Privacy policy

Account data

When you create an account we store your name, email address and a hashed password. If you sign in with Google, we store the email address and name Google gives us and no password. We use the email to sign you in, to confirm the address, to send password-reset links and to send invitations you asked for. We do not sell it or use it for advertising.

If you turn on two-factor authentication, we store the encrypted secret for your authenticator app and hashed backup codes. We also keep a list of your signed-in devices (browser, system, network address and last activity) so you can review and sign them out.

Workspace and QR code data

QR codes belong to a workspace. For each code we store the name you give it, the destination and everything you type into a hosted page (texts, prices, links, coupon codes), the style options, the rules, the campaign notes and the short code inside the QR image. Photos, clips and files you upload are stored with our file host and are reachable by anyone who has their link.

Every member of the workspace can see and edit this data. Owners and admins also manage members, API keys and webhooks.

Scan data

When someone scans one of your codes, our server records the time of the scan, the device type, the browser name, the operating system name, the referring page, and the country and city estimated by our hosting provider from the network address. We do not store the network address or any name. To count unique visitors and to stop double ratings, we store a one-way hash (an irreversible fingerprint) of the network address and browser for each scan and each rating; it cannot be turned back into the address. The workspace sees this data as statistics. If a visitor leaves a rating or a comment on a feedback page, the rating and comment are stored with the code.

Cookies

We use one session cookie to keep you signed in and one to remember the language. There are no advertising or tracking cookies. People who only scan a code receive no cookie from us, with one exception: after entering the password of a protected code, the visitor's browser gets a cookie that remembers the unlock for one hour.

Service providers

The application runs on Vercel, the database is hosted by Turso, uploaded files are stored with Vercel Blob, and emails are sent through Resend. Google handles the optional Google sign-in. These providers process data only to run the service.

Deleting your data

You can delete any QR code, including its scan history, ratings and uploaded files, at any time. You can delete your whole account from the settings page. Workspaces where you are the only member are deleted with their codes, statistics, files, keys and webhooks. Workspaces you share with other people stay, because their codes are still in use; your membership is removed.

Contact

Questions about this policy: write to the operator of qr-kode.io.