This page lists the cookies and similar technologies qrcodekit.com uses, what each one is for and how long it lasts. A cookie is a small file a site stores on your device; we also use your browser's local storage in one place, noted at the end.
Only the cookies in the "Strictly necessary" table below are set without asking. Everything else — analytics and advertising — is loaded by our tag manager (container GTM-5ZTPS3V) and only once consent allows it.
How your choice is obtained
Where prior consent is required — the EEA, the United Kingdom, Switzerland, Brazil, and a number of other jurisdictions — nothing in the measurement or marketing tables is loaded until you accept. Declining leaves only the strictly necessary cookies in place.
Elsewhere, these categories may load by default and you can opt out at any time. We honour Global Privacy Control and "Do Not Track" browser signals as an opt-out, and we treat an opt-out as applying until you change it.
Strictly necessary
Required for the site to work and to remember your privacy choice. These are not optional and are set without consent.
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| _cfuvid | Cloudflare | Distinguishes the visitor for abuse and rate-limit protection | Session |
| cf_clearance | Cloudflare | Records that a security challenge was passed | 30 minutes |
| qrk_consent | QRCodeKIT | Stores your consent choices and the region they were made in, so we do not ask again on every page | 365 days if you accept; 180 days if you decline |
| qrk_country | QRCodeKIT | Two-letter country detected at the CDN edge, used to apply the right consent rules | Session |
| messagesUtk | HubSpot | Links you to your own conversation in the support chat, so a reply still reaches you as you move between pages | Up to 6 months |
Measurement
Aggregate statistics about how the site is used. Loaded only with your consent.
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| _ga, _ga_* | Google Analytics | Distinguishes visitors and sessions to produce aggregate usage statistics | Up to 2 years |
| _gid | Google Analytics | Distinguishes visitors | 24 hours |
| _gat, _gat_* | Google Analytics | Limits the rate of requests sent to Google | 1 minute |
| hubspotutk | HubSpot | Identifies a returning visitor across sessions | Up to 6 months |
| __hstc, __hssrc, __hssc, __hs_* | HubSpot | Records visit timing and session state for aggregate analytics | Session to 6 months |
| _clck | Microsoft Clarity | Persists the Clarity user identifier and preferences so behaviour is attributed to the same anonymous visitor | Up to 1 year |
| _clsk | Microsoft Clarity | Connects multiple page views by the same visitor into a single session recording | 1 day |
Marketing
Advertising measurement and attribution. Loaded only with your consent.
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| _gcl_* | Google Ads | Attributes a conversion to the ad click that led to it | Up to 90 days |
| _fbp, _fbc | Meta | Measures and attributes advertising delivered on Meta platforms | Up to 90 days |
| _uetsid, _uetvid, _uetmsclkid | Microsoft Advertising | Measures and attributes advertising delivered on Microsoft platforms | Up to 13 months |
| _rdt_uuid | Measures and attributes advertising delivered on Reddit | Up to 90 days | |
| __oppref | OpenAI | Remembers the OpenAI ad click that brought you here, so a later signup can be credited to that ad | 30 days |
| __obref | OpenAI | Distinguishes the browser so OpenAI can measure advertising delivered on its platforms | Up to 1 year |
| utmValues, originalReferer | QRCodeKIT | Carries the campaign parameters you arrived with into the app, so a signup can be credited to the right campaign | 30 days |
Changing or withdrawing your choice
Use the "Cookie settings" link in the footer of any page to review or change your choice at any time. Withdrawing consent stops the tags immediately and deletes the first-party cookies for the categories you switched off.
Two limits worth stating plainly: cookies set on another company's domain cannot be deleted from this site, and neither can cookies marked HttpOnly. For those, withdrawal works by instructing the tag not to use them, and you can clear them in your browser settings.
You can also block or delete cookies in your browser. Blocking the strictly necessary ones may stop parts of the site working.
Local storage
Besides cookies, we set one local-storage key, qrk_analytics. It is a diagnostic switch used by our own team to force analytics on while testing, and it is never set for ordinary visits.
Third-party policies
Where a table names another company as the provider, that company processes the data under its own policy: Google, Meta, Microsoft, OpenAI, Reddit, HubSpot and Cloudflare each publish one.
Questions
Write to [email protected] and we will answer. Our privacy policy explains the wider picture of what we collect and why.