Privacy

This page lists what QRCTools stores and why. It also says how to remove it.

What we store about you

• Your account. Your email address and display name, and the address of the profile photo Google provides if you sign in with Google. Firebase Authentication handles passwords, and we never see them.
• What you make. QR codes (name, content or destination, short code, style, tags), landing pages, folders, smart-QR rules and forms, folder sharing roles, and the invitations you send (the invitee's email and role).
• Your workspaces. The team workspaces you create or join, who is in each one and with which role, and invitations that are still waiting (email and role).
• Your brand. The brand kit you set up (logo address, colors, saved styles, landing-page theme, and whether our name shows on your pages), and the custom domains you add with the state of their DNS checks.
• Keys and connected apps. For each API key, its name, its first few characters, its access level and when it was last used. For each app you connect, such as ChatGPT or Claude, its name, where it sends you after sign-in, what it may do and when it was last used. We keep only one-way hashes of keys and tokens, never the keys themselves.

Checking the links you save

When you save a link a code opens, we send it to Google's Web Risk API, which checks it against Google's lists of unsafe sites. That covers the code's destination, the buttons on its landing page, and the links in its rules and form. We check again about once a day while people scan the code. Google gets the link and nothing about who saved it.

A link Google lists can't be saved, and a code whose link Google starts listing is switched off until you change it. We keep a one-way hash of each checked link with the answer, so we don't send the same link again for a few hours. We count how many new links each account has checked each day, so one account can't use up the checks for everyone, and drop the counts after two days.

When someone scans a code

For editable codes, each scan of a qrc.tools/r/ link records the time and the country the scan came from. It also records the referring site's host name if the browser sends one (never the rest of its address), a device class (phone, tablet or desktop), the names of the browser and operating system, and which smart-QR rule sent it on, if any.

If a code opens a form, we store each answer people give with its question, where their answers led and the time. We keep no IP address, browser details or hash with them. The code's owner can read and download them, and they are deleted with the code or the account.

We find the country by looking the scanner's IP address up in an offline copy of the IP to Country Lite database by DB-IP, licensed CC BY 4.0. The lookup runs in memory on our server. The IP address is not sent to anyone, stored or logged, and only the two-letter country code is kept.

To estimate unique visitors we store a one-way hash of the browser's user agent and language, combined with the date and a secret salt. We don't store IP addresses. The hash can't identify a person, and it can't connect one day's scans to another's.

When someone reports a code

Anyone can report a code on our report page. A report stores the code, what's wrong, what the person writes, the email address they give if they want an answer, and the time. We keep no IP address or browser details with it. To stop floods of reports, our server counts reports from each IP address for a few minutes, in memory only. It never stores or logs the address.

Only the QRCTools team reads reports, never the code's owner. We keep them as a record after we've dealt with them. Write to us to have yours removed.

When you use this site

We count visits to this site and the app with PostHog, an analytics service. It records which pages you open, the site that sent you, campaign tags in the address (such as utm_source), and your browser, its language, your operating system, device type and screen size. On public pages it also records which buttons and links you click.

It sets no cookies and stores nothing in your browser. To tell visits apart, PostHog's servers turn your IP address and browser into a one-way hash with a secret that changes every day. They may also look up the city and country you're in. Then they discard the IP address. The hash can't name you and can't connect one day's visits to another's.

Before anything is sent, we remove everything after the “?” in each address, except campaign tags. In your dashboard, your settings and the QR reader, we record which screen you opened, not what you clicked or what's on it. If your browser sends Do Not Track or Global Privacy Control, PostHog doesn't load at all. Neither do the pages people reach by scanning a code.

Cookies and storage

We set two cookies, and only once you sign in. __session keeps you signed in. qrc_verify_hidden remembers that you hid the reminder to confirm your email. It lasts 90 days and holds nothing else. Firebase Authentication keeps your sign-in state in your browser's storage. There are no advertising or third-party analytics cookies.

Who processes data for us

• Google Firebase and Google Cloud, for sign-in, the sign-in emails that come with it, hosting, and checking the links you save against Google's Web Risk lists.
• Neon, for the Postgres database that stores your account and codes.
• PostHog (United States), for counting visits to this site and the app.
• Resend, for the emails we send ourselves (invitations, account notices and report notices to our team), once we switch those on.

We don't sell or rent your data.

Your controls

• Export your profile, folders and codes (with their destinations, landing pages, tags and styles) from Settings, as a JSON file. A code's scans and its form answers download as CSV from that code's pages.
• Delete your account from Settings. This removes your profile, your personal workspace and everything in it (codes, folders, landing pages, rules, forms and their answers, scan history, brand kit and domains), your API keys and connected apps, and any team workspace where you are the only member. If you own a team workspace with other members, hand it over or delete it first. Codes you made in someone else's workspace stay there. Printed editable codes from your workspace stop working.

Contact

Write to support@qrc.tools with questions or requests about your data.