Cookie Policy
Last updated: 2026-06-14
Summary (Key Facts)
• The Company uses no cookies on pages for dynamic QR codes (impressions) • A third-party cookie from Auth0 is used for secure login (strictly necessary) • A functional cookie (sidebar:state) is used to save the user's UI preferences • We use Matomo (Matomo Cloud) for privacy-friendly web analytics on our public website — loaded only after you consent, and never on QR-code (impression) pages • We also use browser localStorage and sessionStorage to remember preferences (language, theme) and to keep you signed in — these values stay on your device and are not used for cross-site tracking • We do not use Google Analytics, Facebook Pixel, LinkedIn Insight Tag, or any advertising cookies • You can enable or withdraw analytics consent at any time via "Manage cookies" in the footer
This summary is intended to provide an overview. Full information is set out in the sections below.
1. Introduction
This cookie policy ("Cookie Policy") describes how Paperphyte AB ("the Company", "we", "us") uses cookies and similar technologies in connection with the provision of the Company's services and websites. The Cookie Policy should be read together with the Company's privacy policy. To the extent that personal data is processed via cookies or similar technologies, the provisions of the privacy policy also apply.
2. What are cookies?
Cookies are small text files that are stored on your device (e.g. computer, mobile or tablet) when you visit a website. Cookies are typically used to make websites function efficiently and to provide information to the website owner.
3. Use of cookies and similar technologies
The Company uses cookies and similar technologies for the purpose of: • Ensuring basic functionality of the service • Improving the user experience • Enabling secure authentication • Performing analysis and statistics (to the extent such technologies are used)
4.1 Impressions and dynamic QR codes
When visiting pages linked to dynamic QR codes ("impressions"), the Company does not use cookies, whether first-party or third-party cookies. No information is stored in the visitor's browser in the form of cookies in this context. However, certain technical information may be processed without the use of cookies, such as IP address and geographic information (country, and city/region for paid plans), in accordance with the privacy policy.
4.2 Authentication (Auth0)
The Company uses the third-party service Auth0 for authentication. Upon login, a session cookie is placed by Auth0 on the domain login.qrgeno.com. This cookie: • Is a third-party cookie (belonging to Auth0) • Is set and managed exclusively by Auth0 • Is strictly necessary to enable secure authentication via the OAuth flow • Is used to maintain the user's logged-in session • Is not accessible to or controlled by the Company Legal basis: Processing is necessary for the performance of a contract (Article 6.1(b) GDPR) and falls within the exemption for strictly necessary cookies under applicable ePrivacy regulation, meaning consent is not required. Storage period: Session-based in accordance with Auth0's configuration and policies.
4.3 Functional cookies
The Company uses a functional cookie inside the signed-in dashboard to improve the user experience: Name: sidebar:state Purpose: Stores the user's sidebar menu setting (open/closed) between page loads Storage period: 7 days (604,800 seconds) Legal basis: Legitimate interest (improved user experience) This cookie is not necessary for the core functionality of the service but is considered to have a low privacy impact. It is only set after sign-in and never on public-facing pages.
4.4 Similar technologies (localStorage and sessionStorage)
In addition to cookies, our web app uses your browser's localStorage and sessionStorage to remember your preferences and to keep you signed in. None of these values are sent to advertisers or used for cross-site tracking. Everything is stored only on your device and can be cleared at any time from your browser settings. localStorage: • language — your selected interface language ('sv' or 'en') • theme — your selected light or dark mode • qrgeno_auth — a true/false flag remembering that you are signed in (so we can render the right call-to-action without flashing an unauthenticated UI) • rq-cache — a cached copy of recent API responses (e.g. your QR code list) so the dashboard loads faster • qr-list-view — your preferred dashboard layout (cards or list) • bulk.lastExport — the timestamp of your most recent CSV export from Bulk import/export, so the import screen can show when you last exported your QR codes • Auth0 token cache — the Auth0 SDK stores its access tokens here when configured to do so; this enables silent token refresh without re-prompting you to sign in sessionStorage: • auth_return_to — the page you were on when redirected to log in, so we can take you back after sign-in (cleared automatically when the browser tab closes) • visited — a single flag set on the public marketing site so that, on subsequent page reloads in the same tab, we skip the first-load entrance animations Legal basis: strictly necessary for the operation of the signed-in service (Article 6.1(b) GDPR), or based on legitimate interest for low-impact UI preferences such as language and theme.
5. Third-party services, cookies and external resources
The Company uses privacy-friendly web analytics but does not use Google Analytics and does not use any advertising or marketing cookies (such as Facebook Pixel or LinkedIn Insight Tag). The only strictly necessary third-party cookie set in connection with our services is the authentication cookie described in section 4.2. Analytics (Matomo): The Company uses Matomo (Matomo Cloud), operated by InnoCraft Ltd (New Zealand), for web analytics on its public website (qrgeno.com and its subdomains). Matomo is not used inside the signed-in dashboard and is never loaded on the pages linked to dynamic QR codes (impressions). It helps us understand how the public site is used — pages viewed, referrer, approximate location derived from the IP address, and device/browser type — with IP addresses anonymised. Matomo is loaded only after you have given consent. If you accept analytics cookies, the following first-party cookies are set on the qrgeno.com domain: • _pk_id.* — distinguishes visitors; storage period 13 months • _pk_ses.* — identifies the current visit; storage period 30 minutes • mtm_consent / mtm_consent_removed — records your analytics-consent choice so we do not ask you again Legal basis: your consent (Article 6.1(a) GDPR). You can withdraw or renew your consent at any time via the "Manage cookies" control in the website footer; if you decline, Matomo is not loaded and none of the cookies above are set. New Zealand is covered by a European Commission adequacy decision, so the transfer of personal data to InnoCraft Ltd is permitted. Our public website (qrgeno.com and its subdomains) is served from Vercel Inc.'s global edge network. Vercel may set a small number of strictly necessary first-party cookies on the qrgeno.com domain for routing, security, and DDoS protection (for example load-balancer and bot-mitigation cookies). These cookies are operational and are not used by Vercel for advertising or cross-site tracking. Your IP address is processed by Vercel for the purpose of delivering the requested page. Our public website loads typography from Google Fonts (fonts.googleapis.com / fonts.gstatic.com), operated by Google LLC (United States), and images from Sanity's CDN (cdn.sanity.io). These requests transmit your IP address and User-Agent to the respective provider when their resource is loaded but do not set cookies on your device. Google LLC is listed as a sub-processor in our Privacy Policy. When you complete a payment, you are redirected to Mollie's checkout. Cookies set during the Mollie session are governed by Mollie's own cookie policy.
6. Consent and cookie management
You can enable or withdraw your consent for analytics cookies at any time using the "Manage cookies" control in the website footer. Where cookies are not strictly necessary for the operation of the service, the Company will obtain your consent before placing such cookies on your device. You may at any time: • Change or withdraw your consent • Delete cookies and clear local/sessionStorage via your browser settings • Block cookies in full or in part Please note that restricting cookies or clearing local storage may affect the functionality of the service — in particular, you may be signed out of the dashboard and lose your saved preferences.
7. Storage period
Cookies are only stored for the period stated above or for as long as is necessary for the respective purpose. localStorage values persist until you clear your browser data; sessionStorage values are cleared automatically when you close the browser tab.
8. Updates to this cookie policy
The Company reserves the right to update this Cookie Policy at any time. In the event of material changes, information will be provided in an appropriate manner.
9. Contact
For questions about this Cookie Policy or our use of cookies, please contact Paperphyte AB.