Skip to content
Create QR

Cookies and Browser Storage

Last updated: October 25, 2026

Document contents · 10 sections
  1. 011. Scope and storage types
  2. 022. Language preference cookie
  3. 033. Public website local storage
  4. 044. Account access, preferences and drafts
  5. 055. Storage used by mini-site features
  6. 066. The operator’s website and account analytics
  7. 077. Publisher-selected trackers and external services
  8. 088. Managing your browser data
  9. 099. Storage duration and server records
  10. 1010. Updates and contact

Draft for review. Legal review is required before this document is published as the effective cookie policy, including review of third-party tracking and consent controls.

1. Scope and storage types

This policy describes cookies and browser storage used by the operator of Smart QR Codes on the public website, in the account application and on published mini-sites. See the Privacy Policy for server-side information and data requests.

The operator is Ozumni LLC.

Cookies can be sent with requests to the host they belong to. localStorage holds values for a website origin across visits. sessionStorage normally lasts for a browser tab session. These mechanisms are different, and browser data is separate from records stored on the service’s servers.

The public website, account interface and guest mini-site language controls use the qrcw_locale cookie to remember a selected language. Its value is a language code, and the configured lifetime is one year from when it is written. It applies to the host where it is set and the whole path of that host.

The cookie uses SameSite=Lax and is marked Secure on HTTPS. It can be read by the interface; it is not a session authentication cookie. Deleting it may reset your language preference, and a later language selection can create it again.

3. Public website local storage

  • qrcw-theme stores the light, dark or system theme preference.
  • qr_templates stores QR design templates you save, including their names, appearance settings and any saved logo reference or image data.
  • qrcw_qr_scan_history and qrcw_barcode_scan_history store recent scanner results and timestamps on this browser. Each history is limited to the latest 20 entries and has a clear-history control.
  • pending_qr_id stores a reference used to continue creating a dynamic QR code after sign-in. It is a reference, not the QR content itself. The corresponding temporary server record has a separate expiry.
  • qrcw_analytics_consent records an allowed or declined analytics choice where the public website’s analytics controls are enabled.

These localStorage entries have no time-based expiry set by the application. They remain until the relevant feature removes or replaces them, you clear site data, or the browser removes them. Saving scanner history locally does not mean that visiting a scanned destination produces no server records.

4. Account access, preferences and drafts

The account client stores accessToken and refreshToken in localStorage, not in HttpOnly cookies. The current server settings give an access token a 15-minute validity and a refresh token a validity of up to seven days. A successful refresh replaces the refresh token. Expiration does not automatically remove the stored value from the browser.

Signing out removes the local account tokens and requests revocation of the supplied refresh token. Do not share these values. On a shared device, sign out and clear site data when you have finished.

  • dashboard.sidebar.collapsed and dashboard.sidebar.v2 record the sidebar preference and its settings version.
  • qr_templates and entries beginning qrk-ms-draft: hold saved QR designs or local mini-site drafts. Drafts can contain the content being edited and are cleared after a successful save.
  • qrcw_menu_view, qrcw_orders_muted, qrcw_kitchen_muted and entries beginning qrcw_orders_kanban_ store view, sound or board preferences for the relevant account features.
  • Session storage includes qrk-tab-id for identifying an editor tab and qrcw.chunk-reload-guard for controlling recovery from a page-loading error. Administrative sessions can also keep local state for authorised support access.

Account preferences and local drafts do not have a general time-based expiry. Their removal depends on the feature or on clearing browser data. Avoid clearing an unsaved draft before keeping a copy or saving it successfully.

5. Storage used by mini-site features

A published mini-site can use additional browser storage when its publisher enables the corresponding features:

  • Entries beginning qrcw_lang_ remember the selected language for that mini-site.
  • Entries beginning qrcw_minisite_tracking_consent: store the allowed or declined publisher-tracking choice separately for each mini-site.
  • qrcw_device_id stores a stable guest device identifier used by interactive menu features. Entries beginning qrcw_guest_phone_ can remember the phone number entered by a guest.
  • Entries beginning qrcw_cart_ store the current cart for a menu. The cart is removed when emptied or after the relevant successful paid-order flow.
  • Session entries beginning qrcw_waiter_table_ or qrcw_preorder_ keep a selected table or temporary payment-return state for the relevant feature.

The localStorage items above have no general time-based expiry. Phone numbers, device identifiers and information submitted in forms or orders can also be transmitted to the service or a recipient configured by the publisher. They are not necessarily stored only on your device.

6. The operator’s website and account analytics

If platform analytics is enabled through the service configuration, the public website and account use Google Analytics 4 with Google Consent Mode v2. When the analytics identifier is not configured, the Google Analytics script is not loaded.

Before a choice, analytics_storage, ad_storage, ad_user_data and ad_personalization are denied. qrcw_analytics_consent stores the allowed or declined analytics choice. Allowing analytics grants analytics_storage; advertising signals remain denied because this control does not request advertising-cookie consent.

Declining prevents the client event helper from sending Google Analytics events. Server-side events used for redirects, security and scan reports are separate from this browser preference.

7. Publisher-selected trackers and external services

Mini-site publishers can include third-party pixels and other external services, and existing mini-sites can retain legacy tracker settings. Configured publisher tracking scripts load only after the visitor allows analytics and marketing tools in that mini-site’s separate consent notice. The choice is stored separately for each mini-site.

External maps, media and other embedded content can also contact their providers when loaded. Refer to the publisher’s information and the relevant provider’s policy for the purpose, lifetime and controls of that provider’s storage. The operator’s website analytics preference is not a control for all third-party content.

When you choose Google sign-in or, when available, Stripe Checkout or Customer Portal, the external service can use its own storage under its own policy. Following a QR destination or other external link can likewise take you to a service with different data practices.

8. Managing your browser data

  • Use the scanner’s clear-history action or delete saved templates in the relevant tool when those controls are available.
  • Use your browser’s site-data settings to remove cookies, localStorage and other stored data for the relevant origin. The public website, account and custom mini-site domains can have separate storage.
  • Use the public website’s analytics settings control to clear the stored preference and show the choice again.
  • Use browser controls to block or remove third-party cookies and consult the publisher or external provider about its own trackers.
  • Sign out of the account on shared devices. Clearing data can remove preferences, scanner history, carts and unsaved drafts, and can require you to sign in again.

Blocking storage can affect sign-in and the functions that rely on saved state. Clearing browser data does not cancel a subscription, withdraw a form already submitted or erase server-side records. For those requests, contact hi@smartqrcodes.io.

9. Storage duration and server records

The language cookie has the one-year configured lifetime described above. localStorage normally persists across browser restarts until it is removed; sessionStorage normally lasts for the tab session. Browser settings, session restoration and storage policies can affect these periods.

Token validity is controlled by the server, separately from browser storage. The temporary server record referenced by pending_qr_id expires after 30 minutes, while a leftover local reference does not have its own timer. Other server records follow separate retention arrangements described in the Privacy Policy.

10. Updates and contact

This policy needs to be updated if browser storage or tracking arrangements change. The current revision is available on this Cookie Policy page, with its revision date.

For questions about cookies, local data or analytics choices, contact the operator of Smart QR Codes at hi@smartqrcodes.io.