Cookie Policy
iziqrcode uses a minimal number of cookies. Technical and functional cookies (session, CSRF, language) are strictly necessary and set without consent, under the functional exemption of Article 5.3 of the ePrivacy Directive 2002/58/EC. In addition, we use an audience-measurement tool (Google Analytics 4) and an advertising-measurement tool (Google Ads), loaded only after your explicit consent via the banner — refusable in one click. No ad targeting, no data resale, and audience measurement is never active on the public pages of your menus (`/p/*`).
1Essential cookies (no consent required)
These cookies are strictly necessary for Service operation:
| Cookie | Purpose | Duration |
|---|---|---|
| `__Secure-authjs.session-token` | Session maintenance (encrypted JWT) | 30 days |
| `__Host-authjs.csrf-token` | CSRF protection during authentication | Session |
| `authjs.callback-url` | Post-login redirect URL | Session |
| `i18n_locale` | Preferred language on the marketing surface (home, pricing, etc.) | 1 year |
| `app_locale` | Preferred language inside the signed-in dashboard (/app) | 1 year |
| `iziqr-consent` | Stores your choice (accepted / refused) on the cookie banner | 6 months |
In local development (HTTP), the NextAuth session cookies drop the `__Secure-` / `__Host-` prefix; functional behaviour is identical.
2Audience-measurement cookies (with consent)
To understand how our site is used and to improve it, we use Google Analytics 4 (provided by Google Ireland Ltd).
Legal basis: your consent (Art. 6.1.a GDPR, Art. 5.3 ePrivacy Directive). No audience-measurement cookie is set until you accept the banner; a refusal takes effect immediately and no Google script is loaded.
Guarantees applied:
- Prior explicit consent (Consent Mode v2: `analytics_storage` denied by default);
- IP address anonymization (`anonymize_ip`);
- Advertising measurement kept separate: `ad_storage`, `ad_user_data` and `ad_personalization` are granted only under the same consent, and serve solely the measurement described in the next section;
- Never on the public pages of your menus (`/p/*`): scans of your QR codes stay entirely free of audience measurement;
- Withdrawable at any time (see "Manage your preferences" below).
| Cookie | Purpose | Duration |
|---|---|---|
| `_ga` | Distinguish visitors (anonymous identifier) | 2 years |
| `_ga_<ID>` | Persist the Google Analytics 4 session state | 2 years |
If you refuse, none of these cookies are created.
3Advertising-measurement cookies (with consent)
We buy advertising on Google Ads (provided by Google Ireland Ltd) and we measure what it returns. Knowing which ads actually bring sign-ups is the only way not to pay for nothing.
Legal basis: your consent (GDPR art. 6(1)(a), ePrivacy Directive art. 5(3)).
This measurement rides on the same tag as the audience measurement above: no extra script is loaded, no other domain is contacted. An event is sent only at the moment an account is created.
| Cookie | Purpose | Duration |
|---|---|---|
| `_gcl_au` | Link a sign-up to the ad click that preceded it | 90 days |
What is not done: none of the data you type is sent to Google — neither your email address nor a hash of it. Google's "enhanced conversions" feature is disabled on our account.
Withdrawing your consent stops this measurement immediately and deletes the cookie, without reloading the page. See "Manage your preferences" below.
4Referral cookies (with consent)
Some links shared by our referral partners carry an identifier (`?ref=`). It lets an account created afterwards be attributed to the person who introduced the Service.
Legal basis: your consent (GDPR art. 6.1.a, ePrivacy Directive art. 5.3). This cookie is only set if you accepted the banner. If you refuse, no cookie is stored and no attribution takes place.
What it contains, and nothing else:
- The referral partner's identifier, an 8-character random string that identifies neither a person nor an account;
- No audience measurement: it is read by no analytics tool and sent to no third party;
- No cross-referencing: it is combined with no other data — not your browsing, not your IP address, not the pages you visit;
- Never read after sign-up: once the account exists, it serves no further purpose;
- Never on your public menu pages (`/p/*`), as with audience measurement.
| Cookie | Purpose | Duration |
|---|---|---|
| `iziqr-apport` | Carry the referral partner's identifier until the account is created | 30 days |
Why thirty days. Beyond that, the link between the visit and the sign-up becomes a supposition rather than a fact. This duration will be reviewed once we measure the actual delay between opening a link and creating an account.
If you refuse, this cookie is not created. The referral partner only sees that their link was opened — a count that stores nothing on your device and does not identify you — without ever knowing whether an account was created.