This policy explains what information QR.app collects when you use qr.app, why we collect it and the choices you have. We collect only what we need to run the service.
Who we are
QR.app ("QR.app", "we", "us") operates the website qr.app. For any question about this policy or your data, email support@qr.app.
The short version
- To create and download QR codes you need an account, which starts with a 7-day free trial. You can sign up with Google or with just your email address.
- We save the QR codes you download to your account so you can find them again. Only you can see them.
- We don’t use advertising or analytics trackers, and the only cookie we set keeps you signed in.
- We don’t sell your personal information or share it for advertising.
Information we collect
Account information. Your email address, how you signed up (Google or email), whether you have confirmed your address, and a securely hashed password if you choose to set one. When you sign in with Google, we receive your email address and basic profile information from Google, and we keep only your email address. When you create an account, we also record the IP address, browser, country and device type it was created from, to protect against abuse.
Sign-in cookie. When you sign in, we set a cookie in your browser that keeps you signed in. We don’t store a record of each sign-in.
Your QR codes. When you download a code while signed in, we store the QR code image (an SVG file), its name, type and design settings. The image contains the content of the code, such as a link, contact details or a WiFi password. For a dynamic code, we also store the link it redirects to. If you save a design to reuse it, we store its name, its settings and a preview image that includes your logo. If you use the API, we store a fingerprint (hash) of your API key, never the key itself, and when it was created and last used; codes you create with it are stored like any other code, and a logo you give as a web address is downloaded once to place it in the code.
Billing. If you subscribe, your payment is handled by Stripe. Your card details go directly to Stripe and we never see or store your full card number. We store your plan, its status and renewal date, your card’s brand, last four digits and expiry date, your successful payments (amount, date and invoice link), any refunds or disputes, the billing name, address and phone number you give us for invoices (also saved at Stripe), and, if you cancel, the reasons you chose.
Dynamic pages. For dynamic codes such as menus, business pages, coupons or galleries, we store the text, links and files (images, audio and PDFs) you add, so we can show them to people who scan the code. This content is public: anyone with the code or its link can see it.
Feedback from people who scan. If you create a Feedback code, the people who scan it can send a rating, a comment and, optionally, their email address. We store these responses with the country they came from and show them to you in your dashboard. For these responses, we process the data on your behalf, and you are responsible for using it lawfully.
Scans of dynamic codes. When someone scans a dynamic code, we record the date, the approximate location (country and city), the operating system and the type of device (phone, tablet or computer), and show these as statistics to the code’s owner. To find the location, the IP address of the person scanning is sent to our IP geolocation provider when the code is opened; we don’t store it. To count unique scans, we keep a one-way, keyed fingerprint of the IP address and browser that cannot be turned back into either. We don’t store the IP address of people who scan your codes.
Messages and sign-ups. If you use the contact form, we store your email address, your message and the IP address it was sent from. If you join the list for upcoming features, we store your email address and what you were interested in.
Where you came from. When you create an account, we save how you first found QR.app: the website that linked to us, and the campaign details in the link you used (such as utm_source, utm_campaign or an ad click id), if any. We use it to understand which channels and ads work.
Reports of abusive pages. If you report a QR.app page through our report form, we store the page, the reason and details you give, your email address if you add it, and the IP address, browser and country the report came from, so we can review it and prevent abuse of the form.
Abuse prevention. To limit how often certain actions can be taken, we keep counters linked to your IP address or email address. These counters are deleted within 24 hours.
Technical data. Like any website, our hosting provider and Cloudflare, our content delivery and security provider, process technical information such as your IP address, browser type and the pages you request, in order to deliver the site and protect it from attacks.
Cookies and similar technologies
We set one cookie, which keeps you signed in, and a short-lived cookie while you sign in with Google. Both are strictly necessary. Google sign-in also briefly uses your browser’s local storage to finish signing you in. We don’t use analytics or advertising cookies. Cloudflare may set strictly necessary security cookies to tell people and bots apart, including on the contact page, which is protected by Cloudflare Turnstile.
How we use your information
- To provide the service: your account, your saved QR codes, dynamic code redirects and scan counts, and hosting the PDFs your codes link to.
- To send you sign-in links, verification codes and other emails about your account.
- To send you a short series of emails after you sign up: a welcome, tips for getting more out of QR.app, an alert when one of your dynamic codes gets its first scan, a notice when your free trial ends, and alerts when people scan a code that is turned off because your account has no plan. Every one of these emails has an unsubscribe link, and you can also turn them off in your account settings. Emails about your account and billing are always sent. We don’t track whether you open these emails or click their links.
- To email you about new features you asked to hear about. Every such email lets you unsubscribe.
- To answer your messages.
- To keep QR.app secure, prevent abuse and enforce our Terms of Service.
- To comply with legal obligations.
Legal bases (EEA and UK visitors)
If you are in the European Economic Area or the United Kingdom, we process your data to provide the service you signed up for (your account, QR codes and hosted PDFs), with your consent (emails about upcoming features, which you can withdraw at any time), for our legitimate interest in helping you use QR.app (the tips and reminders after you sign up, which you can turn off at any time), and for our legitimate interests in keeping the service secure and answering your messages.
Who we share it with
We share information only with service providers that help us run QR.app, and only as needed for that purpose:
- our web hosting provider, which stores the site, the database and uploaded PDFs;
- Cloudflare, which delivers and protects the site and provides the security check on the contact page;
- Amazon Web Services, which stores the QR code files saved to your account and the files on your dynamic pages;
- Mailgun, which sends our emails, such as sign-in links;
- Stripe, which processes payments and stores your card details;
- ip-api, which tells us the approximate country and city of a scan from its IP address;
- Google, if you choose to sign in with Google.
All fonts and code libraries on qr.app are hosted on our own servers. Your browser only contacts these providers when you sign in with Google, use the contact page, or pay (the payment form is loaded from Stripe). Dynamic pages load images and audio from our storage at Amazon Web Services, and a video page plays its video from YouTube (in privacy-enhanced mode) or Vimeo when the code owner added one, under those services’ own privacy policies.
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or acquisition. If that happens, this policy will continue to apply to your information.
Uploaded files are accessible by link
A file you upload for a dynamic page (such as a PDF or an image) is available to anyone who has its link or scans its QR code. The link is random and hard to guess, and we tell search engines not to index it, but you should not upload documents that contain sensitive information.
How long we keep it
- Account information, saved QR codes and the content and files of their pages: until you delete them or ask us to delete your account.
- Feedback responses: for as long as the Feedback code exists.
- Scan statistics: for as long as the account exists. IP addresses of people who scan are never stored.
- Sign-in cookie: up to 60 days.
- Contact messages: as long as needed to answer you and keep a record of our conversation.
- Rate-limit counters: up to 24 hours.
- Technical data processed by our hosting provider and Cloudflare: according to their own retention periods, typically a few days to a few weeks.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw your consent. You can delete individual QR codes from your dashboard, and your whole account in your account settings once you have no active plan (we keep the payment records we need for accounting and taxes). To make any other request, email support@qr.app from the address on your account. If you want an uploaded PDF removed, include its link. We will respond within 30 days and won’t treat you differently for exercising your rights.
California residents have the right to know what personal information we collect, to request its deletion and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined by California law.
If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.
Security
All traffic to QR.app is encrypted with HTTPS. Passwords, sign-in links and verification codes are stored only as secure hashes, sign-in links and codes work once and expire within 30 minutes, saved QR code files are kept in private storage, and uploaded files get random names and can’t be executed on our servers. No system is perfectly secure, but we work to protect your information.
International transfers
QR.app is based in the United States. Our servers and service providers may be located in the United States, the European Union or other countries. Where required, we rely on appropriate safeguards for transfers of personal data.
Children
QR.app is not directed at children under 13, or under 16 in the EEA and UK, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as QR.app grows. We will change the date at the top of this page, and if the changes are significant, we will give notice on the site or by email.
Contact
Questions or requests? Email support@qr.app or use our contact form.