COOKIE POLICY
Operator: Wootera Digital Technologies, s.r.o., Company ID: 19160526, registered office: Oldřichova 255/20, Nusle, 128 00 Prague 2 | cleanqr@wootera.com
3.1 What are cookies and browser storage?
Cookies are small files stored by a website in a browser. CleanQR also uses localStorage and sessionStorage, which store information in the browser without creating a cookie. This Policy describes all of these technologies across the public website, administration, housekeeping view, and guest form.
3.2 Public website cleanqr.app
| Name | Type / provider | Purpose | Duration | Consent |
|---|---|---|---|---|
cookie-consent | localStorage / cleanQR | Stores the selected consent settings | Until deleted by the browser or user | No — necessary |
_ga | Cookie on .cleanqr.app / Google Analytics 4 | Distinguishes a visitor for traffic statistics | Up to 2 years | Yes |
_ga_1Q3JNLBKC3 | Cookie on .cleanqr.app / Google Analytics 4 | Maintains session state for traffic statistics | Up to 2 years | Yes |
No third-party script is loaded and no analytical cookie is set before consent. Choosing “Reject all” removes analytical cookies. Fonts and all other website resources are served from cleanqr.app. CSRF protection does not use a cookie; it is based on checking the Origin header.
Google Analytics is activated only on the public marketing website after consent. You can withdraw consent at any time through “Cookie settings” in the footer. Google may process information about the browser, device, IP address, and use of the website. Further details: Google Privacy Policy.
3.3 Administration at admin.cleanqr.app
| Name | Type | Purpose | Duration | Consent |
|---|---|---|---|---|
adminSessionId | API cookie; HttpOnly, Secure, SameSite=None | Authenticated session | Without “Remember me”, the cookie expires when the browser is closed; with this option, it remains for 365 days. The server session lasts 30 days or 1 year respectively and is invalidated when the password changes. | No — necessary |
_GRECAPTCHA | Third-party cookie (google.com) | Protects sign-in, registration, and password reset through Google reCAPTCHA v3 | 6 months | No — necessary for security |
cleanqr-lang | localStorage | Selected interface language | Persistent, until deleted | No |
cleanqr-guestinfo-nudge-dismissed | localStorage | Records dismissal of the room information board prompt | Persistent, until deleted | No |
cleanqr:onboarding-just-completed | sessionStorage | Displays the welcome message once after setup | Until the tab is closed | No |
Google reCAPTCHA processes the IP address and interaction data on sign-in-related pages for security purposes. The adminSessionId cookie is deleted when the user signs out.
The administration does not load a Stripe script. For payment and subscription management, the user is redirected to Stripe Checkout or the Stripe customer portal, where Stripe's own cookie policy applies.
3.4 Housekeeping view
| Name | Type | Purpose | Duration |
|---|---|---|---|
housekeepingPinAuth | API cookie; HttpOnly, Secure, SameSite=Lax | Remembers PIN verification through a signed record containing the hotel, link version, and expiry | 30 days; invalidated when the link is regenerated or the PIN changes |
cleanqr:hk-pin:<link> | sessionStorage | Equivalent verification for browsers that do not send the cookie between domains | Until the tab is closed |
These records are stored only for hotels that have enabled a PIN. Without a PIN, the link stores nothing. The link displays the daily list of rooms and choices — room numbers, cleaning type, and time — but no guest details.
3.5 Guest form after scanning a room QR code
| Name | Type | Purpose | Duration |
|---|---|---|---|
cleanqr_device | API cookie; HttpOnly, Secure, SameSite=None | A random 64-character device identifier that ties the daily cleaning choice to the phone that submitted it and helps prevent misuse of a photographed code | 180 days |
The cookie is set when the form is first opened, even when the hotel has not enabled device locking. The cookie contains no guest identity; only its SHA-256 hash is stored in the database. The form stores nothing else in the browser, loads no third-party service, and communicates only with the cleanQR API. No third-party tracking, advertising, or analytics tools are loaded after scanning a QR code.
3.6 Managing storage
You can change analytical consent through “Cookie settings” in the cleanqr.app footer. Browser settings can also delete or block cookies and local storage. Blocking necessary storage may prevent sign-in, PIN verification, language preferences, or guest-form security from working correctly.
3.7 Contact
For questions regarding cookies and browser storage, contact cleanqr@wootera.com.
This Cookie Policy takes effect on 1 April 2026.