Cookie policy · QrRota

1.What are cookies?

Cookies are small text files that are saved to your device through your browser when you visit a website. They allow the site to recognize you across pages and visits, remember your preferences and operate securely. Technologies such as the browser’s local storage (localStorage) are also used for similar purposes; in this policy, the term “cookie” also covers these technologies.

Depending on who places them, cookies are classified as first-party (the site you are visiting) or third-party (another service provider) cookies; depending on how long they are kept, they are classified as session cookies, which are deleted when you close the browser, or persistent cookies, which remain on the device for a set period. By purpose, they are divided into strictly necessary, functional, analytics and marketing cookies. QrRota uses only first-party, strictly necessary and functional cookies.

This Cookie policy explains the cookies used on the qrrota.com website, the user dashboard and the short link redirect service operated by QrRota Yazılım ve Teknoloji A.Ş..

2.Our approach

We use only the cookies necessary for the site and dashboard to work, to keep your session secure and to remember the language and interface preferences you choose.
We do not use advertising, retargeting or social media tracking cookies.
We do not run third-party analytics or visitor tracking tools on our site.
We do not use cookies to track you across different sites or to build a profile about you.

For this reason, we do not display a cookie consent banner on our site: the cookies we use are necessary to provide the service you request and do not require your explicit consent.

3.Cookies we use

Name	Purpose	Duration	Type
better-auth.session_token	Confirms that you are signed in and protects your account from unauthorized access.	30 days (renewed with use); until you close the browser if you don’t choose “Remember me”	Strictly necessary · first-party cookie
better-auth.dont_remember	Makes a session you opened without “Remember me” end when you close the browser.	Until you close the browser	Strictly necessary · first-party cookie
better-auth.state	Verifies that the request came from you during “Sign in with Google” or “Sign in with Apple” (CSRF protection).	5 minutes	Strictly necessary · first-party cookie
better-auth.two_factor	If two-step verification is on, recognizes your sign-in until you enter the verification code.	10 minutes	Strictly necessary · first-party cookie
better-auth.trust_device	If you tick “Trust this device for 30 days” when entering the code, you aren’t asked for a code again on this device for 30 days.	30 days	Strictly necessary (your choice) · first-party cookie
better-auth-passkey	Matches the verification request when you add a passkey or sign in with one.	5 minutes	Strictly necessary · first-party cookie
better-auth.last_used_login_method	Marks the sign-in method you used last as “Last used” on the sign-in page.	30 days	Functional (interface preference) · first-party cookie
sidebar_state	Remembers whether you keep the dashboard sidebar open or closed.	7 days	Functional (interface preference) · first-party cookie
QRROTA_LOCALE	Remembers the language version you are viewing (Turkish or English) so the dashboard and server responses use the same language.	400 days	Functional (language preference) · first-party cookie
QRROTA_UI	Remembers the guide and information cards you closed in the dashboard (for example the getting-started checklist).	1 year	Functional (interface preference) · first-party cookie
qrrota-theme	Stores your light, dark or system theme preference; it is never sent to the server.	Until you delete it	Functional (interface preference) · local storage
qrrota:… (dashboard preferences)	Remembers in this browser the colors you used last, your table column choices, whether the rule simulator stays open, when suggestion cards were shown, whether you have downloaded a QR code (for the getting-started checklist) and that you have seen the language suggestion; never sent to the server.	Until you delete it	Functional (interface preference) · local storage
qrrota:verify-…	Remembers in this tab that you closed the email verification reminder and when the verification email was sent.	Until you close the tab	Functional (interface preference) · session storage

Session and sign-in cookies cannot be read by scripts in the browser (HttpOnly) and, in production, are sent only over HTTPS connections; for this reason, their names may carry the “__Secure-” prefix. The names in the table may change with infrastructure updates, in which case we will update the table. The language preference cookie is set automatically based on the language version you visit; other interface preference records are created only by what you do in the dashboard or on the sign-in page. Apart from the ID of the workspace concerned, these records contain no information that identifies you.

4.No cookies on QR code scans

When you scan a QrRota QR code, our short link redirect service and the pages we host (business card, text, Wi-Fi and location pages) place no cookies on your device and write nothing to local storage. The visitor identifier needed to count unique scans and to route consistently in A/B tests is not a value stored on your device; it is generated on the fly on the server side by hashing the IP address and browser information with a secret key using the HMAC method; scan data never contains your raw IP address. The connection records Law No. 5651 requires are kept on our servers, encrypted, not on your device (see the Privacy policy).

The destination site you are redirected to belongs to the QR code owner or a third party and may use its own cookies; those cookies are subject to that site’s cookie policy. For detailed information about scan data, please see our KVKK Privacy Notice.

5.Third-party services

We do not use third-party cookies for advertising or tracking on our site. However, in the following cases you may interact with components of third-party services or be redirected to them:

Cloudflare Turnstile: on the sign-up, sign-in link, password reset and abuse report forms, Cloudflare’s Turnstile component is loaded to tell automated software (bots) apart. During this check Cloudflare processes your IP address and technical signals about your browser under its own policies.
Sign in with Google and Sign in with Apple: when you use one of these options, you are redirected to Google’s or Apple’s sign-in page. These providers use cookies on their own domains, subject to their own cookie policies.
iyzico payment form: At the payment step, iyzico may use its own cookies or similar technologies for payment security and fraud prevention. These cookies are subject to iyzico’s policies.

6.Legal basis

The limited data processed through the cookies we use is processed on the legal grounds of the performance of the contract we have concluded with you, under Article 5(2)(c) of Law No. 6698 on the Protection of Personal Data (“KVKK”), and our legitimate interest in keeping the service secure, under Article 5(2)(f). As also stated in the Personal Data Protection Authority’s Guide on Cookie Practices, explicit consent is not required for strictly necessary cookies.

If we decide in the future to use a cookie that is not strictly necessary (for example, an analytics or marketing cookie), we will enable such cookies only after obtaining your explicit consent, and we will update this policy in advance.

7.How can you manage cookies?

You can view, delete or block cookies and site data in your browser settings. Menu names may vary depending on the browser version:

Google Chrome: Settings → Privacy and security → Third-party cookies / Site data
Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
Safari (macOS): Settings → Privacy → Manage Website Data
Safari (iOS): Settings → Safari → Advanced → Website Data
Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data

If you block strictly necessary cookies, you will not be able to sign in to the dashboard or stay signed in. Clearing site data also deletes local records such as your theme preference; in that case, the theme reverts to your device’s system setting. When you sign out of the dashboard, your session cookies are invalidated.

8.Changes and contact

We update this policy when the technologies we use or the legislation change; the current version is always published on this page. For general information on how your personal data is processed, please see our KVKK Privacy Notice and Privacy Policy. If you have any questions about cookies, you can write to us at destek@qrrota.com.

This English version is provided for convenience only; in the event of any conflict or inconsistency between this version and the Turkish version, the Turkish version prevails.