Cookie policy
Last updated: 12 October 2026
The small files and browser storage QRiva uses, what each one does and how long it lasts. QRiva sets no advertising cookies of its own.
1.About cookies
Cookies are small files a website stores in your browser. Local storage is similar, but its contents stay in your browser and are not sent to us.
QRiva sets cookies only on its own domain, qr-iva.com, and on domains our customers connect to QRiva for their links and pages. They are first-party cookies; none are used for advertising or to follow you across other websites.
Under Romanian Law 506/2004 and the EU ePrivacy Directive, cookies that are strictly necessary to provide a service you asked for need no consent. On the pages, cards, forms and passports businesses publish with QRiva, every other cookie is set only after the choice described below. On QRiva's own website and app, the functional cookies in the table are set to provide the features they describe: recognising a team member's own test scans, and crediting a referral link you followed. The analytics and advertising cookies of QRiva's own website are set only after you agree to them, as described below.
2.Cookies QRiva sets
This is every cookie QRiva itself sets:
| Name | What it's for | How long | Type |
|---|---|---|---|
| sb-…-auth-token | Keeps you signed in to the app. | Until you sign out, renewed while you use the app | Strictly necessary |
| qws | Remembers which workspace you're working in. | 1 year | Strictly necessary |
| qm | Marks a team member's browser so their own test scans aren't counted in analytics. | 1 year | Functional |
| qtd | Marks a device the workspace chose as a test device, so its scans aren't counted. | 5 years | Functional |
| qpk | Holds a one-time challenge while you sign in with a passkey. | 5 minutes | Strictly necessary |
| qu_… | Remembers that you entered the right password for a protected link. | 12 hours | Strictly necessary |
| qops | Confirms, for a few hours, that a QRiva staff member has re-checked who they are with a passkey before using QRiva's internal console. | 12 hours | Strictly necessary |
| qref | Remembers the referral link you arrived through, so the business that invited you can be credited if you sign up. Holds only the referral code. | 60 days | Functional (referral) |
| qopc | Holds a one-time challenge while a QRiva staff member confirms who they are with a passkey in QRiva's internal console. | 5 minutes | Strictly necessary |
| qsc | Remembers your answer in the cookie panel on QRiva's own website, separately for analytics and advertising, so you aren't asked on every visit. | 6 months | Strictly necessary |
| qriva_ga, qriva_ga_… | Google Analytics on QRiva's own website: tells visits and visitors apart so we can see how the website is used. Set only after you accept Analytics in that panel. | 13 months | Analytics (QRiva's website, optional) |
| qriva_au, qriva_aw, qriva_gb | Google Ads on QRiva's own website: connects a visit or a sign-up to the QRiva ad that led to it. Set only after you accept Advertising in that panel. | 90 days | Advertising (QRiva's website, optional) |
| qsignup | Marks, for a few minutes after you sign up, that the sign-up can be reported once to the Google tags you accepted. Set only if you accepted Analytics or Advertising. | 10 minutes | Analytics or advertising (QRiva's website, optional) |
| qc | Remembers your answer in the cookie panel (Accept all, Limited or Decline) separately for each business whose pages you opened on that address, so you aren't asked on every visit. Each business appears only as a short one-way code, never by name or account number. | 6 months | Strictly necessary |
| qv | Lets QRiva count returning visitors for the businesses you allowed it for, without storing IP addresses. A business you chose Accept all for may use it; a business you chose Limited for only while it is a browser-session cookie; others never. Never used by workspaces in strict privacy mode. | 13 months once you choose Accept all for any business on that address; until you close your browser if you've only chosen Limited; removed when no business has either | Analytics (for the publishing business) |
3.Local storage
QRiva also keeps a few things in your browser's local storage, which is never sent to us:
- your light, dark or automatic theme, whether the sidebar is collapsed, and the choices you make in the website's Accessibility menu;
- whether you've dismissed the welcome tour;
- a draft of a long form you're filling in, so you don't lose your answers;
- on a business's own website that uses the QRiva conversion snippet, the scan reference, so a later purchase or sign-up can be connected to the scan.
4.Measuring our own website
Our website counts page views in two ways that set no cookies and store no IP addresses: our own counter, which keeps only a daily total per page and referring website, and Vercel Web Analytics. Neither is used inside the app or on pages our customers publish.
QRiva may also use Google Analytics 4 and Google Ads on its own website. When it does, the website asks you about each one separately in a cookie panel, and neither loads at all until you agree to it. Analytics shows us how the website is used. Advertising tells us which of our ads led to a visit or a sign-up and lets Google show our ads to people who visited our website. Their cookies on qr-iva.com start with “qriva_”, so they never mix with tags a business adds to its own pages. With Advertising accepted, Google may also set cookies on its own domains, such as google.com and doubleclick.net, under Google's own policy.
These tags never run on the pages, cards, forms, product passports or redirects our customers publish, or inside the app, except to report once that you signed up, when you agreed to it.
5.Tags added by businesses
Businesses can add their own analytics or advertising tags, such as Google Analytics, Google Ads, Meta Pixel or TikTok Pixel, to the pages, passports and redirects they publish with QRiva.
Those tags and their cookies are controlled by that business and the tag provider, not by QRiva, and that business is responsible for them. On pages, cards, product passports and redirects that QRiva serves, a business's tags load only after you choose Accept all for that business in the cookie panel; accepting for one business never loads another business's tags. With Limited or Decline, or before you choose, they never load. On a business's own website, that website asks for your consent itself.
6.Your choices
You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop you signing in to the app or opening password-protected links.
On QRiva's own website, whenever these tags are in use, Cookie settings at the bottom of every page lets you change or withdraw your answer about analytics and advertising at any time. Withdrawing removes the cookies those tags set on qr-iva.com.
On pages businesses publish, choices are made per business, on that business's own pages. The first time you open a page, form, card or product passport a business published with QRiva, a panel names the business and asks what you allow for it alone. Accept all lets QRiva recognise your repeat visits for that business and lets its analytics and advertising tags run. Limited allows only anonymous visit counting for that business within one browser session, and no tags. Decline allows neither: your visit is still counted as a total, without recognising you. Until you choose, everything works as if you had declined.
Answers are kept for 6 months on that address and also apply to that business's codes you scan there. To change an answer, use Cookie settings at the bottom of that business's page. To remove every answer on this device for this address at once, use the button below.
7.Changes
We update this page whenever we add, change or remove a cookie. The date at the top shows the latest version.