Last updated October 29, 2026
Privacy policy
Who we are
/qr is operated by the operator of /qr, which is responsible for your personal data (the “controller”). You can reach us about anything in this policy at privacy@yourdomain.com.
Static QR codes: nothing is collected
When you create a static code, everything happens in your browser. The content you type (links, Wi-Fi passwords, contact details) and any logo you upload are never sent to our servers, and you don’t need an account.
What we collect
| Information | When | Why |
|---|---|---|
| Email address and password | You create an account | To sign you in and contact you about your account. Passwords are stored only as a secure hash. |
| Dynamic code details: name, destination link, design, and logo | You create or edit a dynamic code | To show and forward your code. This is the service you asked for. |
| Your plan and, once paid plans launch, billing status | You use or upgrade your plan | To apply plan limits and features. |
| Session cookie | You sign in | To keep you signed in. See the cookie notice. |
When someone scans a dynamic code
Scanning a dynamic code sends the visitor through /qr before they reach the destination. To give the code’s owner scan analytics, we record:
- the time of the scan;
- approximate location (country and city), derived from the IP address by our hosting provider;
- device type, operating system, and browser, derived from the browser’s user agent;
- the referring page, if the browser sends one.
We don’t store IP addresses. To count unique visitors, we store a one-way hash of the IP address, browser, date, and code. It changes every day and can’t be turned back into an IP address. We don’t set cookies on visitors, and link previews and known bots aren’t counted.
For this scan data, the owner of the code decides why it’s collected, and we process it on their behalf. If you scanned a code and have a question, contact the business that printed it, or us at privacy@yourdomain.com.
Legal bases (GDPR)
- Contract: account data and dynamic codes, to provide the service you signed up for.
- Legitimate interests: scan analytics for code owners, and keeping the service secure and free of abuse. We keep this minimal and privacy-friendly, as described above.
- Legal obligation: billing records, once paid plans launch.
Who we share data with
We don’t sell personal data or use it for advertising. We share it only with providers that run the service for us:
- Supabase for the database and sign-in;
- our hosting provider, which serves the website and adds approximate location to scans;
- a payment processor, once paid plans launch. We won’t see or store your full card number.
These providers may process data outside your country, including in the United States, under appropriate safeguards such as the EU Standard Contractual Clauses. We may also disclose data if the law requires it.
How long we keep it
- Account data: until you delete your account.
- Dynamic codes and their scan history: until you delete the code or your account.
- When you delete your account, your codes and scan data are deleted right away. Copies in encrypted backups are removed when those backups expire.
Your rights
Depending on where you live, you can ask to access, correct, export, or delete your data, and to object to or restrict how we use it. You can do most of this yourself: edit or delete codes from My codes, and delete your whole account from Account settings. For anything else, email privacy@yourdomain.com. You can also complain to your local data protection authority.
Security
Data is encrypted in transit, and our database controls access per account, so nobody else can read your codes or analytics. No system is perfectly secure, so please use a strong, unique password.
Children
/qr accounts are not meant for anyone under 16. If you believe a child has given us personal data, contact us and we’ll delete it.
Changes to this policy
If we make significant changes, we’ll update the date at the top and, if you have an account, tell you by email before they take effect.