Legal

Cookie and Storage Policy

Effective 15 September 2026 · Version 2.7 · Part of our Privacy Policy

This page explains the cookies and browser storage QRCandy uses on qrcandy.co, how we classify each one, and how to change your choices. QRCandy uses no advertising, retargeting, or cross-site behavioural tracking, and never sells personal data.

Manage your choices

You can change or withdraw your consent at any time. Open the settings below, or use the “Cookie settings” link at the bottom of the site's pages (in the menu when you are signed in), and choose “Reject all” to withdraw it in one step. Strictly-necessary storage always runs because the site cannot work without it; everything optional stays off until you allow it.

What each category does

Strictly necessary: always on

Needed for sign-in, your cart, checkout, the language and currency you pick, security, and remembering your cookie choice. This category also covers error and security monitoring (Sentry): it sets no cookies, stores nothing on your device, collects no IP address or account identifiers, and sends anything only when an error occurs. It only helps us detect and fix faults, which is why we treat it as an essential safeguard rather than analytics.

Analytics: off until you allow it

We use Google Analytics to see which pages are visited, which sites send visitors, and how the site works on different devices, so we can improve it. While this category is off, nothing from Google loads and no request is sent to Google. If you allow it, Google Analytics sets the two first-party cookies listed below. Withdrawing consent deletes them straight away.

What we send is limited on purpose: page addresses lose everything after “#”, every query parameter except campaign tags such as utm_source, and account or order identifiers. We never send your name, email address, or account identifier. Advertising storage, ad personalisation, Google signals, and Google Analytics' automatic event collection are switched off, and pages for QR scans, supplier links, and staff administration are never measured. Google Ireland Limited processes the data as our processor; Google LLC may process it in the United States under the EU-US Data Privacy Framework. The Privacy Policy gives the legal basis and retention, and Google explains its own use of the data at policies.google.com/technologies/partner-sites.

Everything we store

qrcandy:consent · local storage

Remember your cookie choices so we don't ask again on every visit.

Duration: 12 months, then we re-ask; removed when you clear browser data
Category: Necessary

qrc_locale and qrc_currency · first-party cookies

Remember the language and presentment currency you select.

Duration: 1 year
Category: Necessary

__cf_bm · first-party cookie set by our hosting provider (Cloudflare)

Tells people apart from automated bots so the site stays protected. Set by Cloudflare's security layer, not by QRCandy's own code.

Duration: 30 minutes
Category: Necessary

sidebar_state · first-party cookie

Remember whether the authenticated dashboard sidebar is open.

Duration: 7 days
Category: Necessary

Supabase authentication token · local storage

Keep an authenticated account signed in and refresh its session securely.

Duration: Until sign-out, session invalidation/expiry, or browser data is cleared
Category: Necessary

qrcandy:cart, product drafts, brand settings, and QR call-to-action · local storage

Keep the cart and customer-requested design work across pages and return visits.

Duration: Until removed, replaced, account data takes over, or browser data is cleared
Category: Necessary

qrcandy-marks · IndexedDB database

Keep each logo or icon used in your cart and design drafts once on your device, so large images do not fill up browser storage.

Duration: Until removed, pushed out by newer images (the 64 most recently used are kept), or browser data is cleared
Category: Necessary

qrcandy:checkout:address, :email, and :attempt · local storage

Prefill checkout and safely reconcile/retry the current Stripe checkout attempt.

Duration: Until edited, successful checkout removes the attempt, or browser data is cleared
Category: Necessary

qrcandy:help-dismissed:* · local storage

Remember that you dismissed a one-time help note.

Duration: Until browser data is cleared
Category: Necessary

qrcandy:card-columns · local storage

Remember whether you chose one or two product cards per row on a phone.

Duration: Until you switch back to two per row or clear browser data
Category: Necessary

qrcandy:chunk-reload · session storage

Stop an endless reload loop when the site recovers on its own from an outdated version after an update.

Duration: Until you close the tab
Category: Necessary

qrcandy:referral · local storage

Remember a referral or discount code you followed or applied, and when, so the discount reaches checkout and the partner who referred you can be credited for the order.

Duration: 30 days by default; the configured code window may be 1–365 days; removal at expiry or when you clear the code
Category: Necessary

_ga · first-party cookie (Google Analytics)

Holds a random identifier so Google Analytics can tell visits apart and count returning visitors. Set only if you allow the Analytics category.

Duration: Until your consent expires, at most 12 months after you gave it; deleted at once if you withdraw consent
Category: Analytics

_ga_W9S06TJ8GG · first-party cookie (Google Analytics)

Keeps track of the current visit (session) for Google Analytics. Set only if you allow the Analytics category.

Duration: Until your consent expires, at most 12 months after you gave it; deleted at once if you withdraw consent
Category: Analytics

Name / type	Purpose	Duration	Category
qrcandy:consent · local storage	Remember your cookie choices so we don't ask again on every visit.	12 months, then we re-ask; removed when you clear browser data	Necessary
qrc_locale and qrc_currency · first-party cookies	Remember the language and presentment currency you select.	1 year	Necessary
__cf_bm · first-party cookie set by our hosting provider (Cloudflare)	Tells people apart from automated bots so the site stays protected. Set by Cloudflare's security layer, not by QRCandy's own code.	30 minutes	Necessary
sidebar_state · first-party cookie	Remember whether the authenticated dashboard sidebar is open.	7 days	Necessary
Supabase authentication token · local storage	Keep an authenticated account signed in and refresh its session securely.	Until sign-out, session invalidation/expiry, or browser data is cleared	Necessary
qrcandy:cart, product drafts, brand settings, and QR call-to-action · local storage	Keep the cart and customer-requested design work across pages and return visits.	Until removed, replaced, account data takes over, or browser data is cleared	Necessary
qrcandy-marks · IndexedDB database	Keep each logo or icon used in your cart and design drafts once on your device, so large images do not fill up browser storage.	Until removed, pushed out by newer images (the 64 most recently used are kept), or browser data is cleared	Necessary
qrcandy:checkout:address, :email, and :attempt · local storage	Prefill checkout and safely reconcile/retry the current Stripe checkout attempt.	Until edited, successful checkout removes the attempt, or browser data is cleared	Necessary
qrcandy:help-dismissed:* · local storage	Remember that you dismissed a one-time help note.	Until browser data is cleared	Necessary
qrcandy:card-columns · local storage	Remember whether you chose one or two product cards per row on a phone.	Until you switch back to two per row or clear browser data	Necessary
qrcandy:chunk-reload · session storage	Stop an endless reload loop when the site recovers on its own from an outdated version after an update.	Until you close the tab	Necessary
qrcandy:referral · local storage	Remember a referral or discount code you followed or applied, and when, so the discount reaches checkout and the partner who referred you can be credited for the order.	30 days by default; the configured code window may be 1–365 days; removal at expiry or when you clear the code	Necessary
_ga · first-party cookie (Google Analytics)	Holds a random identifier so Google Analytics can tell visits apart and count returning visitors. Set only if you allow the Analytics category.	Until your consent expires, at most 12 months after you gave it; deleted at once if you withdraw consent	Analytics
_ga_W9S06TJ8GG · first-party cookie (Google Analytics)	Keeps track of the current visit (session) for Google Analytics. Set only if you allow the Analytics category.	Until your consent expires, at most 12 months after you gave it; deleted at once if you withdraw consent	Analytics

Payments

Payments are handled on Stripe's own hosted checkout pages. Any Stripe cookies used for checkout, fraud prevention, security, and performance are set on Stripe's domain under Stripe's own notices, not on qrcandy.co.

Deleting what is stored

Clearing your browser's site data for qrcandy.co removes every first-party item above. It also signs you out and clears saved carts, drafts, and preferences, and the cookie banner will ask for your choice again on your next visit.

For the full picture of how we handle personal data, see our Privacy Policy and Terms of Service.