Cookie Policy
In short
- We only use what is strictly necessary to run the Service: keeping you signed in, security, and remembering your choices.
- On our public website only, we use Google Analytics to measure visits, and only if you accept analytics cookies. We use no advertising cookies.
- Scanning a Trackero QR code or opening a short link places nothing on the device, also on customers' own (custom) domains.
- Your browser's Global Privacy Control signal is respected automatically.
This summary is for convenience only. The full text below is what applies.
This Cookie Policy explains how Mihail Hummel ("Trackero", "we") uses cookies and similar technologies, such as browser local storage, on https://trackero.co, https://app.trackero.co, public client dashboards, our redirect domain shoort.link and customers' custom domains connected to it. It complements our Privacy Policy.
1. What cookies and similar technologies are
Cookies are small text files that a website stores on your device. Similar technologies include browser local storage, session storage and scripts that read information from your device. Under the EU ePrivacy Directive (as implemented in each country, for example section 25 TDDDG in Germany) and the UK PECR, storing or reading information on your device requires your consent, unless it is strictly necessary to provide a service you have explicitly requested. We follow that rule for every technology described here.
2. Strictly necessary technologies (no consent required)
These are needed for the Service to work and cannot be switched off in our settings.
| Name | Type and provider | Purpose | Duration |
|---|---|---|---|
sb-<project>-auth-token | Local storage, first party (Supabase authentication) | Keeps you signed in to the app and refreshes your session securely. | Until you sign out or the session expires |
sb-<project>-auth-token-code-verifier | Local storage, first party | Temporary security value used while you sign in with Google. | Removed after sign-in completes |
trackero_cookie_consent | Local storage, first party | Remembers your cookie choices so we do not ask again on every visit. | 12 months, then we ask again |
theme | Local storage, first party | Remembers whether you chose light or dark mode in the app. | Until you clear it |
| Cloudflare Turnstile | Third party (Cloudflare, Inc.), loaded on sign-up, sign-in and some forms | Distinguishes humans from bots to protect accounts and forms against abuse. Turnstile evaluates technical browser signals; Cloudflare states that it does not use them for advertising. | Duration of the check |
__cf_bm | Cookie, Cloudflare, Inc., may be set on our domains and on custom domains | Bot management and protection against attacks. | 30 minutes |
3. Optional technologies (consent required)
These are only set or loaded after you have given your consent in our cookie banner, and you can withdraw it at any time (see Section 7). We do not use advertising, social media or other marketing cookies or trackers. The banner nevertheless lets you record your preference for the Marketing category; if we introduce such technologies in the future, we will list them here first and activate them only after you have given your consent.
Analytics: Google Analytics 4
On our public marketing website (https://trackero.co, including this policy and our other legal pages) we use Google Analytics 4, provided by Google Ireland Limited (EEA/UK/Switzerland) or Google LLC (elsewhere), to count visits and understand which pages and sources bring visitors, so we can improve the website. We do not use it inside the app (https://app.trackero.co), in the dashboard, on public client dashboards, or on sign-in and password-reset pages, and we do not enable Google signals or ad personalisation. Google Analytics receives your IP address (which Google Analytics 4 does not store in logs or use to identify you), the page you view, referrer, approximate location, device and browser information, and a pseudonymous identifier stored in the cookies below. Google may transfer this data to the USA under the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.
| Name | Type and provider | Purpose | Duration |
|---|---|---|---|
_ga | Cookie, first party set by Google Analytics | Distinguishes visitors so that we can count unique visitors. | 2 years |
_ga_<container-id> | Cookie, first party set by Google Analytics | Keeps session state so that visits and page views can be counted. | 2 years |
- Marketing: would help us measure and personalise our marketing. Not currently used.
4. People who scan QR codes or open short links
Our redirect service (shoort.link, and custom domains that customers connect to it) does not set cookies or store anything on the device of the person scanning a QR code or opening a short link. Only Cloudflare's strictly necessary security cookie __cf_bm (Section 2) may be set where Cloudflare suspects automated traffic. To count unique visitors without cookies, we use a one-way, salted hash of the IP address and browser user agent that is specific to each individual code or link. The IP address itself is not stored. See the Privacy Policy for details.
Earlier versions of the redirect service set a cookie called qr_device_id, link_device_id or sqr_device_id. These cookies are no longer read or renewed and expire on their own. You can also delete them in your browser settings at any time.
5. Third-party websites
- Payments: when you pay, you are taken to a checkout page hosted by Stripe on its own domain. Stripe uses its own cookies there for payment processing and fraud prevention. See Stripe's cookie policy.
- Sign in with Google: if you choose it, you are taken to Google, which uses its own cookies. See Google's cookie policy.
- Destination websites: the websites that QR codes and short links lead to are operated by our customers or other third parties, and their own cookie policies apply.
- Preset logos: if you choose one of the preset social media logos in the QR designer, the logo image is loaded from Wikimedia Commons (upload.wikimedia.org), which receives your IP address as part of that request.
- Custom domain setup: when you look up a domain or check its DNS records on the Custom domains page, your browser contacts Google Public DNS (dns.google) and Cloudflare DNS (cloudflare-dns.com), and loads the domain's icon from DuckDuckGo (icons.duckduckgo.com) or from the domain itself. These services receive your IP address as part of the request. Nothing is stored on your device. See the Privacy Policy.
Apart from Google Analytics on our public website (Section 3, only with your consent), we do not embed third-party fonts, maps, analytics or advertising scripts. Fonts and map data are served from our own servers.
6. Global Privacy Control and Do Not Track
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of all optional cookies and as an opt-out of any "sale" or "sharing" of personal information within the meaning of US state privacy laws, and we do not show you the cookie banner. A choice you later make yourself in our cookie settings takes precedence. We do not sell or share personal information in any case. Because no industry standard has been agreed for "Do Not Track" (DNT), we do not respond to DNT signals differently. We do not track you across third-party websites in any case.
7. Managing your choices
You can change or withdraw your consent at any time with the button below or the "Cookie settings" link in the footer. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. You can also delete or block cookies and local storage in your browser settings. If you block strictly necessary technologies, signing in and some features will not work.
8. Changes
We update this policy when the technologies we use change. If we add technologies that need your consent, we will ask for it again before using them.
9. Contact
Questions about cookies: privacy@trackero.co.