 minutes |
CF_Authorizationcookie | Set only for our own staff, when they sign in to our admin area through Cloudflare Access. Customers and visitors never get it. | Cloudflare | Up to 24 hours |
The anti-bot check on sign-in, registration, forms and abuse reports (Cloudflare Turnstile) runs in a frame from challenges.cloudflare.com. It is used only to tell people from bots and sets no cookie on our domain.
Payment pages
Checkout is provided by Whop, our payment provider. Its payment pages set their own cookies, under Whop's own policies, to take the payment securely. We may also use Whop's ad pixel on our public pages in future; it is switched off today, and if we switch it on it will follow the same choice as the advertising cookies below and be listed here first.
Analytics (optional)
Google Analytics tells us how the public pages are used. It follows the one choice you make above. If you say no, these are not set: in Europe nothing loads at all, and elsewhere the tag stays on the page in its switched-off state, where Google receives only cookieless signals without identifiers. If your browser sends Global Privacy Control, the tag is never loaded anywhere and Google receives nothing.
| Name | What it does | Set by | Lasts |
|---|---|---|---|
_gacookie | Tells one browser’s visits from another’s, so page views can be counted as visits. | Google Analytics, on our domain | Up to 2 years |
_ga_ followed by our property idcookie | Keeps track of the current visit. | Google Analytics, on our domain | Up to 2 years |
Advertising (optional)
We advertise on Google, and these tell us which ads lead to someone signing up or subscribing, so we stop paying for the ones that do not. They follow the same choice as analytics. See the privacy policy for what is sent to Google when you subscribe.
| Name | What it does | Set by | Lasts |
|---|---|---|---|
_gcl_aucookie | Connects a visit to a later sign-up or purchase on this site. | Google Ads, on our domain | 90 days |
_gcl_aw, _gcl_gs, _gcl_dccookie | Hold the identifier of the Google ad you clicked to get here. | Google Ads, on our domain | 90 days |
Google’s own cookies, such as IDE and test_cookiecookie | Ad delivery and measurement, under Google’s cookie policy. | Google, on its own domains | Up to 13 months |
qr_clickcookie | The Google ad click that brought you, and when. Saved with your account if you sign up, so a later purchase can be credited to that ad; that means it is sent to Google Ads. | QRSalt | 90 days |
qr_touchcookie | The site that first sent you, the campaign tags in its link, and the path of the first page you saw here. Nothing that identifies you. Saved with your account if you sign up, and never shared. In Europe it waits for your yes like the rest of this table; elsewhere it is kept even if you opt out of sharing, because it goes to nobody else. | QRSalt | 30 days |
qr.reports.checkedsession storage | Remembers that this tab has already checked whether a new account or purchase of yours still needs reporting to Google, so it does not ask again. | QRSalt | Until you close the tab |
Changing your choice
- On this site: choose Cookie settings — or Your privacy choices, if you are in the United States — at the foot of any page. When you withdraw consent, the tag is told to stop, and the Google cookies above are deleted from our domain.
- In your browser: you can block or delete cookies and site data in its settings. Blocking strictly necessary cookies will stop you signing in.
- With Google: cookies Google set on its own domains can only be removed by Google or in your browser. Google also offers ad settings and a Google Analytics opt-out add-on.
What we do not use
No analytics beyond the Google Analytics cookies above, no session recording, no fingerprinting, and no tracking pixels in our emails. Scanning a customer's dynamic code sets no cookie at all.
More
How we handle personal data generally is in the privacy policy. Questions: support@qrsalt.com.