In short
- thugqr.com sets no cookies unless you allow statistics or advertising. The generator saves your design only in your browser’s local storage.
- If you sign in, api.thugqr.com sets two sign-in cookies, strictly necessary to keep you signed in. They are deleted when you sign out.
- If you open a locked QR code with the right password, go.thugqr.com sets one 12-hour cookie so you need not type the password again. Plain scans set nothing.
- Google Analytics and TikTok Pixel cookies are set only if you allow them in the banner or in “Cookie settings” at the bottom of every page, where you can change your mind at any time. ThugQR itself shows no ads.
What cookies and local storage are
Cookies are small text files that a website stores in your browser and that the browser sends back with every later request to the same site. They are legitimately used to keep you signed in, but often also to follow you from site to site. Local storage is a similar browser space with one important difference: its content is never sent anywhere automatically. It stays on your device and is read only by the page’s own code.
The law (Article 5(3) of the ePrivacy Directive 2002/58/EC, in Greece Article 4(5) of law 3471/2006) requires consent for any storing or reading of information on your device, unless it is strictly necessary for a service you explicitly requested. Everything ThugQR uses falls under that exemption, except Google Analytics and the TikTok Pixel: that is why you see a banner, and those cookies are set only if you accept them.
thugqr.com: local storage
Without your consent, the website and the generator set no cookies. They use your browser’s local storage for the following:
| Name | What it does | Duration |
|---|---|---|
thugqr:v1 | Your current QR code design and content, with the logo you uploaded if it fits, and the QR dashboard defaults | Until you reset or clear the site’s data |
thugqr:tab | The design tab you last opened | Until you clear the site’s data |
thugqr:theme | Light or dark theme | Until you clear the site’s data |
thugqr:lang | The language you chose | Until you clear the site’s data |
thugqr.user | Name, email and plan of the signed-in account, so that the account button appears at once | Until you sign out |
thugqr:editing | Which saved QR code you are editing, so that “Save” updates it (session storage) | Until you close the tab |
thugqr:consent | Your answer in the cookie banner (accept or reject) and when you gave it, so that we do not ask on every page | 12 months, then we ask again |
None of this is sent to us. All of it is strictly necessary for functions you use yourself (the generator remembering your work, your language and theme, or the page knowing you are signed in).
thugqr.com: Google Analytics, only with your consent
If you press “Accept” in the banner, thugqr.com loads Google Analytics 4, which sets the following cookies. They belong to thugqr.com, but what they measure goes to Google. If you press “Reject” or do nothing, none of them is set and nothing is loaded from Google.
| Name | What it does | Duration |
|---|---|---|
_ga | A random identifier that tells one browser from another, so that visits are not counted twice | 13 months |
_ga_Q61ZHNSCD8 | Keeps the state of the current visit (session) for Google Analytics | 13 months |
We have switched off Google signals and ad personalisation. What is measured and how long it is kept is explained in the Privacy Policy. If you withdraw your consent from “Cookie settings”, both cookies are deleted at once.
thugqr.com: TikTok Pixel, only with your consent
If you allow advertising cookies (or press “Accept” in the banner), thugqr.com loads the TikTok Pixel, which sets the following cookies. They belong to thugqr.com, but what they measure goes to TikTok. If you do not allow them, none is set and nothing is loaded from TikTok.
| Name | What it does | Duration |
|---|---|---|
_ttp | An identifier that lets TikTok recognise this browser and measure visits from TikTok ads | Up to 13 months |
_tt_enable_cookie | Records that TikTok cookies may be used on this site | Up to 13 months |
ttcsid, ttcsid_<id> | Keep the state of the current visit for the TikTok Pixel | Up to 13 months |
What TikTok receives and how it uses it is explained in the Privacy Policy. If you withdraw your consent from “Cookie settings”, these cookies are deleted at once.
api.thugqr.com: the sign-in cookies
When you sign in to your account, the accounts service (api.thugqr.com) sets two cookies. They belong to api.thugqr.com only, are never sent to any other website, cannot be read by code (HttpOnly), travel only encrypted (Secure) and only with requests that originate from ThugQR (SameSite=Strict):
| Name | What it does | Duration |
|---|---|---|
__Host-thugqr_at | The access token: proves to the service that it is you, on every request | 15 minutes, renewed automatically while you use the service |
__Secure-thugqr_rt | The refresh token: issues a new access token without signing in again. Sent only to the refresh address | 14 days from last use, 90 days at most |
Both are deleted when you press “Sign out” (or “Sign out of all devices”), when you change your password from another device, or when they expire. They are strictly necessary for the account service you requested, so they need no consent. If you never sign in, they are never set.
go.thugqr.com: the locked QR cookie
Scanning a dynamic QR code sets no cookie and reads nothing from your device; scans are counted without identifiers, as the Privacy Policy explains. There is one exception: when you open a QR code that its owner has locked with a password, and you enter the right password.
| Name | What it does | Duration |
|---|---|---|
qru_<number> | Remembers that you entered the right password for that specific QR code, so you need not type it again. Contains only an expiry date and a digital signature, not the password | 12 hours |
qrs_<number> | After you open a giveaway QR code, it remembers that this device has already seen the result, so that you can see it again when the organizer reveals it only once. It contains a signed timestamp, nothing about you | 30 days |
thugqr_report | Carries the QR code’s link from the go.thugqr.com page to the abuse report form. The form reads it and deletes it at once | Up to 10 minutes |
The cookie belongs to go.thugqr.com only, is HttpOnly and Secure, and is not used for statistics or any other purpose. If the owner changes the password, the cookie stops working.
What we do not use
Apart from Google Analytics and the TikTok Pixel, both only with your consent, there are no cookies or technologies for analytics or advertising, social networks (“like” buttons, embeds), fingerprinting or third-party cookies of any kind, on any of our three subdomains. Fonts and libraries are hosted on our own server. The only other external load, the ZIP library from Cloudflare’s cdnjs when you download many QR codes together, sets no cookies.
How you control them
Press Cookie settings at the bottom of any page to allow or refuse statistics and advertising again; whatever you refuse, its cookies are deleted at once. Press Reset in the generator to erase your design and content. Press Sign out to delete the sign-in cookies and the account details from your device. To delete everything, clear the data of thugqr.com, api.thugqr.com and go.thugqr.com in your browser settings (usually under Privacy or Site settings). You can also set your browser to refuse cookies; the generator will then still work, but you will not be able to sign in to your account or open locked QR codes.
Other websites
The QR codes you make or scan lead to other websites. Those may use their own cookies, as described in their own policies, which we do not control. When we redirect you, we do not reveal to the destination where you came from.
Changes
If we ever add a cookie or similar technology that is not strictly necessary, we will update this page first and ask for your consent before using it.
