1. Your choice
QR Cigars separates technologies needed to deliver a requested feature from optional analytics. Essential technologies remain active. Cookieless measurement runs for every visitor and stores nothing on your device, as Section 4 explains: the catalog visits QR Cigars counts, and the site and product use Vercel Web Analytics and PostHog measure. Selecting Allow analytics additionally lets PostHog use cookies and local storage and record masked session replays.
Choose Essential only to reject analytics cookies, local storage, and session replay. You can change the choice at any time through Cookie settings in the footer. The preference itself must be stored so the site can remember it. Withdrawing consent does not affect processing already completed lawfully.
3. Local and session storage
- qrc_device: a random browser identifier stored until browser data is cleared. It is created when a person rates a cigar, answers a community questionnaire, or signs up from a catalog page, and is used only to prevent duplicate votes and answers and to connect an answer to a later sign-up from the same browser. It is never used to count visits.
- qrc_vote_* and qrc_vote_ts_*: remember a recent rating and enforce the 12-hour repeat-vote window. They may remain in storage until cleared, but the application treats the vote restriction as expired after 12 hours.
- qrc_comment_* and qrc_contact_*: remember that the visitor completed or dismissed a comment or contact prompt so the same prompt is not repeatedly shown. They remain until browser data is cleared.
- qrc_qnr_*: remember this device's answers and reveal state for a community questionnaire. They may remain in storage until cleared, but the application treats a record older than 12 hours as expired and starts a fresh round.
- qrc_palate_*: remember, per brand, the palate answers this device already gave so later questionnaires only ask what is not yet known. They may remain until browser data is cleared, but the application ignores answers older than 90 days.
- qrc_deal_*: remembers that this browser signed up for a brand offer or giveaway so the prompt is not repeated. It remains until browser data is cleared.
- qrc_source_qr_*: session storage that remembers which printed QR opened the catalog, so a later sign-up, RSVP, or contact request in the same browser session is credited to it. Created only after Allow analytics and removed after successful use or when the browser session ends.
- qrc_pending_event: session storage that holds the name of a product event for up to 15 seconds while a form is saved, so its outcome can be reported after the page reloads. Created only after Allow analytics; otherwise the event waits in page memory.
- ph_* and __ph_opt_in_out_*: PostHog analytics state (a random identifier, the current session, and the record of your Allow analytics choice), kept in cookies, local storage, and session storage for up to one year. Created only after Allow analytics and deleted when you switch to Essential only or clear browser data.
4. Analytics
Catalog visits without cookies. QR Cigars counts visits to public catalog pages, and taps on a brand's contact, website, social, and event links, for every visitor, whatever the choice in Section 1. This measurement reads and writes no cookie, local storage, or other device storage. The page sends only its address, the brand, line, and vitola it shows, the language, the referring page, campaign tags (utm_source, utm_medium, utm_campaign) in the address, and, for a tap, the kind of link and, when it opens one of the brand's listed stores or online sellers, which one. It also reports how the page was used: active time on the page, the furthest scroll depth reached, and interactions such as reading the brand story, viewing photos, sharing, opening Where to Buy or a retailer, switching language, starting a rating, and viewing a deal or event. Activity such as scrolling or touching is only used in the browser to compute active time; no typed text, pointer positions, or addresses beyond the page's own are sent.
On our server, QR Cigars combines the visitor's network (IP) address, the browser's user-agent string, and the brand into a one-way hash, using a secret key that changes every day at midnight UTC. Only the hash is kept, never the IP address or the full user-agent string. Because the key changes daily and the brand is part of the hash, the stored hashes cannot link a browser's visits from one day to the next or across different brands' catalogs. Each record also holds the time, the page, coarse country, region and city, device type, browser, operating system, language, referring domain, and, when the visit follows a printed-QR scan, that code.
The purpose is to give each brand accurate, aggregated counts of how its catalog is used, free of duplicates and automated traffic. QR Cigars relies on legitimate interests for this minimal measurement. Crawlers, link previews, scripts, and browsers signed in to a QR Cigars account are not counted unless the account is a Lounge account: a browser carrying the qrc_consumer marker in Section 2 is counted like any other visitor, and its visit record is built the same way and never contains the account. A repeat view of the same page from the same browser within 30 minutes counts once. Visit and link-tap records are deleted 800 days after they are recorded; daily aggregate counts that contain no visitor identifier are kept for trend history.
Site and product analytics without cookies. For every visitor, whatever the choice in Section 1, Vercel Web Analytics counts page views, and PostHog, hosted in the European Union and reached through the qrcigars.com domain, records page views, time on page, page-load performance, named product events such as a vote, a sign-up, or a published catalog, clicks and form interactions on page elements (never typed values; forms that collect personal details are excluded), repeated or unresponsive clicks, and click and pointer positions for heatmaps. On public pages PostHog keeps the visible text of a clicked element; in the signed-in dashboard it is masked. Neither sets a cookie or keeps anything in local, session, or other device storage for this, and the browser sends no stored identifier. Each provider tells visitors apart only by a one-way hash of the request, computed on its own servers, that cannot link visits on different days: Vercel discards its hash after 24 hours, and PostHog combines the network address, the browser's user agent, and the site with a random key that it replaces every day and then deletes, and removes the network address and full user agent before it stores the event. In this mode PostHog creates no person profile and records no session replay. PostHog receives page addresses without query strings, fragments, or printed-QR codes. QR Cigars relies on legitimate interests for this measurement and uses it only to understand and improve the site and dashboard; neither tool is used for the visit counts brands see.
With Allow analytics. PostHog additionally keeps a random identifier in cookies and local storage (ph_* in Section 3), so visits from the same browser can be connected over time and to a signed-in QR Cigars account, and it can record session replays with every input and all page text masked. Choosing Essential only deletes that state and returns PostHog to measurement without cookies.
A scan of a printed QR is recorded server-side as a core feature whatever the choice in Section 1. The application stores a one-way visitor hash plus coarse request information, not the raw IP address; the scan's visitor hash, city, and region are cleared after 400 days and the record is deleted after 800 days. Infrastructure providers necessarily process network requests under their own security and retention practices.
5. Browser and device controls
You can delete or block cookies and site storage through browser settings. Blocking essential technologies can prevent sign-in, age confirmation, billing, rating controls, or saved preferences from working. Settings are usually specific to each browser and device.
QR Cigars does not sell personal information or share it for cross-context behavioral advertising. If a browser sends a legally recognized opt-out signal such as Global Privacy Control, our no-sale and no-sharing practice already applies.
6. Changes and contact
We will update this Notice when technologies, providers, or durations materially change. Questions can be sent to hello@qrcigars.com.