What Are Cookies
Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies (localStorage, sessionStorage) to operate the Qrew platform and improve your experience.
Cookies We Use
Strictly Necessary (No Consent Required)
| Name | Purpose | Duration |
|---|---|---|
session_token | Session authentication on app.qrew.it (HttpOnly, Secure, SameSite=Lax in production) | Persistent (per session duration) |
Cookie: NEXT_LOCALE | Language preference on the qrew.it marketing site (set by next-intl; SameSite=Lax) | Up to 12 months |
localStorage: i18nextLng | PWA (app.qrew.it) language preference | Persistent until cleared |
localStorage: qrew_theme | UI theme preference | Persistent until cleared |
Security & Delivery (Cloudflare — No Consent Required)
Cloudflare sits in front of qrew.it, app.qrew.it and api.qrew.it as our CDN and reverse proxy. Its bot-management and rate-limiting features may, when they are triggered, set the following cookies on your domain. They are strictly necessary for the security and delivery of the service, so no consent banner is shown for them.
| Name | Purpose | Duration |
|---|---|---|
__cf_bm | Distinguishes trusted traffic from automated bots and applies rate limiting | About 30 minutes |
cf_clearance | Only set when you pass a Cloudflare security check (e.g. a challenge or captcha) | About 30 minutes |
Functional (Consent Required)
| Name | Purpose | Duration |
|---|---|---|
localStorage: qrew_device_id | Device identifier for anti-spoofing / device-trust scoring | Persistent until cleared |
| Service Worker: push subscription | Web Push notification subscription | Until revoked |
| WebAuthn credentials (server-side) | Passkey credential IDs for passwordless login | Until removed in Settings |
Third-Party Cookies
We do not use third-party advertising or tracking cookies, and we run no client-side analytics that stores cookies in your browser. Website traffic is measured on our own server with AWStats, which analyses web-server access logs (not cookies) to produce aggregate, non-identifiable statistics and therefore sets nothing on your device. Cloudflare may set the strictly-necessary security cookies listed above, and Stripe may set cookies during the payment checkout flow — see Stripe's privacy policy.
Managing Cookies
You can control cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in or using the platform.
- Chrome: Settings → Privacy and Security → Cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Cookies and Website Data
Consent
We deliberately keep our cookie footprint minimal. The cookies above are strictly necessary to operate, secure and deliver the platform or to remember your language and theme, so they do not require opt-in consent and we do not display a cookie banner. Features that do rely on your consent — such as Web Push notifications and optional photo verification in the app — are requested separately at the moment you use them, as described in our Privacy Policy. AWStats traffic measurement runs server-side from access logs and sets no cookies. You can still delete or block cookies in your browser at any time, though this may affect your ability to log in and your saved preferences.
Updates
We may update this Cookie Policy. Changes will be posted on this page with an updated revision date.