Cookie Policy

1. Scope

Cookies and similar browser storage support authentication, security, language, interface state, request routing and checkout. This policy covers storage set by Magic QR Studio and identifies relevant third-party contexts.

2. Strictly necessary storage

Necessary cookies and storage are used to provide a service you request, keep sessions secure, prevent abuse, remember language and route authenticated requests. Where applicable e-privacy law permits, these are used without optional consent because the service cannot reasonably operate without them.

3. Current first-party inventory

• magic_qr_backend_session: HttpOnly authentication cookie, normally no longer than the session-token expiry and commonly up to seven days.
• magic_qr_password_challenge: short-lived HttpOnly cookie, normally up to 10 minutes, used to complete password verification or password setup securely.
• Auth.js session, OAuth state, PKCE and callback cookies: authentication and Google sign-in security; duration depends on the session or short-lived sign-in flow.
• magicqr.lang: language preference, normally up to one year.
• Browser local storage: language, time zone and short-lived session-subject or expiry coordination.
• mqs_patpat_admin: administrator-only HttpOnly session, normally up to two hours.

4. Third-party contexts

Cloudflare security and Turnstile, Google authentication and Creem hosted checkout may use necessary cookies on their own domains or embedded contexts under their policies. Magic QR Studio does not receive full payment-card cookie data.

5. No optional analytics or advertising cookies

The current application does not intentionally deploy advertising cookies, cross-site behavioural tracking or non-essential audience analytics cookies. Accepting purchase documents or continuing to browse does not consent to such technologies. If optional technologies are introduced, they will not be set before any legally required category choice, and rejecting them will be as easy as accepting them.

6. Controls and browser signals

You may delete or block storage in browser settings, but authentication and core features may stop working. Global Privacy Control and similar signals concern sale, sharing or targeted advertising; we currently do none of those activities. If our practices change, we will honour legally recognised signals and provide the required preference control.

7. Changes and contact

We update the inventory and effective date when storage practices materially change. Cookie questions may be sent to [email protected]. The purchase checkbox is never treated as consent to optional cookies or advertising.