Cookies and browser storage

Last updated: 17 September 2026

This site has no advertising, tracking or identifying analytics cookies. There is no banner asking for consent either, for the simple reason that there is nothing to ask about. There is one cookie and a handful of items in your browser's storage, all of them needed for the service to work, and all of them listed here.

This English text is provided for convenience. The Hebrew version of this document is the one that governs: מדיניות עוגיות ואחסון בדפדפן.

1. What there is

Name	Kind	Why	Life
`qder_session`	Cookie	To remember that you are signed in. Sent only over HTTPS, not readable by JavaScript, and never sent from another site.	Until you sign out or the session lapses
The table session	Browser storage (sessionStorage)	To remember which table you are sitting at as you move between screens. Not a cookie, so it is never sent automatically with a request.	Until the tab closes, and in any case the server ends the session after 4 hours
A random visitor string	Browser storage	To give the conversation on the home page a random "name" so the server can rate-limit without identifying you. Linked to nothing else.	Until the tab closes
The allergens you named in the conversation	Browser storage (sessionStorage)	Sensitive information. When you tell the waiter you are allergic to something, your browser remembers which allergens were named so the menu can mark them at once. Kept on your device only, never sent to any measurement tool, and it never leaves this table.	Until the tab closes
Your basket	Browser storage (sessionStorage)	What you have chosen and not yet sent to the kitchen, so a refresh does not lose it. Tied to the table session.	Until the tab closes
The menu language	Browser storage (sessionStorage)	To remember which language you asked to see the menu in.	Until the tab closes
Carrying the conversation from the concierge to the table	Browser storage (sessionStorage)	So what you typed before scanning the code travels with you to the table screen.	Deleted the moment it is read
Your place in the waiting list	Browser storage (localStorage)	The id of your entry in the branch's waiting list, so we can show you the queue after a refresh.	Until you leave the list or clear the site's data
Site language	Browser storage (localStorage)	To remember whether you chose Hebrew or English on the diner pages.	Until you clear the site's data
`qder_privacy` and the preference beside it	Cookie + browser storage (localStorage)	Your decision in the settings panel further down this page. It holds two letters and a digit per category and nothing else: no name, no identifier and no link to an account. The server reads it only to decide whether a measurement script may run at all.	One year, or until you clear the site's data
The message you started typing	Browser storage	So the question you wrote on the home page travels with you to the chat screen.	Deleted the moment it is read
Assistant panel state (staff only)	Browser storage	To remember whether the assistant panel was open.	Until the tab closes
A copy of the conversation with the digital waiter	Browser storage (localStorage)	So the conversation at the table does not vanish if you lock your phone or refresh the page. Kept on your device only, for this table only.	48 hours, then deleted from the device
The first-time hints at the table	Browser storage (localStorage)	To remember which short explanations you have already seen, so they are not shown again. It does not identify you.	Until you clear the site's data
Theme (staff)	Browser storage (localStorage)	To remember whether you chose dark or light mode in the panels and the kitchen screen.	Until you clear the site's data
The processor chosen on the setup screen (staff)	Browser storage (localStorage)	To remember which payment processor was selected on the setup screen, so it is not lost on a refresh. No keys are kept in it.	Until you clear the site's data
`qder_next`	Cookie	When signing in with Google or Microsoft: to remember which page to return you to once the provider confirms. It contains a page address and nothing else.	10 minutes, deleted as soon as sign-in finishes
"Not now" on the passkey suggestion	Browser storage (localStorage)	To remember that you asked not to be shown the passkey suggestion on the account page again.	Until you clear the site's data
Status page language	Browser storage (localStorage)	On status.qder.ai: to remember whether you chose Hebrew or English.	Until you clear the site's data
CF_Authorization (Qder staff only)	Cloudflare cookie	Created only for someone signing in to our internal operations console through Cloudflare Access. Diners and restaurants never receive it.	Up to 12 hours

All of these are needed for the service to work. Under Israeli and European law, uses like these do not require prior consent, which is why we do not show a banner asking for it. The conversation with the digital waiter is kept in three places: a copy in your browser for 48 hours (the row above), the most recent messages on the server for 24 hours, tied to the table rather than to you, and a scrubbed log of the conversation (no name, email or phone) for 90 days, to improve the waiter at that restaurant. All of it is explained in the privacy policy.

2. What there is not

No Google Analytics and no analytics tool that identifies you. The only measurement is Cloudflare Web Analytics, which counts page views with no cookie, no device identifier and no profile — an aggregate count at the infrastructure that serves the site anyway. It appears in the settings panel below under "Measurement", and you can switch it off there.
No Facebook, TikTok or any advertising network pixels.
No third-party cookies at all.
No cross-site user profile and no sharing of information with advertisers.

Our pages run under a Content Security Policy that blocks scripts from outside sources, so a tracking tool cannot be loaded even by accident. That policy follows your setting: when you switch "Measurement" off, the address of the measurement script stops appearing in the policy and the browser itself blocks it — even if the infrastructure tries to add it to the page. It is a real switch, not a polite request.

3. Nothing is loaded from outside

Even the site's fonts are served from our own server. Your browser does not contact any third-party server to display these pages — not Google Fonts and not an advertising network — and your IP address reaches only us and the infrastructure that hosts us.

4. The payment page

When you pay, you move to the page of the restaurant's payment processor. Whatever that page stores in your browser is governed by its policy, not ours.

5. Your settings

This panel is live: it shows what may be kept on this device and lets you change it. Categories with nothing in them are marked as such, because we do not show a switch that does nothing.

6. Controlling it from the browser too

You can delete what is stored in your browser through your browser's settings, at any time. Deleting the table session means you will have to scan the code on the table again. None of this affects an order already sent to the kitchen.